Open cbeuw opened 7 months ago
It looks like you are multiplying a 128bit integer with a 16bit integer. I don't think that is possible in surface rust. Probably something the MIR verifier should be made to deny.
By multiplying I assume you meant shift right?
Shr
in MIR is documented with "The offset is truncated to the size of the first operand and made unsigned before shifting."
This surface Rust also triggers the same panic (though it has UB):
#![allow(arithmetic_overflow)]
pub fn fn13(mut _7:i8) {
let mut _31: (i128, i16) = (0,0);
let mut _25: i16 = 0;
let mut _39: i16 = 0;
_31.1 = _7 as i16;
_25 = _31.1 * _31.1;
_31 = (50414009528881047150422352225052180952_i128, _25);
_25 = _31.1 >> _31.0 as u128;
std::hint::black_box(_25);
}
pub fn main() {
fn13(0);
}
I misread the _25 = _31.1 * _31.1;
(i16 times itself) as _25 = _31.0 * _31.1;
(i128 times i16).
The only place where cg_clif emits an smulhi
is when multiplying with the left hand side being a 128bit integer: https://github.com/rust-lang/rustc_codegen_cranelift/blob/cdae185e3022b6e7c6c7fe363353fe1176a06604/src/num.rs#L257
This surface Rust also triggers the same panic (though it has UB):
I see. It doesn't have UB by the way. There is no unsafe code. Shifting with overflow is defined as panicking at runtime. The lint you suppressed only triggers when rustc knows the shift amount at compile time already.
In any case I can't reproduce this error on aarch64-unknown-linux-gnu, but I can reproduce it on x86_64-unknown-linux-gnu. It seems to be a Cranelift issue. I reduced it to:
test compile
set opt_level=speed
target x86_64
function u0:9(i8) -> i16 system_v {
block0(v0: i8):
v8 = sextend.i16 v0
v9 = imul v8, v8
v10 = iconst.i64 1000
v13 = sshr v9, v10 ; v10 = 1000
return v13
}
I've reported this upstream at https://github.com/bytecodealliance/wasmtime/issues/7865. Thanks for reporting this to me!
I've found something similar involving simd stuff, might be related:
auto-reduced (treereduce-rust):
#![crate_type = "lib"]
#![feature(repr_simd, platform_intrinsics)]
#[repr(simd)]
pub struct f32x2(pub f32, pub f32);
extern "platform-intrinsic" {
fn simd_fcos<T>(x: T) -> T;
}
pub unsafe extern "C-unwind" fn fcos_32x2(a: f32x2) -> f32x2 {
simd_fcos(a)
}
original:
````rust
// compile-flags: -C no-prepopulate-passes
#![crate_type = "lib"]
#![feature(repr_simd, platform_intrinsics)]
#![allow(non_camel_case_types)]
#[repr(simd)]
#[derive(Copy, Clone, PartialEq, Debug)]
pub struct f32x2(pub f32, pub f32);
#[repr(simd)]
#[derive(Copy, Clone, PartialEq, Debug)]
pub struct f32x4(pub f32, pub f32, pub f32, pub f32);
#[repr(simd)]
#[derive(Copy, Clone, PartialEq, Debug)]
pub struct f32x8(pub f32, pub f32, pub f32, pub f32,
pub f32, pub f32, pub f32, pub f32);
#[repr(simd)]
#[derive(Copy, Clone, PartialEq, Debug)]
pub struct f32x16(pub f32, pub f32, pub f32, pub f32,
