Skip to content

Conversation

@alexcrichton
Copy link
Member

These failed to account for the edge case of 0/width(type) shifts where the shld instruction is no longer applicable. Guards are added to ensure that the shift amounts are both greater than zero.

This in theory shouldn't have much practical impact since shift-by-zero and shift-by-type-width are both optimized away in the mid-end. That means that this is only possible to expose with opt-level=0 which may help explain why this went undiscovered for ~1 year.

Closes #12318

These failed to account for the edge case of 0/width(type) shifts where
the `shld` instruction is no longer applicable. Guards are added to
ensure that the shift amounts are both greater than zero.

This in theory shouldn't have much practical impact since shift-by-zero
and shift-by-type-width are both optimized away in the mid-end. That
means that this is only possible to expose with opt-level=0 which may
help explain why this went undiscovered for ~1 year.

Closes bytecodealliance#12318
@cfallin cfallin added this pull request to the merge queue Jan 12, 2026
@github-merge-queue github-merge-queue bot removed this pull request from the merge queue due to failed status checks Jan 12, 2026
@alexcrichton
Copy link
Member Author

@cfallin mind double-checking the Winch-specific commit I added? Looks like Winch's encoding of shift-by-32 was using the immediate form of the instruction but that's not compatible with AArch64's encoding so it ended up encoding an illegal instruction.

Copy link
Member

@cfallin cfallin left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Latest commit to Winch looks fine too!

@alexcrichton alexcrichton added this pull request to the merge queue Jan 12, 2026
Merged via the queue into bytecodealliance:main with commit c65ba68 Jan 12, 2026
58 checks passed
@alexcrichton alexcrichton deleted the fix-shift-bug branch January 12, 2026 19:01
alexcrichton added a commit to alexcrichton/wasmtime that referenced this pull request Jan 12, 2026
* x64: Fix lowering rules for `shld`

These failed to account for the edge case of 0/width(type) shifts where
the `shld` instruction is no longer applicable. Guards are added to
ensure that the shift amounts are both greater than zero.

This in theory shouldn't have much practical impact since shift-by-zero
and shift-by-type-width are both optimized away in the mid-end. That
means that this is only possible to expose with opt-level=0 which may
help explain why this went undiscovered for ~1 year.

Closes bytecodealliance#12318

* Fix Winch's encoding of shift-by-32
alexcrichton added a commit that referenced this pull request Jan 12, 2026
* x64: Fix lowering rules for `shld`

These failed to account for the edge case of 0/width(type) shifts where
the `shld` instruction is no longer applicable. Guards are added to
ensure that the shift amounts are both greater than zero.

This in theory shouldn't have much practical impact since shift-by-zero
and shift-by-type-width are both optimized away in the mid-end. That
means that this is only possible to expose with opt-level=0 which may
help explain why this went undiscovered for ~1 year.

Closes #12318

* Fix Winch's encoding of shift-by-32
alexcrichton added a commit to alexcrichton/wasmtime that referenced this pull request Jan 14, 2026
* x64: Fix lowering rules for `shld`

These failed to account for the edge case of 0/width(type) shifts where
the `shld` instruction is no longer applicable. Guards are added to
ensure that the shift amounts are both greater than zero.

This in theory shouldn't have much practical impact since shift-by-zero
and shift-by-type-width are both optimized away in the mid-end. That
means that this is only possible to expose with opt-level=0 which may
help explain why this went undiscovered for ~1 year.

Closes bytecodealliance#12318

* Fix Winch's encoding of shift-by-32
cfallin pushed a commit that referenced this pull request Jan 14, 2026
* Fix ISLE optimization for vector inputs (#12179)

Add some more `fits_in_64` constraints to types to handle the fact that
`iconst_u` can't construct a 128-bit output.

Closes #12170

* x64: Fix lowering rules for `shld` (#12321)

* x64: Fix lowering rules for `shld`

These failed to account for the edge case of 0/width(type) shifts where
the `shld` instruction is no longer applicable. Guards are added to
ensure that the shift amounts are both greater than zero.

This in theory shouldn't have much practical impact since shift-by-zero
and shift-by-type-width are both optimized away in the mid-end. That
means that this is only possible to expose with opt-level=0 which may
help explain why this went undiscovered for ~1 year.

Closes #12318

* Fix Winch's encoding of shift-by-32

* Fix ISLE icmp optimization rules for vector inputs (#12335)

Closes #12328

* Add release notes

---------

Co-authored-by: Zijie Zhao <zzjas98@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Wasmtime fuzzbug: i32.shr_u with shift amount 32 produces divergent result under OptLevel::None

2 participants