1663327 - Arm64 emulation of tbl instruction is broken

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect, P1)

Description

[Lars T Hansen [:lth]]

The emulation of tbl (Logic-vixl.cpp 2250 et seq) performs tbl in terms of tbx by first moving zero to the destination register and then invoking tbx. This is incorrect when the table register is the same as the destination register. The ARM ARM is clear that the destination is updated only when the instruction is complete; a temporary result is used to hold the bits as they are being computed, and this result is initialized to zero for tbl and to the destination register for tbx.

Affects only the WebAssembly SIMD work, no JS implact.

Comment 1

[Lars T Hansen [:lth]]

Attachment: Bug 1663327 - Fix emulation of tbl instruction. r?jseward

The emulation must use a temporary register to avoid clobbering the output register early.

Comment 2

[Lars T Hansen [:lth]]

Also fixed upstream, in a more principled manner: https://git.linaro.org/arm/vixl.git/tree/src/aarch64/logic-aarch64.cc#n3227

Comment 3

[Lars T Hansen [:lth]]

Attachment: Bug 1663327 - Fix emulation of tbl instruction. r?jseward

The emulation must use a temporary register to avoid clobbering the
output register early.

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/42ffc70267ab
Fix emulation of tbl instruction. r=jseward

Comment 5

[Alexandru Michis [:malexandru]]

https://hg.mozilla.org/mozilla-central/rev/42ffc70267ab