evan/qemu-xteink
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

wasm32: E8 proves store bug is emergent (aggregate on 8-bit and 32-bit axes)

Browse Source
This commit is contained in:
Evan Reichard
2026-07-22 07:25:17 -04:00
parent 3c064ae6c9
commit e80c3c7088
1 changed files with 6 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tcg/wasm32/tcg-target.c.inc
+6 -5
View File
@@ -3372,11 +3372,12 @@ static void tcg_out_qemu_st(TCGContext *s, TCGOpcode opc, const TCGArg *args, bo
tcg_tci_out_qemu_ldst(s, opc, args); tcg_tci_out_qemu_ldst(s, opc, args);
tcg_wasm_out_qemu_st(s, args, is_64); tcg_wasm_out_qemu_st(s, args, is_64);
/* ponytail: Store-Containing TBs Run on TCI - Upstream qemu-wasm sets this for every guest store. /* ponytail: Store-Containing TBs Run on TCI - Upstream qemu-wasm sets this for every guest store.
* Investigation (docs/wasm-inflate-panic.md E3-E7) narrowed it to the restartable-block rewind * Investigation (docs/wasm-inflate-panic.md E1-E8) proved the corruption is emergent, not
* machinery around stores, not the store data codegen: both direct and helper store paths corrupt, * localizable: it is deterministic and needs both 8-bit and 32-bit store TBs compiled, yet no
* a replay-skip precheck does not help, and the crash is deterministic but needs a byte-store TB * single PC region of either width reproduces it, and it survives disabling TB chaining, pinning
* and a 32-bit-store TB compiled together (counter-monotonic: adding 16-bit compilation hides it). * instances, routing stores through the helper, and skipping replayed helpers. Whole-TB gating
* Ceiling: store-TBs interpreted (perf cost). Upgrade path: fix restart/register handling. */ * (the backend's only knob) cannot dissect it further; the fix needs generated-wasm inspection or
* per-op TCI. Ceiling: store-TBs interpreted (perf cost, ~30s book open). */
wasm_tci_only_tb = true; wasm_tci_only_tb = true;
} }
static void tcg_out_deposit_i32(TCGContext *s, TCGOpcode opc, TCGReg dest, TCGReg arg1, TCGReg arg2, int pos, int len) static void tcg_out_deposit_i32(TCGContext *s, TCGOpcode opc, TCGReg dest, TCGReg arg1, TCGReg arg2, int pos, int len)