From e80c3c708863b30fef43609e5edf65398862f7f3 Mon Sep 17 00:00:00 2001 From: Evan Reichard Date: Wed, 22 Jul 2026 07:25:17 -0400 Subject: [PATCH] wasm32: E8 proves store bug is emergent (aggregate on 8-bit and 32-bit axes) --- tcg/wasm32/tcg-target.c.inc | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/tcg/wasm32/tcg-target.c.inc b/tcg/wasm32/tcg-target.c.inc index 739df2e2ef..265c1f5d96 100644 --- a/tcg/wasm32/tcg-target.c.inc +++ b/tcg/wasm32/tcg-target.c.inc @@ -3372,11 +3372,12 @@ static void tcg_out_qemu_st(TCGContext *s, TCGOpcode opc, const TCGArg *args, bo tcg_tci_out_qemu_ldst(s, opc, args); tcg_wasm_out_qemu_st(s, args, is_64); /* ponytail: Store-Containing TBs Run on TCI - Upstream qemu-wasm sets this for every guest store. - * Investigation (docs/wasm-inflate-panic.md E3-E7) narrowed it to the restartable-block rewind - * machinery around stores, not the store data codegen: both direct and helper store paths corrupt, - * a replay-skip precheck does not help, and the crash is deterministic but needs a byte-store TB - * and a 32-bit-store TB compiled together (counter-monotonic: adding 16-bit compilation hides it). - * Ceiling: store-TBs interpreted (perf cost). Upgrade path: fix restart/register handling. */ + * Investigation (docs/wasm-inflate-panic.md E1-E8) proved the corruption is emergent, not + * localizable: it is deterministic and needs both 8-bit and 32-bit store TBs compiled, yet no + * single PC region of either width reproduces it, and it survives disabling TB chaining, pinning + * instances, routing stores through the helper, and skipping replayed helpers. Whole-TB gating + * (the backend's only knob) cannot dissect it further; the fix needs generated-wasm inspection or + * per-op TCI. Ceiling: store-TBs interpreted (perf cost, ~30s book open). */ wasm_tci_only_tb = true; } static void tcg_out_deposit_i32(TCGContext *s, TCGOpcode opc, TCGReg dest, TCGReg arg1, TCGReg arg2, int pos, int len)