bytecodealliance / bytecodealliance/wasmtime
fuzz: lacking coverage of sinkable loads in ISLE-generated x64 lowerings
- Dominant language
- Rust
- Stars
- 18.6k
- Forks
- 1.8k
- Avg merge
- 1d 18h
- Merged PRs (30d)
- 126
Description
@alexcrichton sent me a [coverage report] for the ISLE-generated lowerings for x64. I noticed by searching for "sinkable_load" that various operations (FP?) are not using the case where the load is sunk. In the Wasmtime meeting, @alexcrichton pointed out that the fact that we don't know whether the address is aligned could be preventing load-sinking here, but recall ([here]) that VEX- and EVEX-encoded instructions do not have the alignment restriction. Since @alexcrichton has been adding VEX-encoded versions of many instructions, I would think that we should be able to load-sink in that case (i.e., "can load sink MINUS alignment restriction" AND "have AVX").
[coverage report]: https://storage.googleapis.com/oss-fuzz-coverage/wasmtime/reports/20230425/linux/src/wasmtime/target/debug/build/cranelift-codegen-d3be7d5f89248fcc/out/isle_x64.rs.html
[here]: https://github.com/bytecodealliance/wasmtime/issues/4767#issuecomment-1432149408
I don't know what to do with this issue exactly, but @fitzgen thought I should record it as one. As mentioned in the Wasmtime meeting, it would be great to have better ways to find coverage gaps. This is at least one x64 lowering gap that I noticed (there are likely others) so here's an issue!
Contributor guide
Assessment
This issue has not been assessed yet.