Skip to content

[Draft] Update SMT-based ISLE verifier#13550

Draft
avanhatt wants to merge 62 commits into
bytecodealliance:mainfrom
avanhatt:upstream-06-02
Draft

[Draft] Update SMT-based ISLE verifier#13550
avanhatt wants to merge 62 commits into
bytecodealliance:mainfrom
avanhatt:upstream-06-02

Conversation

@avanhatt

@avanhatt avanhatt commented Jun 3, 2026

Copy link
Copy Markdown
Member

Update the core ISLE verifier for formal, SMT-based checking of instruction lowering rules. This brings the implementation up-to-date with our work described at OOPSLA 2025, rather than the prior ASPLOS 2024 implementation.

The core improvements are:

  1. Automatic rule chaining. Rather than requiring specifications on every ISLE term, terms can be marked veri chain to be automatically composed/inlined. This reduces the specification burden substantially. See the paper for details.
  2. For the aarch64 backend, most machine inst Minst specifications are automatically derived from the authoritative ARM ASL reference, with our work building on the ASLp project to derive more targeted specifications for this domain.
  3. Our state modeling now handles traps and other side effects more explicitly, see the paper for details.
  4. The specification language is more expressive, including structs and macros. See the language reference updates for details.

avanhatt and others added 6 commits June 3, 2026 15:04
Co-authored-by: Michael McLoughlin <mmcloughlin@gmail.com>
Co-authored-by: Michael McLoughlin <mmcloughlin@gmail.com>
Co-authored-by: Michael McLoughlin <mmcloughlin@gmail.com>
Co-authored-by: Michael McLoughlin <mmcloughlin@gmail.com>
Co-authored-by: Michael McLoughlin <mmcloughlin@gmail.com>
Comment thread cranelift/isle/veri/veri/log.txt Outdated

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Accidental commit?

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah yes, thanks for spotting!

@github-actions github-actions Bot added cranelift Issues related to the Cranelift code generator cranelift:area:aarch64 Issues related to AArch64 backend. cranelift:meta Everything related to the meta-language. labels Jun 3, 2026

@cfallin cfallin left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This largely looks good! I skimmed over any spec/model/attr forms in the diffs of ISLE, and the cranelift/isle/veri tree in general; reviewed more carefully the bits that were touched in Cranelift and the ISLE compiler proper. Some logistical comments but nothing really substantial. Thanks for all the work in getting this in shape for upstreaming!

Comment thread cranelift/codegen/meta/src/gen_isle.rs
Comment thread cranelift/codegen/src/isa/aarch64/inst/imms.rs
Comment thread cranelift/codegen/src/isa/aarch64/inst/regs.rs Outdated
Comment thread cranelift/codegen/src/isa/aarch64/inst.isle
Comment thread cranelift/codegen/src/spec/state.isle
Comment thread cranelift/isle/veri/aslp/Cargo.toml Outdated
Comment thread cranelift/isle/veri/test-macros/Cargo.toml Outdated
Comment thread cranelift/isle/veri/veri/src/veri.rs Outdated
}

fn add_binding(&mut self, id: BindingId, binding: &Binding) -> Result<()> {
dbg_depth!("add_binding");

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Does this debug code need to stay in-tree? (It looks like it's trying to help find very deeply nested invocations? In any case I'd rather not have the ad-hoc thread-local magic here if we don't need this check permanently)

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Oops, did not mean to include, removed!

mmcloughlin and others added 3 commits June 11, 2026 10:28
Bump pest/pest_derive to 2.8.6, num-bigint to 0.4.6, and num-traits to 0.2.19
(version-floor hygiene; lock unchanged), and easy-smt 0.2 -> 0.3.2, adjusting
for its ContextBuilder solver/solver_args split.
The symbolic-EXTR lift fix merged upstream (UQ-PAC/aslp#152), so asli no longer
needs the fork. Pin it to the upstream merge commit (not yet in a tagged
release). Regenerated specs are byte-identical.
mmcloughlin and others added 26 commits June 12, 2026 11:10
UQ-PAC/aslp 0.3.4 shipped with the symbolic-EXTR fix, so pin asli to the release
tag instead of the merge commit. 0.3.4 differs from the previously pinned commit
only by a CHANGES.md edit (no code change), so the generated specs are
unaffected.
…iance#13590)

They were immediately legalized into `op(x, bnot(y))` so instead we just emit
those instructions immediately in `InstBuilder` convenience/backwards-compat
methods.
…ytecodealliance#13593)

* Cranelift: use the vmctx param directly in `vmctx_val`

Return the function's `VMContext` special parameter instead of emitting a
`global_value` instruction, which is exactly what the legalizer would
desugar it into.

* Cranelift: load the `*mut VMStoreContext` directly in `get_vmstore_context_ptr`

* Cranelift: use the vmctx value directly in `epoch_ptr`

Instead of via the `ir::GlobalValue`.
* Enable the Wasm GC proposal by default

And also the function references proposal, which was effectively folded into the
GC proposal.

Resolves bytecodealliance#13216

Resolves bytecodealliance#5032

* Also update docs/stability-tiers.md

* review feedback
…ytecodealliance#13582)

* wizer: support init func as a wave function call (components only)

* rustfmt

* wizer: test program using wit interfaces and wave expressions

* wizer: wasmtime-cli fixes and tests

* wasmtime-cli: improve doc text for wizer and run --invoke

* wizer: plumb through output of init func as Val / wave func results

* rustfmt

* fix test
* Update wasi-testsuite and get it running

This commit updates wasi-testsuite to its latest revision and updates to
run the new `*.json` infrastructure that's present. This involves more
functionality such as making TCP connections, making HTTP requests,
reading/writing stdio, etc.

prtest:full

* Try to add some debugging

* Always serve on localhost
* Update webpki-roots dependency

Move it onto the 1.x.y version track.

