docs(wasm): record B store-isolation experiments (E2)

2026-07-21 20:42:01 -04:00
parent 080a264b5c
commit a071badfe8
2 changed files with 14 additions and 1 deletions
@@ -114,6 +114,19 @@ isolation, which points away from the direct emit and toward the store path's
 surrounding block/rewind/helper scaffolding in `tcg_wasm_out_qemu_st`, or an
 interaction with a co-located op.

+### E2 — crash is icount-independent; loads-TCI also masks it (inconclusive on op)
+- Removed the store flag and ran at the new `noicount` default: **same crash**
+  (`Invalid read at 0x3FCB80A5`, drifts, `MEPC 0x4201e210`). So icount timing
+  is not the trigger.
+- Moved the flag to `tcg_out_qemu_ld` (loads TCI, stores compiled): **passed**
+  (33s). Not decisive — load-containing TBs are a superset of store-containing
+  TBs, so forcing loads to TCI drops nearly every TB (including all store TBs)
+  to the interpreter. It masks the bug the same way store-TCI does.
+- **Takeaway:** whole-TB TCI cannot isolate the offending op. Precise
+  localization needs per-op TCI infrastructure (backend is whole-TB) or reading
+  the generated wasm for one miscompiled TB. Large task; reader already works at
+  ~31s with the store flag, so this is headroom, not a blocker.
+
 ### Next options
 1. **Ship E1 as a guarded workaround** — reader works now; measure real
   navigation/page-turn perf before judging it unacceptable.