Skip to content

Commit 8a9e7cc

Browse files
matthargettmatthargett
committed
pulley: trap on null in 8 fused funcref-dispatch handlers
Codex review on the rebeckerspecialties wasmtime fork PR pointed out that phase-2/3's continuation-block load absorption breaks the lazy-init slow path's correctness: the slow path's libcall rejoins `continuation_block` via a block param, and after absorption the loads are gone — `call_indirect` would see uninitialized `dst_code`/`dst_vmctx` if the slow path is ever reached. Fusion is gated on `is_eagerly_initialized_funcref_table` so the slow path is unreachable at runtime, but the previous handler's `ControlFlow::Continue(())` on null was advertised as defence-in- depth and was itself broken. Replace it with `done_trap` in the 8 affected handlers (4 forward + 4 `_not` variants across x64/x32 × xfuncref_dispatch/xband_funcref_dispatch). `offset` on the `_not` variants becomes vestigial; kept for encoding-shape parity.
1 parent 1318256 commit 8a9e7cc

4 files changed

Lines changed: 236 additions & 75 deletions

File tree

‎cranelift/codegen/src/isa/pulley_shared/inst/emit.rs‎

Lines changed: 92 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -407,12 +407,20 @@ fn pulley_emit<P>(
407407
match size {
408408
OperandSize::Size32 => {
409409
enc::xband32_s8_br_if_not_x32(
410-
&mut inverted, dst_writable, src_reg, mask_imm, 0,
410+
&mut inverted,
411+
dst_writable,
412+
src_reg,
413+
mask_imm,
414+
0,
411415
);
412416
}
413417
OperandSize::Size64 => {
414418
enc::xband64_s8_br_if_not_x64(
415-
&mut inverted, dst_writable, src_reg, mask_imm, 0,
419+
&mut inverted,
420+
dst_writable,
421+
src_reg,
422+
mask_imm,
423+
0,
416424
);
417425
}
418426
}
@@ -422,12 +430,20 @@ fn pulley_emit<P>(
422430
match size {
423431
OperandSize::Size32 => {
424432
enc::xband32_s8_br_if_not_x32(
425-
&mut inverted, dst_writable, src_reg, mask_imm, inv_rel,
433+
&mut inverted,
434+
dst_writable,
435+
src_reg,
436+
mask_imm,
437+
inv_rel,
426438
);
427439
}
428440
OperandSize::Size64 => {
429441
enc::xband64_s8_br_if_not_x64(
430-
&mut inverted, dst_writable, src_reg, mask_imm, inv_rel,
442+
&mut inverted,
443+
dst_writable,
444+
src_reg,
445+
mask_imm,
446+
inv_rel,
431447
);
432448
}
433449
}
@@ -482,12 +498,24 @@ fn pulley_emit<P>(
482498
match size {
483499
OperandSize::Size32 => {
484500
enc::xfuncref_dispatch_not_x32(
485-
&mut inverted, dst_code_w, dst_vmctx_w, src_reg, oc, ov, 0,
501+
&mut inverted,
502+
dst_code_w,
503+
dst_vmctx_w,
504+
src_reg,
505+
oc,
506+
ov,
507+
0,
486508
);
487509
}
488510
OperandSize::Size64 => {
489511
enc::xfuncref_dispatch_not_x64(
490-
&mut inverted, dst_code_w, dst_vmctx_w, src_reg, oc, ov, 0,
512+
&mut inverted,
513+
dst_code_w,
514+
dst_vmctx_w,
515+
src_reg,
516+
oc,
517+
ov,
518+
0,
491519
);
492520
}
493521
}
@@ -497,12 +525,24 @@ fn pulley_emit<P>(
497525
match size {
498526
OperandSize::Size32 => {
499527
enc::xfuncref_dispatch_not_x32(
500-
&mut inverted, dst_code_w, dst_vmctx_w, src_reg, oc, ov, inv_rel,
528+
&mut inverted,
529+
dst_code_w,
530+
dst_vmctx_w,
531+
src_reg,
532+
oc,
533+
ov,
534+
inv_rel,
501535
);
502536
}
503537
OperandSize::Size64 => {
504538
enc::xfuncref_dispatch_not_x64(
505-
&mut inverted, dst_code_w, dst_vmctx_w, src_reg, oc, ov, inv_rel,
539+
&mut inverted,
540+
dst_code_w,
541+
dst_vmctx_w,
542+
src_reg,
543+
oc,
544+
ov,
545+
inv_rel,
506546
);
507547
}
508548
}
@@ -513,12 +553,12 @@ fn pulley_emit<P>(
513553
sink.use_label_at_offset(taken_end - 4, *taken, LabelUse::PcRel);
514554
sink.add_cond_branch(*start_offset, taken_end, *taken, &inverted);
515555
patch_pc_rel_offset(sink, |sink| match size {
516-
OperandSize::Size32 => enc::xfuncref_dispatch_x32(
517-
sink, dst_code_w, dst_vmctx_w, src_reg, oc, ov, 0,
518-
),
519-
OperandSize::Size64 => enc::xfuncref_dispatch_x64(
520-
sink, dst_code_w, dst_vmctx_w, src_reg, oc, ov, 0,
521-
),
556+
OperandSize::Size32 => {
557+
enc::xfuncref_dispatch_x32(sink, dst_code_w, dst_vmctx_w, src_reg, oc, ov, 0)
558+
}
559+
OperandSize::Size64 => {
560+
enc::xfuncref_dispatch_x64(sink, dst_code_w, dst_vmctx_w, src_reg, oc, ov, 0)
561+
}
522562
});
523563
debug_assert_eq!(sink.cur_offset(), taken_end);
524564