pub f32, pub f32, pub f32, pub f32,
pub f32, pub f32, pub f32, pub f32,
pub f32, pub f32, pub f32, pub f32);
extern "platform-intrinsic" {
fn simd_fcos
Version information
rustc 1.78.0-nightly (bdc15928c 2024-02-12)
binary: rustc
commit-hash: bdc15928c8119a86d15e2946cb54851264607842
commit-date: 2024-02-12
host: x86_64-unknown-linux-gnu
release: 1.78.0-nightly
LLVM version: 17.0.6
Command:
/home/matthias/.rustup/toolchains/master/bin/rustc -Zcodegen-backend=cranelift
```
warning: the feature `platform_intrinsics` is internal to the compiler or standard library
--> /tmp/icemaker_global_tempdir.invhaiigiPnt/rustc_testrunner_tmpdir_reporting.y089HvaBptEQ/mvce.rs:2:23
|
2 | #![feature(repr_simd, platform_intrinsics)]
| ^^^^^^^^^^^^^^^^^^^
|
= note: using it is strongly discouraged
= note: `#[warn(internal_features)]` on by default
warning: type `f32x2` should have an upper camel case name
--> /tmp/icemaker_global_tempdir.invhaiigiPnt/rustc_testrunner_tmpdir_reporting.y089HvaBptEQ/mvce.rs:6:12
|
6 | pub struct f32x2(pub f32, pub f32);
| ^^^^^ help: convert the identifier to upper camel case (notice the capitalization): `F32x2`
|
= note: `#[warn(non_camel_case_types)]` on by default
warning: `extern` fn uses type `f32x2`, which is not FFI-safe
--> /tmp/icemaker_global_tempdir.invhaiigiPnt/rustc_testrunner_tmpdir_reporting.y089HvaBptEQ/mvce.rs:12:46
|
12 | pub unsafe extern "C-unwind" fn fcos_32x2(a: f32x2) -> f32x2 {
| ^^^^^ not FFI-safe
|
= help: consider adding a `#[repr(C)]` or `#[repr(transparent)]` attribute to this struct
= note: this struct has unspecified layout
note: the type is defined here
--> /tmp/icemaker_global_tempdir.invhaiigiPnt/rustc_testrunner_tmpdir_reporting.y089HvaBptEQ/mvce.rs:6:1
|
6 | pub struct f32x2(pub f32, pub f32);
| ^^^^^^^^^^^^^^^^
= note: `#[warn(improper_ctypes_definitions)]` on by default
warning: `extern` fn uses type `f32x2`, which is not FFI-safe
--> /tmp/icemaker_global_tempdir.invhaiigiPnt/rustc_testrunner_tmpdir_reporting.y089HvaBptEQ/mvce.rs:12:56
|
12 | pub unsafe extern "C-unwind" fn fcos_32x2(a: f32x2) -> f32x2 {
| ^^^^^ not FFI-safe
|
= help: consider adding a `#[repr(C)]` or `#[repr(transparent)]` attribute to this struct
= note: this struct has unspecified layout
note: the type is defined here
--> /tmp/icemaker_global_tempdir.invhaiigiPnt/rustc_testrunner_tmpdir_reporting.y089HvaBptEQ/mvce.rs:6:1
|
6 | pub struct f32x2(pub f32, pub f32);
| ^^^^^^^^^^^^^^^^
thread '
The multiplication issue has been fixed.
@matthiaskrgr I can't reproduce your crash. I had to change it to
#![crate_type = "lib"]
#![feature(repr_simd, intrinsics)]
#[repr(simd)]
pub struct f32x2(pub f32, pub f32);
extern "rust-intrinsic" {
fn simd_fcos<T>(x: T) -> T;
}
pub unsafe extern "C-unwind" fn fcos_32x2(a: f32x2) -> f32x2 {
simd_fcos(a)
}
as extern "platform-intrinsics"
is now gone.
