1858969 - arm32: make MacroAssembler::wasmBoundsCheck32 handle offsets >= 4096

Status: RESOLVED FIXED

(Core :: JavaScript: WebAssembly, defect)

Description

[Julian Seward [:jseward]]

Attachment: Test case (scheme-wireworld-jsshell.zip)

wasm baseline on arm32 can generate a load instruction with an out-of-range
immediate. Unzip the attached test case, then:

./dist/bin/js --wasm-compiler=baseline --no-threads --no-ion --wasm-gc
--wasm-function-references --wasm-tail-calls ./run.js

produces

Assertion failure: data_ == imm, at js/src/jit/arm/Assembler-arm.h:626

Comment 1

[Julian Seward [:jseward]]

Attachment: Bug 1858969 - arm32: make MacroAssembler::wasmBoundsCheck32 handle offsets >= 4096. r=nbp.

On arm32, MacroAssembler::wasmBoundsCheck32 routes the load directly to
ma_ldr, but that can't handle an offset of more than 4095. This patch
routes it via ma_dataTransferN instead, which can handle any offset.
For the small-offset case, the generated code remains unchanged.

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/90d6f139028e
arm32: make MacroAssembler::wasmBoundsCheck32 handle offsets >= 4096.  r=nbp.

Comment 3

[Sandor Molnar[:smolnar]]

https://hg.mozilla.org/mozilla-central/rev/90d6f139028e