[Draft] Update SMT-based ISLE verifier#13550
Conversation
Co-authored-by: Michael McLoughlin <mmcloughlin@gmail.com>
Co-authored-by: Michael McLoughlin <mmcloughlin@gmail.com>
Co-authored-by: Michael McLoughlin <mmcloughlin@gmail.com>
Co-authored-by: Michael McLoughlin <mmcloughlin@gmail.com>
Co-authored-by: Michael McLoughlin <mmcloughlin@gmail.com>
There was a problem hiding this comment.
Ah yes, thanks for spotting!
cfallin
left a comment
There was a problem hiding this comment.
This largely looks good! I skimmed over any spec/model/attr forms in the diffs of ISLE, and the cranelift/isle/veri tree in general; reviewed more carefully the bits that were touched in Cranelift and the ISLE compiler proper. Some logistical comments but nothing really substantial. Thanks for all the work in getting this in shape for upstreaming!
| } | ||
|
|
||
| fn add_binding(&mut self, id: BindingId, binding: &Binding) -> Result<()> { | ||
| dbg_depth!("add_binding"); |
There was a problem hiding this comment.
Does this debug code need to stay in-tree? (It looks like it's trying to help find very deeply nested invocations? In any case I'd rather not have the ad-hoc thread-local magic here if we don't need this check permanently)
There was a problem hiding this comment.
Oops, did not mean to include, removed!
Bump pest/pest_derive to 2.8.6, num-bigint to 0.4.6, and num-traits to 0.2.19 (version-floor hygiene; lock unchanged), and easy-smt 0.2 -> 0.3.2, adjusting for its ContextBuilder solver/solver_args split.
The symbolic-EXTR lift fix merged upstream (UQ-PAC/aslp#152), so asli no longer needs the fork. Pin it to the upstream merge commit (not yet in a tagged release). Regenerated specs are byte-identical.
da0f8f6 to
0465b1c
Compare
UQ-PAC/aslp 0.3.4 shipped with the symbolic-EXTR fix, so pin asli to the release tag instead of the merge commit. 0.3.4 differs from the previously pinned commit only by a CHANGES.md edit (no code change), so the generated specs are unaffected.
…iance#13590) They were immediately legalized into `op(x, bnot(y))` so instead we just emit those instructions immediately in `InstBuilder` convenience/backwards-compat methods.
…ytecodealliance#13593) * Cranelift: use the vmctx param directly in `vmctx_val` Return the function's `VMContext` special parameter instead of emitting a `global_value` instruction, which is exactly what the legalizer would desugar it into. * Cranelift: load the `*mut VMStoreContext` directly in `get_vmstore_context_ptr` * Cranelift: use the vmctx value directly in `epoch_ptr` Instead of via the `ir::GlobalValue`.
* Enable the Wasm GC proposal by default And also the function references proposal, which was effectively folded into the GC proposal. Resolves bytecodealliance#13216 Resolves bytecodealliance#5032 * Also update docs/stability-tiers.md * review feedback
…ytecodealliance#13582) * wizer: support init func as a wave function call (components only) * rustfmt * wizer: test program using wit interfaces and wave expressions * wizer: wasmtime-cli fixes and tests * wasmtime-cli: improve doc text for wizer and run --invoke * wizer: plumb through output of init func as Val / wave func results * rustfmt * fix test
* Update wasi-testsuite and get it running This commit updates wasi-testsuite to its latest revision and updates to run the new `*.json` infrastructure that's present. This involves more functionality such as making TCP connections, making HTTP requests, reading/writing stdio, etc. prtest:full * Try to add some debugging * Always serve on localhost
* Update webpki-roots dependency Move it onto the 1.x.y version track. * Update mutates to 0.5.x * Update similar to 3.x.y * Update cpp_demangle to 0.5.x * Add another license
Pull in a fix to ungate a test on Linux. Closes bytecodealliance#13396
* Set `IPV6_V6ONLY` for UDP sockets Addresses a failure in an upstream wasi-testsuite test. The remaining `sockets-udp-send` test is not fully passing just yet but this at least gets it a bit further. Closes bytecodealliance#12475 * Print more error information prtest:full * Windows error code
…iance#13600) * Cranelift: load the GC heap base directly in `get_gc_heap_base` * Cranelift: load the GC heap bound directly in `get_gc_heap_bound` * review feedback
…bytecodealliance#13599) Additionally slightly refactors `AliasRegionKey` to have a `Vm { ty: VmType, ... }` variant instead of `AliasRegionKey::VMContext` and `AliasRegionKey::VMStoreContext` variants (and `VMMemoryDefinition`, `VMTableDefinition`, etc... in commits to follow this one).