@@ -559,12 +599,26 @@ fn pulley_emit<P>(
559599
match size {
560600
OperandSize::Size32 => {
561601
enc::xband_funcref_dispatch_not_x32(
562-
&mut inverted, dm_w, dc_w, dv_w, src_reg, oc, ov, 0,
602+
&mut inverted,
603+
dm_w,
604+
dc_w,
605+
dv_w,
606+
src_reg,
607+
oc,
608+
ov,
609+
0,
563610
);
564611
}
565612
OperandSize::Size64 => {
566613
enc::xband_funcref_dispatch_not_x64(
567-
&mut inverted, dm_w, dc_w, dv_w, src_reg, oc, ov, 0,
614+
&mut inverted,
615+
dm_w,
616+
dc_w,
617+
dv_w,
618+
src_reg,
619+
oc,
620+
ov,
621+
0,
568622
);
569623
}
570624
}
@@ -574,12 +628,26 @@ fn pulley_emit<P>(
574628
match size {
575629
OperandSize::Size32 => {
576630
enc::xband_funcref_dispatch_not_x32(
577-
&mut inverted, dm_w, dc_w, dv_w, src_reg, oc, ov, inv_rel,
631+
&mut inverted,
632+
dm_w,
633+
dc_w,
634+
dv_w,
635+
src_reg,
636+
oc,
637+
ov,
638+
inv_rel,
578639
);
579640
}
580641
OperandSize::Size64 => {
581642
enc::xband_funcref_dispatch_not_x64(
582-
&mut inverted, dm_w, dc_w, dv_w, src_reg, oc, ov, inv_rel,
643+
&mut inverted,
644+
dm_w,
645+
dc_w,
646+
dv_w,
647+
src_reg,
648+
oc,
649+
ov,
650+
inv_rel,
583651
);
584652
}
585653
}
@@ -589,12 +657,12 @@ fn pulley_emit<P>(
589657
sink.use_label_at_offset(taken_end - 4, *taken, LabelUse::PcRel);
590658
sink.add_cond_branch(*start_offset, taken_end, *taken, &inverted);
591659
patch_pc_rel_offset(sink, |sink| match size {
592-
OperandSize::Size32 => enc::xband_funcref_dispatch_x32(
593-
sink, dm_w, dc_w, dv_w, src_reg, oc, ov, 0,
594-
),
595-
OperandSize::Size64 => enc::xband_funcref_dispatch_x64(
596-
sink, dm_w, dc_w, dv_w, src_reg, oc, ov, 0,
597-
),
660+
OperandSize::Size32 => {
661+
enc::xband_funcref_dispatch_x32(sink, dm_w, dc_w, dv_w, src_reg, oc, ov, 0)
662+
}
663+
OperandSize::Size64 => {
664+
enc::xband_funcref_dispatch_x64(sink, dm_w, dc_w, dv_w, src_reg, oc, ov, 0)
665+
}
598666
});
599667
debug_assert_eq!(sink.cur_offset(), taken_end);
600668

0 commit comments

Comments
 (0)