Wasmtime: Cranelift ARM64 and Spidermonkey integration

[bnjbvr]

Trying to keep track of all the remaining correctness issues in the new arm64 backend, found when running Spidermonkey test cases. I'll update this list as I find and understand more issues.

cc @julian-seward1 @cfallin

• [ ] anyref / reftypes integration. This is a large item that will require additional support in regalloc.rs too.
• [x] unpatched code locations should respect the emit_all_ones_funcaddrs setting (by putting all ones in unpatched code locations when this setting is set to true) => https://github.com/bytecodealliance/wasmtime/pull/1538
• [x] integer SDiv/UDiv must be legalized to a sequence that checks if the divisor is 0 (or if we're dividing INT_MIN by -1), when the avoid_div_traps setting is set to true. => #1585
• [x] ditto for modulo => #1585
• [x] float-to-int conversion must raise errors in some cases (out of bounds, NaN, inf) => https://github.com/bytecodealliance/wasmtime/pull/1578
• [x] (verify?) saturating conversions must return 0 for NaN
• [x] rotate_left by an amount larger than the integer's size is allowed (apply modulo on rotation amount) => #1584
• [x] there's something wrong when passing many FP/int registers on the stack (might be on the Spidermonkey side; to be investigated) => #1564
• [ ] trapif (as legalized from trapnz) may not take its input from an ifcmp, it seems
• [x] (verify?) popcnt is still incorrect for i32, see also #1537
• [x] lowering of stack store for call arguments is incorrect for large SP offsets => #1586

[github-actions[bot]]

Subscribe to Label Action

cc @bnjbvr

This issue or pull request has been labeled: "cranelift"

Thus the following users have been cc'd because of the following labels:

• bnjbvr: cranelift

To subscribe or unsubscribe from this label, edit the .github/subscribe-to-label.json configuration file.

Learn more.

[jgouly]

I'm working on a patch for the DIV by 0 and overflow issue.

[bnjbvr]

I'll take care of float-to-int conversions edge cases. edit: done in https://github.com/bytecodealliance/wasmtime/pull/1578

[cfallin]

I can take the trapif / ifcmp issue -- it's sort of a gnarly corner of isel. Also happy to fix rotate_left and the saturating conversions.

[bnjbvr]

I'm now looking at rotations. There are a few tricks we can steal from Spidermonkey's implementation... done => https://github.com/bytecodealliance/wasmtime/pull/1584

[bnjbvr]

Re trapif, investigation shows that a heap with explicit bounds checks will generate ifadd_cout to compute base+offset, then check for overflow with trapif if the carry flag is set. I'm happy to let others figure the right fix for this (this would require implementing ifadd_cout too, or lowering heap accesses with explicit bounds checks to something entirely different). Here's a test case extracted from Spidermonkey test suite.

function u0:0(i32, i64 vmctx) baldrdash_system_v {
    gv0 = vmctx
    gv1 = load.i64 notrap aligned gv0
    gv2 = load.i32 notrap aligned gv0+8
    heap0 = dynamic gv1, min 0x0001_0000, bound gv2, offset_guard 0xfff8, index_type i32

                                block0(v0: i32, v1: i64):
@0025                               v4 = load.i32 notrap aligned v1+8
@0025                               v5 = iconst.i32 0x7fff_ffe1
@0025                               v6, v7 = iadd_ifcout v0, v5
@0025                               trapif ult v7, heap_oob
@0025                               v8 = icmp ugt v6, v4
@0025                               brz v8, block3
@0025                               jump block2

                                block2:
@0025                               trap heap_oob

                                block3:
@0025                               v9 = uextend.i64 v0
@0025                               v10 = get_pinned_reg.i64 
@0025                               v2 = iadd v10, v9
@0025                               v3 = sload8.i32 v2+0x7fff_ffff
@002d                               jump block1

                                block1:
@002d                               fallthrough_return
}

[bnjbvr]

Confirmed that as of last Friday, Spidermonkey can run all the main tests, and only have the two remaining issues. I'll open up follow-up issues instead for both remaining items, because reftypes require a bunch of work in regalloc too, and heaps with explicit bounds checks is lower priority on arm64.

RESOLVED FIXED o/