evan/qemu-xteink
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Work around wasm32 store-TB miscompile (reader font decompression)

Browse Source 
A TB containing a guest store is miscompiled by the wasm backend: it
corrupts a pointer that a later load faults on. It reproduces in uzlib
inflate during the reader's font prewarm (browser panics with a rejected
Load access fault); native QEMU decompresses the same static flash font
fine, confirming a wasm32 codegen bug.

Force store-containing TBs onto the TCI interpreter as the working
workaround. Perf ceiling: those TBs no longer JIT-compile. Upgrade path:
localize the miscompiled op in tcg_wasm_out_qemu_st and drop this.
This commit is contained in:
Evan Reichard
2026-07-21 09:16:31 -04:00
parent d2bb76e672
commit 1f76f73fee
1 changed files with 7 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tcg/wasm32/tcg-target.c.inc
+7
View File
@@ -3372,6 +3372,13 @@ static void tcg_out_qemu_st(TCGContext *s, TCGOpcode opc, const TCGArg *args, bo
{
tcg_tci_out_qemu_ldst(s, opc, args);
tcg_wasm_out_qemu_st(s, args, is_64);
/* ponytail: Store-Containing TBs Run on TCI - The compiled wasm store path miscompiles a TB
* containing a guest store (corrupts a pointer a later load faults on; reproduces in uzlib
* inflate during reader font prewarm, native is fine). Forcing these TBs to the interpreter is
* the working workaround. Ceiling: every store-containing TB is interpreted (perf cost). Upgrade
* path: localize the miscompiled op in tcg_wasm_out_qemu_st and drop this. See
* docs/wasm-inflate-panic.md. */
wasm_tci_only_tb = true;
}
static void tcg_out_deposit_i32(TCGContext *s, TCGOpcode opc, TCGReg dest, TCGReg arg1, TCGReg arg2, int pos, int len)
{