2054456 - Test failures in wasm/memory-riscv64-ion-codegen.js when huge memory is disabled

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Rong Bao [:csmantle]]

On riscv64-simulator with --disable-wasm-huge-memory or on riscv64 machines with Sv39 VA scheme, the following disassembly failed to match due to the extra bounds checks inserted without huge memory:

$ ./mach jit-test --ion -t 600 --args=--disable-wasm-huge-memory wasm/memory-riscv64-ion-codegen.js
[6|0|0|6]  66% ===================================>                   |   0.1s
---- codegen-riscv64-test.js: TEST FAILED ----
---- module text
(module
       (memory 1)
       (func (export "f") (result i32)
         (i32.load (i32.const 0x7fff_f7ff))))
---- actual
0x2e6d0dd9b540  ff810113       addi      sp, sp, -8
0x2e6d0dd9b544  00113023       sd        ra, 0(sp)
0x2e6d0dd9b548  ff810113       addi      sp, sp, -8
0x2e6d0dd9b54c  00813023       sd        fp, 0(sp)
0x2e6d0dd9b550  00010413       mv        fp, sp
0x2e6d0dd9b554  00300e93       li        t4, 3
0x2e6d0dd9b558  01d39463       bne       t2, t4, 8 -> 0x2e6d0dd9b560
0x2e6d0dd9b55c  0280006f       j         40 -> 0x2e6d0dd9b584
0x2e6d0dd9b560  c0035073       csrwi     csr_cycle, 0x6
0x2e6d0dd9b564  00000013       nop
0x2e6d0dd9b568  00000013       nop
0x2e6d0dd9b56c  00000013       nop
0x2e6d0dd9b570  ff810113       addi      sp, sp, -8
0x2e6d0dd9b574  00113023       sd        ra, 0(sp)
0x2e6d0dd9b578  ff810113       addi      sp, sp, -8
0x2e6d0dd9b57c  00813023       sd        fp, 0(sp)
0x2e6d0dd9b580  00010413       mv        fp, sp
0x2e6d0dd9b584  01443823       sd        s4, 16(fp)
0x2e6d0dd9b588  7ffff2b7       lui       t0, 0x7ffff
0x2e6d0dd9b58c  7ff2829b       addiw     t0, t0, 2047
0x2e6d0dd9b590  008a3e83       ld        t4, 8(s4)
0x2e6d0dd9b594  03d2f263       bgeu      t0, t4, 36 -> 0x2e6d0dd9b5b8
0x2e6d0dd9b598  7ffffeb7       lui       t4, 0x7ffff
0x2e6d0dd9b59c  01db8eb3       add       t4, s7, t4
0x2e6d0dd9b5a0  7ffea503       lw        a0, 2047(t4)
0x2e6d0dd9b5a4  00013403       ld        fp, 0(sp)
0x2e6d0dd9b5a8  00813083       ld        ra, 8(sp)
0x2e6d0dd9b5ac  01010113       addi      sp, sp, 16
0x2e6d0dd9b5b0  00008067       ret
0x2e6d0dd9b5b4  00000013       nop
0x2e6d0dd9b5b8  c0035073       csrwi     csr_cycle, 0x6

---- expected (initial)
lui       t4, 0x7ffff
     add       t4, s7, t4
     lw        a0, 2047\(t4\)
---- expected (as used)
addi\s+sp,\s+sp,\s+-8
sd\s+ra,\s+0\(sp\)
addi\s+sp,\s+sp,\s+-8
sd\s+fp,\s+0\(sp\)
mv\s+fp,\s+sp(
sd\s+s4,\s+16\(fp\))?
lui\s+t4,\s+0x7ffff
add\s+t4,\s+s7,\s+t4
lw\s+a0,\s+2047\(t4\)
ld\s+fp,\s+0\(sp\)
ld\s+ra,\s+8\(sp\)
addi\s+sp,\s+sp,\s+16
----
/home/mantle/workspace/mozilla-firefox-dev/js/src/jit-test/lib/codegen-test-common.js:104:13 Error: Assertion failed: got false, expected true
Stack:
  codegenTestShared_adhoc@/home/mantle/workspace/mozilla-firefox-dev/js/src/jit-test/lib/codegen-test-common.js:104:13
  codegenTestRISCV64_adhoc@/home/mantle/workspace/mozilla-firefox-dev/js/src/jit-test/lib/codegen-riscv64-test.js:35:28
  @/home/mantle/workspace/mozilla-firefox-dev/js/src/jit-test/tests/wasm/memory-riscv64-ion-codegen.js:84:25
Exit code: 3
FAIL - wasm/memory-riscv64-ion-codegen.js
[6|1|0|6]  77% =========================================>             |   0.1s

Comment 1

[Rong Bao [:csmantle]]

Attachment: Bug 2054456 - [riscv64] Use {no_prefix: true} under "special cases" in memory-riscv64-ion-codegen.js. r=anba!

Since WASM huge memory isn't available on riscv64 machines with Sv39
scheme, extra bounds checks are present in the generated code. Use
no_prefix to skip checking them.

Comment 2

[BugBot [:suhaib / :marco]]

Set release status flags based on info from the regressing bug 2051485

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/a0d72041a4a6
https://hg.mozilla.org/integration/autoland/rev/cb1827773a8f
[riscv64] Use {no_prefix: true} under "special cases" in memory-riscv64-ion-codegen.js. r=anba

Comment 4

[Sandor Molnar[:smolnar]]

https://hg.mozilla.org/mozilla-central/rev/cb1827773a8f

Comment 5

[BugBot [:suhaib / :marco]]

Set release status flags based on info from the regressing bug 2051485