From 725845d0d8cd9254ce6a9e81721281e9c43f2aa0 Mon Sep 17 00:00:00 2001 From: Evan Reichard Date: Tue, 21 Jul 2026 21:48:07 -0400 Subject: [PATCH] docs(wasm32): record E3 bisection - store bug is aggregate, not one TB --- tcg/wasm32/tcg-target.c.inc | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/tcg/wasm32/tcg-target.c.inc b/tcg/wasm32/tcg-target.c.inc index 923b145ad9..52cdef8ad7 100644 --- a/tcg/wasm32/tcg-target.c.inc +++ b/tcg/wasm32/tcg-target.c.inc @@ -3372,12 +3372,12 @@ static void tcg_out_qemu_st(TCGContext *s, TCGOpcode opc, const TCGArg *args, bo { tcg_tci_out_qemu_ldst(s, opc, args); tcg_wasm_out_qemu_st(s, args, is_64); - /* ponytail: Store-Containing TBs Run on TCI - Upstream qemu-wasm sets this for every guest store; - * the compiled restartable-block store path is unfinished upstream (never runs there) and corrupts - * state (uzlib inflate reader font prewarm faults; native is fine). Ceiling: store-containing TBs - * interpreted (perf cost). Isolation needs per-op TCI (backend is whole-TB only) or reading the - * generated wasm; forcing loads-to-TCI instead also masks it because load TBs superset store TBs. - * Upgrade path: rewind-safe compiled stores, then drop this. See docs/wasm-inflate-panic.md. */ + /* ponytail: Store-Containing TBs Run on TCI - Upstream qemu-wasm sets this for every guest store. + * PC-windowed bisection (docs/wasm-inflate-panic.md E3) showed the corruption is NOT a single + * miscompiled TB: inflate, ROM+IRAM, flash-lower, and flash-upper each compile safely alone, but + * the full set corrupts. It is an aggregate timing/rewind or TB-instance race in the compiled + * store path, which is why upstream punts all store-TBs to TCI. Ceiling: store-TBs interpreted + * (perf cost). Upgrade path: make the restartable-block store path rewind/instance safe. */ wasm_tci_only_tb = true; } static void tcg_out_deposit_i32(TCGContext *s, TCGOpcode opc, TCGReg dest, TCGReg arg1, TCGReg arg2, int pos, int len)