bug2045312.js - mozsearch

Enable keyboard shortcuts

// Wasm Ion loop unrolling (js/src/jit/UnrollLoops.cpp): stale memory

// dependency on loads placed after an unrolled+peeled loop.

//

// Run:    js --fuzzing-safe --wasm-compiler=optimized poc.js   -> FAIL lines

//         js --fuzzing-safe --wasm-compiler=baseline  poc.js   -> all PASS

// Also reproduces with default flags after warmup (lazy tiering to Ion),

// and with -P wasm_unroll_loops=false the optimized run becomes correct.

//

// The loop alternates a/b between two structs each iteration and stores an

// incrementing counter into the current struct's field, then immediately

// reloads it:

//     S: a.f = c        (store)

//     L: v = a.f        (load, dependency() == S)

// After the loop, the field of the *first* struct is reloaded:

//     A: r = s0.f       (load, dependency() == S as well: S is the last

//                        aliasing store in RPO order)

//

// UnrollAndOrPeelLoop clones the loop body (peel + unroll factor 3) and

// remaps dependency() fields only for the *cloned* instructions

// (UnrollLoops.cpp, "For cloned instructions that have a (load) dependency

// field ..."). The dependency of A, which lies outside the loop, is left

// pointing at the original store S, which after peeling is the store of the

// once-executed peeled iteration. The cloned aliasing stores S1..S3 that

// now execute between S and A are not reflected in A's dependency.

//

// Peeling collapses the copy-0 header phi for `a` to its initial value s0,

// so in the GVN rerun after unrolling (which runs even with --ion-gvn=off)

// the peeled-iteration load L0 (= load s0.f, dep S) becomes congruent with

// A (= load s0.f, dep S) and A is replaced by L0. The function then returns

// the value of the *first* iteration's store instead of the last aliasing

// store: stores from all cloned loop iterations are lost.

let inst = wasmEvalText(`(module

  (type $S (struct (field (mut i32))))

  (func (export "f") (param $n i32) (result i32)

    (local $a (ref null $S)) (local $b (ref null $S)) (local $t (ref null $S))

    (local $s0 (ref null $S))

    (local $i i32) (local $c i32) (local $sum i32) (local $v i32)

    (local.set $s0 (struct.new_default $S))

    (local.set $a (local.get $s0))

    (local.set $b (struct.new_default $S))

    (local.set $c (i32.const 100))

    (loop $l

      ;; S: a.f = c

      (struct.set $S 0 (local.get $a) (local.get $c))

      ;; L: v = a.f   (same-iteration reload; dependency = S)

      (local.set $v (struct.get $S 0 (local.get $a)))

      (local.set $sum (i32.add (local.get $sum) (local.get $v)))

      ;; swap a <-> b

      (local.set $t (local.get $a))

      (local.set $a (local.get $b))

      (local.set $b (local.get $t))

      (local.set $c (i32.add (local.get $c) (i32.const 1)))

      (local.set $i (i32.add (local.get $i) (i32.const 1)))

      (br_if $l (i32.lt_u (local.get $i) (local.get $n)))

    ;; A: reload s0.f after the loop (stale dependency after unrolling)

    (i32.add (struct.get $S 0 (local.get $s0))

             (i32.mul (local.get $sum) (i32.const 65536)))))`);

// Reference implementation of the wasm function above.

function ref(n) {

  let s0 = 0, s1 = 0, cur = 0, c = 100, sum = 0;

  for (let i = 0; i < n; i++) {

    if (cur === 0) s0 = c; else s1 = c;

    sum += (cur === 0 ? s0 : s1);

    cur ^= 1;

    c++;

  return ((sum << 16) | s0) >>> 0;

let failures = 0;

for (let n = 1; n <= 10; n++) {

  let got = inst.exports.f(n) >>> 0;

  let want = ref(n);

  let ok = got === want;

  if (!ok) failures++;

assertEq(failures, 0);