* Update mutates to 0.5.x

* Update similar to 3.x.y

* Update cpp_demangle to 0.5.x

* Add another license
* Set `IPV6_V6ONLY` for UDP sockets

Addresses a failure in an upstream wasi-testsuite test. The remaining
`sockets-udp-send` test is not fully passing just yet but this at least
gets it a bit further.

Closes bytecodealliance#12475

* Print more error information

prtest:full

* Windows error code
…iance#13600)

* Cranelift: load the GC heap base directly in `get_gc_heap_base`

* Cranelift: load the GC heap bound directly in `get_gc_heap_bound`

* review feedback
…bytecodealliance#13599)

Additionally slightly refactors `AliasRegionKey` to have a `Vm { ty: VmType,
... }` variant instead of `AliasRegionKey::VMContext` and
`AliasRegionKey::VMStoreContext` variants (and `VMMemoryDefinition`,
`VMTableDefinition`, etc... in commits to follow this one).
* Wasmtime: enable exception-handling by default.

Following [discussion in the most recent Wasmtime
meeting](https://github.com/bytecodealliance/meetings/blob/main/wasmtime/2026/wasmtime-06-04.md),
and following the enablement by default of garbage collection (bytecodealliance#13594),
we are now ready to ship [Wasm exception
handling](https://github.com/WebAssembly/exception-handling) as well. It
has been fuzzed for a while now, has good test coverage, has not had a
reported bug for quite a while, and in general meets our requirements
for tier-1 features. This PR thus promotes it to tier 1 (on all
platforms, with the Cranelift compiler backend) and enables it by
default.

May exceptions be the norm!

* Exceptions on by default only when `gc` build-time feature is enabled.
…13602)

Upstream refactorings mean that we should be able to ratchet this for
all tests now to keep them passing on all platforms.

prtest:full
…tecodealliance#13608)

* add test for `substituted_component_type` panic

`Linker::substituted_component_type` builds a `types::Component` whose
resource substitution map is `Some(..)` but only covers the component's
*imported* resources. Introspecting an exported function that references
an *exported* (non-imported) resource then panics with an
index-out-of-bounds, because `InstanceType::resource_type` hard-indexes
that partial map (`matching.rs`) instead of falling back to treating an
absent resource as uninstantiated.

This adds a test that builds a component exporting a resource plus a
constructor returning `own<t>` and a method taking `borrow<t>`, then
walks the introspected function types via `substituted_component_type`.
It panics today (index out of bounds) and will pass once the resolver
falls back gracefully.

Assisted-by: claude:claude-opus-4-8

* fix panic on guest-exported resources

`Linker::substituted_component_type` constructs the introspection type
with `resources: Some(&cx.imported_resources)`, a map that only contains
the component's *imported* resources. `InstanceType::resource_type`
previously hard-indexed that map (`self.resources.map(|t| t[ty])`), so
resolving a resource that is not in the map -- e.g. a resource the
component *exports* -- panicked with an index-out-of-bounds whenever an
exported function's params/results referenced it.

Fix this by using a fallible lookup and falling back to
`ResourceType::uninstantiated` when the resource is absent from the map,
exactly as the `resources: None` path already does. This is the
semantically correct behavior: a resource that has no substitution is
"not (yet) instantiated", which is also what `Component::component_type()`
relies on (it passes `resources: None`). With this fix the same safe,
public introspection API no longer panics depending on which (also
public) API produced the `types::Component`.

Assisted-by: claude:claude-opus-4-8
…odealliance#13606)

This commit updates the test to allow for timings that match
non-wasmtime implementations (i.e. Jco), which may not report the
intermediate error (`ErrorCode::HttpProtocolError`) ahead of the
"real" expected error (`ErrorCode::HttpRequestBodySize`)
This helps keep wasm/clif-util using the same exact code and
additionally removes the implicit assumption that tags are sorted which
isn't always the case for wasm. The replacement isn't a perfect fit but
it's workable enough for clif-util.
* Add bounds-checked unsafe intrinsics

These intrinsics are similar to the unchecked versions, but instead of taking a
raw address, take a base, offset, and length. They do a bounds check first, and
trap on out-of-bounds accesses or perform the actual in-bounds access. When
Spectre mitigations are enabled, their bounds check has Spectre mitigations
applied.

* review feedback

* fix i686 tests in CI

* fix i686 tests, take two

prtest:full

* Use `TranslateTrap` instead of emitting `trap[n]z` directly

This means we will correctly call the raise-trap libcall when signals-based
traps are disabled. However, it also means that `UnsafeIntrinsicCompiler` needed
to be refactored a bit to take a `FuncBuilder` rather than a `FuncCursor`, and
additionally take a generic `T: TranslateTrap`.

This should fix the s390x errors in CI.
…alliance#13601)

Rather than duplicating all the compilation of unsafe intrinsics.
* Consolidate wasm features in `config.rs`

Use the `WASM3` fixed feature set which Wasmtime now implements by
default.

* Adjust some comments
* Add and complete i31

* Add forgotten import
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

cranelift:area:aarch64 Issues related to AArch64 backend. cranelift:meta Everything related to the meta-language. cranelift Issues related to the Cranelift code generator

Projects

None yet

Development

Successfully merging this pull request may close these issues.

10 participants