1884708 - Scale::Invalid gets baked into MWasmStoreElementKA

Status: RESOLVED INVALID

(Core :: JavaScript: WebAssembly, defect)

Description

[Julian Seward [:jseward]]

BUILD: current m-c, x86_64-linux, configure

CC="ccache clang" CXX="ccache clang++" ../src/configure --enable-debug --enable-optimize="-g -O0" --disable-tests --disable-shared-js --disable-sysroot

Test case is bug1882772_poc6.js

RUN:

IONFLAGS=dump-mir-expr ./dist/bin/js --no-threads --no-ion --wasm-compiler=ion /nfs/compx/bug1882772_poc6.js

Fails when printing the MIR at entry to OptimizeMIR, thusly:

Block35:
232 = Int32.phi 227 235
233 = None.wasmstoreelementkaHit MOZ_CRASH(Unknown Scale) at /nfs/compx/MC_SCALE/js/src/jit/shared/Assembler-shared.h:122

RUN (MORE):

Apply attached patch "assert_valid_scale.diff"

Build; rerun:

./dist/bin/js --no-threads --no-ion --wasm-compiler=ion /nfs/compx/bug1882772_poc6.js

Assertion failure: IsValidScale(scale), at /nfs/compx/MC_SCALE/js/src/jit/MIR.h:11707

This is writeGcValueAtBasePlusScaledIndex calling
MWasmStoreElementKA::MWasmStoreElementKA.

Comment 1

[Julian Seward [:jseward]]

Attachment: assert_valid_scale.diff as referred to in comment 0

Comment 2

[Ben Visness [:bvisness]]

This is not a bug. We deliberately pass Scale::Invalid to MWasmStoreElementKA when storing v128 values. Since there is no Scale::TimesSixteen in hardware, v128 scales must be computed manually; this is already handled correctly in CodeGenerator.