evan/qemu-xteink
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

docs(wasm32): record E3 bisection - store bug is aggregate, not one TB

Browse Source
This commit is contained in:
Evan Reichard
2026-07-21 21:48:07 -04:00
parent b3ca9f1eb6
commit 725845d0d8
1 changed files with 6 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tcg/wasm32/tcg-target.c.inc
+6 -6
View File
@@ -3372,12 +3372,12 @@ static void tcg_out_qemu_st(TCGContext *s, TCGOpcode opc, const TCGArg *args, bo
{
tcg_tci_out_qemu_ldst(s, opc, args);
tcg_wasm_out_qemu_st(s, args, is_64);
/* ponytail: Store-Containing TBs Run on TCI - Upstream qemu-wasm sets this for every guest store;
* the compiled restartable-block store path is unfinished upstream (never runs there) and corrupts
* state (uzlib inflate reader font prewarm faults; native is fine). Ceiling: store-containing TBs
* interpreted (perf cost). Isolation needs per-op TCI (backend is whole-TB only) or reading the
* generated wasm; forcing loads-to-TCI instead also masks it because load TBs superset store TBs.
* Upgrade path: rewind-safe compiled stores, then drop this. See docs/wasm-inflate-panic.md. */
/* ponytail: Store-Containing TBs Run on TCI - Upstream qemu-wasm sets this for every guest store.
* PC-windowed bisection (docs/wasm-inflate-panic.md E3) showed the corruption is NOT a single
* miscompiled TB: inflate, ROM+IRAM, flash-lower, and flash-upper each compile safely alone, but
* the full set corrupts. It is an aggregate timing/rewind or TB-instance race in the compiled
* store path, which is why upstream punts all store-TBs to TCI. Ceiling: store-TBs interpreted
* (perf cost). Upgrade path: make the restartable-block store path rewind/instance safe. */
wasm_tci_only_tb = true;
}
static void tcg_out_deposit_i32(TCGContext *s, TCGOpcode opc, TCGReg dest, TCGReg arg1, TCGReg arg2, int pos, int len)