1687936 - Arm64 simulator misexecutes uminv, umaxv, sminv, smaxv

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect, P1)

Description

[Lars T Hansen [:lth]]

The simulator misexecutes the vector-reduction min and max opcodes when src==dest, because it clears the destination register before reading the source register. (We've seen this kind of bug before in the simulator. I made a pass through Logic-vixl.cpp now to look for other cases but found no more than these.)

As Cranelift cleverly emits uminv for the all_true opcodes, and all_true is used extensively across the test suite to check results, the world burns when we run the SIMD tests with Cranelift.

We did not notice this before because there's a bug in moz.configure: wasm simd is disabled on the simulator. That code dates to May 2020, when I landed some initial work for wasm simd. Will fix as part of this patch.

Comment 1

[Lars T Hansen [:lth]]

Attachment: Bug 1687936 - Fix uminv/umaxv/sminv/smaxv; fix config. r?nbp

Fix the vector min/max reductions to not overwrite the source before writing the
destination, if src == dest.

Fix moz.configure to enable wasm simd by default even if we're running on the
simulator, this was a bug that has prevented us from testing cranelift
(and the simulator, as this bug shows) as well as we should, up until now.

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/e4fe21125777
Fix uminv/umaxv/sminv/smaxv; fix config. r=nbp

Comment 3

[Natalia Csoregi [:nataliaCs]]

Backed out for spidermonkey bustage

backout: https://hg.mozilla.org/integration/autoland/rev/87fc8320394fff94d5a47651e4a2d95143d71880

push: https://treeherder.mozilla.org/jobs?repo=autoland&searchStr=linux%2Cdebug%2Cspidermonkey%2Cbuilds%2Cspidermonkey-sm-arm-sim-linux32%2Fdebug%2Carm&revision=becb6a284f3835529cab8da85591874785a8cab4&selectedTaskRun=f8hoz5luQK6xIRPHxN5SqA.1

failure log: https://treeherder.mozilla.org/logviewer?job_id=327726708&repo=autoland&lineNumber=551

[task 2021-01-25T19:14:04.246Z] ERROR: --enable-wasm-simd only possible when targeting the x86_64/x86/arm64 jits
[task 2021-01-25T19:14:04.298Z] Traceback (most recent call last):
[task 2021-01-25T19:14:04.298Z] File "/builds/worker/checkouts/gecko/js/src/devtools/automation/autospider.py", line 514, in <module>
[task 2021-01-25T19:14:04.298Z] check=True,
[task 2021-01-25T19:14:04.298Z] File "/builds/worker/checkouts/gecko/js/src/devtools/automation/autospider.py", line 429, in run_command
[task 2021-01-25T19:14:04.298Z] raise subprocess.CalledProcessError(status, command, output=stderr)
[task 2021-01-25T19:14:04.298Z] subprocess.CalledProcessError: Command '['sh', '-c', '/builds/worker/checkouts/gecko/js/src/configure --enable-stdcxx-compat --disable-gold --enable-simulator=arm --target=i686-pc-linux --enable-rust-simd --enable-optimize --enable-debug --target=i686-pc-linux --enable-nspr-build --prefix=/builds/worker/workspace/obj-spider/dist']' returned non-zero exit status 1.
[task 2021-01-25T19:14:04.305Z] + BUILD_STATUS=1
[task 2021-01-25T19:14:04.305Z] + upload=0
[task 2021-01-25T19:14:04.305Z] + '[' -n '' ']'
[task 2021-01-25T19:14:04.306Z] + '[' 0 = 1 ']'
[task 2021-01-25T19:14:04.306Z] + cat
[task 2021-01-25T19:14:04.306Z] + exit 1
[taskcluster 2021-01-25 19:14:06.650Z] === Task Finished ===
[taskcluster 2021-01-25 19:14:07.164Z] Unsuccessful task run with exit code: 1 completed in 486.595 seconds

Comment 4

[Lars T Hansen [:lth]]

Bug in the moz.configure change, will be tweaked.

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/229e636bcc05
Fix uminv/umaxv/sminv/smaxv; fix config. r=nbp

Comment 6

[Andreea Pavel [:apavel]]

https://hg.mozilla.org/mozilla-central/rev/229e636bcc05