* Wasmtime: enable exception-handling by default. Following [discussion in the most recent Wasmtime meeting](https://github.com/bytecodealliance/meetings/blob/main/wasmtime/2026/wasmtime-06-04.md), and following the enablement by default of garbage collection (bytecodealliance#13594), we are now ready to ship [Wasm exception handling](https://github.com/WebAssembly/exception-handling) as well. It has been fuzzed for a while now, has good test coverage, has not had a reported bug for quite a while, and in general meets our requirements for tier-1 features. This PR thus promotes it to tier 1 (on all platforms, with the Cranelift compiler backend) and enables it by default. May exceptions be the norm! * Exceptions on by default only when `gc` build-time feature is enabled.
…13602) Upstream refactorings mean that we should be able to ratchet this for all tests now to keep them passing on all platforms. prtest:full
…tecodealliance#13608) * add test for `substituted_component_type` panic `Linker::substituted_component_type` builds a `types::Component` whose resource substitution map is `Some(..)` but only covers the component's *imported* resources. Introspecting an exported function that references an *exported* (non-imported) resource then panics with an index-out-of-bounds, because `InstanceType::resource_type` hard-indexes that partial map (`matching.rs`) instead of falling back to treating an absent resource as uninstantiated. This adds a test that builds a component exporting a resource plus a constructor returning `own<t>` and a method taking `borrow<t>`, then walks the introspected function types via `substituted_component_type`. It panics today (index out of bounds) and will pass once the resolver falls back gracefully. Assisted-by: claude:claude-opus-4-8 * fix panic on guest-exported resources `Linker::substituted_component_type` constructs the introspection type with `resources: Some(&cx.imported_resources)`, a map that only contains the component's *imported* resources. `InstanceType::resource_type` previously hard-indexed that map (`self.resources.map(|t| t[ty])`), so resolving a resource that is not in the map -- e.g. a resource the component *exports* -- panicked with an index-out-of-bounds whenever an exported function's params/results referenced it. Fix this by using a fallible lookup and falling back to `ResourceType::uninstantiated` when the resource is absent from the map, exactly as the `resources: None` path already does. This is the semantically correct behavior: a resource that has no substitution is "not (yet) instantiated", which is also what `Component::component_type()` relies on (it passes `resources: None`). With this fix the same safe, public introspection API no longer panics depending on which (also public) API produced the `types::Component`. Assisted-by: claude:claude-opus-4-8
…odealliance#13606) This commit updates the test to allow for timings that match non-wasmtime implementations (i.e. Jco), which may not report the intermediate error (`ErrorCode::HttpProtocolError`) ahead of the "real" expected error (`ErrorCode::HttpRequestBodySize`)
This helps keep wasm/clif-util using the same exact code and additionally removes the implicit assumption that tags are sorted which isn't always the case for wasm. The replacement isn't a perfect fit but it's workable enough for clif-util.
* Add bounds-checked unsafe intrinsics These intrinsics are similar to the unchecked versions, but instead of taking a raw address, take a base, offset, and length. They do a bounds check first, and trap on out-of-bounds accesses or perform the actual in-bounds access. When Spectre mitigations are enabled, their bounds check has Spectre mitigations applied. * review feedback * fix i686 tests in CI * fix i686 tests, take two prtest:full * Use `TranslateTrap` instead of emitting `trap[n]z` directly This means we will correctly call the raise-trap libcall when signals-based traps are disabled. However, it also means that `UnsafeIntrinsicCompiler` needed to be refactored a bit to take a `FuncBuilder` rather than a `FuncCursor`, and additionally take a generic `T: TranslateTrap`. This should fix the s390x errors in CI.
…alliance#13601) Rather than duplicating all the compilation of unsafe intrinsics.
* Consolidate wasm features in `config.rs` Use the `WASM3` fixed feature set which Wasmtime now implements by default. * Adjust some comments
* Add and complete i31 * Add forgotten import
Update the core ISLE verifier for formal, SMT-based checking of instruction lowering rules. This brings the implementation up-to-date with our work described at OOPSLA 2025, rather than the prior ASPLOS 2024 implementation.
The core improvements are:
veri chainto be automatically composed/inlined. This reduces the specification burden substantially. See the paper for details.aarch64backend, most machine instMinstspecifications are automatically derived from the authoritative ARM ASL reference, with our work building on the ASLp project to derive more targeted specifications for this domain.