1661723 - Cranelift: test failure when running WPT wasm/jsapi/constructors/multi-value.any.js

Status: RESOLVED FIXED

(Core :: JavaScript: WebAssembly, defect)

Description

[Benjamin Bouvier [:bbouvier] (inactive)]

Can be reproduced with the following mach line:

./mach jstests --shell /path/to/shell/dist/bin/js --wpt=enabled wasm

Results:

## wasm/jsapi/constructor/multi-value.any.js: rc = -11, run time = 1.634538

Harness status: CRASH (Exit code reported crash)
REGRESSION - wasm/jsapi/constructor/multi-value.any.js

Still needs to be investigated.

Comment 1

[Benjamin Bouvier [:bbouvier] (inactive)]

Reduced test case, definitely related to multi-value:

let { exports } = new WebAssembly.Instance(
    new WebAssembly.Module(wasmTextToBinary(`
    (module
        (func (import "module" "fn") (param f64 i32) (result i32 f64))
        (func (export "f") (result i32)
            f64.const 4.2
            i32.const 7
            call 0
            drop
        )
    )
    `)),
    {
        "module": {
          fn(f32, i32) {
            assertEq(f32, 4.2);
            assertEq(i32, 7);
            return [2, 7.3];
          },
        }
    });

assertEq(exports.f(), 2);

Comment 2

[Benjamin Bouvier [:bbouvier] (inactive)]

looking at the assembly of the cranelift's function body, right before the call, it seems that the double and the integer parameters are put in registers, and no stack space is provided to the callee for the multiple returns. This might be the fallout of a recent call ABI refactoring; will look on monday.

[Codegen] 0x7f8748a170b4  5c000040  ldr     d0, pc+8 (addr 0x7f8748a170bc)
[Codegen] 0x7f8748a170b8  14000003  b       #+0xc (addr 0x7f8748a170c4)
[Codegen] 0x7f8748a170bc  cccccccd  unallocated (Unallocated)
[Codegen] 0x7f8748a170c0  4010cccc  unallocated (Unallocated)
[Codegen] 0x7f8748a170c4  d28000e0  mov     x0, #0x7
[Codegen] 0x7f8748a170c8  2a0003e0  mov     w0, w0
[Codegen] 0x7f8748a170cc  d63f0020  blr     x1

Comment 3

[Benjamin Bouvier [:bbouvier] (inactive)]

Fixed by https://github.com/bytecodealliance/wasmtime/pull/2177; we'll need a crate bump, and I'll add the test to Spidermonkey, since it's simple enough and I recall it's the second time I run into this (at least in Cranelift).

Comment 4

[Benjamin Bouvier [:bbouvier] (inactive)]

Attachment: Bug 1661723; Bump Cranelift to a7f7c23bf9c37c642da962d575b7c99007918872; r=lth

Depends on D88395

Comment 5

[Benjamin Bouvier [:bbouvier] (inactive)]

Attachment: Bug 1661723: Add test case; r=lth

Depends on D88784

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/e3be5f8c4f2a
; Bump Cranelift to a7f7c23bf9c37c642da962d575b7c99007918872; r=lth
https://hg.mozilla.org/integration/autoland/rev/03aa9e68f1a5
Add test case; r=lth

Comment 7

[Narcis Beleuzu [:NarcisB]]

https://hg.mozilla.org/mozilla-central/rev/e3be5f8c4f2a
https://hg.mozilla.org/mozilla-central/rev/03aa9e68f1a5