From 1f76f73feef6dc0ecd956ac19e25cde2f7b905ba Mon Sep 17 00:00:00 2001 From: Evan Reichard Date: Tue, 21 Jul 2026 09:16:31 -0400 Subject: [PATCH] Work around wasm32 store-TB miscompile (reader font decompression) A TB containing a guest store is miscompiled by the wasm backend: it corrupts a pointer that a later load faults on. It reproduces in uzlib inflate during the reader's font prewarm (browser panics with a rejected Load access fault); native QEMU decompresses the same static flash font fine, confirming a wasm32 codegen bug. Force store-containing TBs onto the TCI interpreter as the working workaround. Perf ceiling: those TBs no longer JIT-compile. Upgrade path: localize the miscompiled op in tcg_wasm_out_qemu_st and drop this. --- tcg/wasm32/tcg-target.c.inc | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/tcg/wasm32/tcg-target.c.inc b/tcg/wasm32/tcg-target.c.inc index bbdb2de88f..4298fbe598 100644 --- a/tcg/wasm32/tcg-target.c.inc +++ b/tcg/wasm32/tcg-target.c.inc @@ -3372,6 +3372,13 @@ static void tcg_out_qemu_st(TCGContext *s, TCGOpcode opc, const TCGArg *args, bo { tcg_tci_out_qemu_ldst(s, opc, args); tcg_wasm_out_qemu_st(s, args, is_64); + /* ponytail: Store-Containing TBs Run on TCI - The compiled wasm store path miscompiles a TB + * containing a guest store (corrupts a pointer a later load faults on; reproduces in uzlib + * inflate during reader font prewarm, native is fine). Forcing these TBs to the interpreter is + * the working workaround. Ceiling: every store-containing TB is interpreted (perf cost). Upgrade + * path: localize the miscompiled op in tcg_wasm_out_qemu_st and drop this. See + * docs/wasm-inflate-panic.md. */ + wasm_tci_only_tb = true; } static void tcg_out_deposit_i32(TCGContext *s, TCGOpcode opc, TCGReg dest, TCGReg arg1, TCGReg arg2, int pos, int len) {