is this an x86 thing again? :sweat_smile:
with https://github.com/rust-lang/rustc_codegen_cranelift/issues/1455#issuecomment-1986928883
rustc 1.78.0-nightly (46b180ec2 2024-03-08)
binary: rustc
commit-hash: 46b180ec2452d388c5d9c14009442e2e0beb01d7
commit-date: 2024-03-08
host: x86_64-unknown-linux-gnu
release: 1.78.0-nightly
LLVM version: 18.1.0
rustc a.rs -Zcodegen-backend=cranelift
warning: the feature `intrinsics` is internal to the compiler or standard library
--> a.rs:2:23
|
2 | #![feature(repr_simd, intrinsics)]
| ^^^^^^^^^^
|
= note: using it is strongly discouraged
= note: `#[warn(internal_features)]` on by default
warning: type `f32x2` should have an upper camel case name
--> a.rs:6:12
|
6 | pub struct f32x2(pub f32, pub f32);
| ^^^^^ help: convert the identifier to upper camel case (notice the capitalization): `F32x2`
|
= note: `#[warn(non_camel_case_types)]` on by default
warning: `extern` fn uses type `f32x2`, which is not FFI-safe
--> a.rs:12:46
|
12 | pub unsafe extern "C-unwind" fn fcos_32x2(a: f32x2) -> f32x2 {
| ^^^^^ not FFI-safe
|
= help: consider adding a `#[repr(C)]` or `#[repr(transparent)]` attribute to this struct
= note: this struct has unspecified layout
note: the type is defined here
--> a.rs:6:1
|
6 | pub struct f32x2(pub f32, pub f32);
| ^^^^^^^^^^^^^^^^
= note: `#[warn(improper_ctypes_definitions)]` on by default
warning: `extern` fn uses type `f32x2`, which is not FFI-safe
--> a.rs:12:56
|
12 | pub unsafe extern "C-unwind" fn fcos_32x2(a: f32x2) -> f32x2 {
| ^^^^^ not FFI-safe
|
= help: consider adding a `#[repr(C)]` or `#[repr(transparent)]` attribute to this struct
= note: this struct has unspecified layout
note: the type is defined here
--> a.rs:6:1
|
6 | pub struct f32x2(pub f32, pub f32);
| ^^^^^^^^^^^^^^^^
thread '<unnamed>' panicked at /rust/deps/cranelift-codegen-0.104.0/src/machinst/lower.rs:766:21:
should be implemented in ISLE: inst = `v5 = load.f32x2 notrap v11`, type = `Some(types::F32X2)`
stack backtrace:
0: 0x7f213d78ca52 - std::backtrace_rs::backtrace::libunwind::trace::h28d52d4a76871913
at /rustc/46b180ec2452d388c5d9c14009442e2e0beb01d7/library/std/src/../../backtrace/src/backtrace/libunwind.rs:104:5
1: 0x7f213d78ca52 - std::backtrace_rs::backtrace::trace_unsynchronized::h503ea3de55b2f93a
at /rustc/46b180ec2452d388c5d9c14009442e2e0beb01d7/library/std/src/../../backtrace/src/backtrace/mod.rs:66:5
2: 0x7f213d78ca52 - std::sys_common::backtrace::_print_fmt::h7c876b0271ead112
at /rustc/46b180ec2452d388c5d9c14009442e2e0beb01d7/library/std/src/sys_common/backtrace.rs:68:5
3: 0x7f213d78ca52 - <std::sys_common::backtrace::_print::DisplayBacktrace as core::fmt::Display>::fmt::hf5aadce27155ac5d
at /rustc/46b180ec2452d388c5d9c14009442e2e0beb01d7/library/std/src/sys_common/backtrace.rs:44:22
4: 0x7f213d7dda5c - core::fmt::rt::Argument::fmt::h13d90bf5fbe267cf
at /rustc/46b180ec2452d388c5d9c14009442e2e0beb01d7/library/core/src/fmt/rt.rs:142:9
5: 0x7f213d7dda5c - core::fmt::write::h2de89e906ae130f8
at /rustc/46b180ec2452d388c5d9c14009442e2e0beb01d7/library/core/src/fmt/mod.rs:1153:17
6: 0x7f213d78155f - std::io::Write::write_fmt::h474fe2851308390a
at /rustc/46b180ec2452d388c5d9c14009442e2e0beb01d7/library/std/src/io/mod.rs:1846:15
7: 0x7f213d78c824 - std::sys_common::backtrace::_print::h71e1c5fa8a76cc1f
at /rustc/46b180ec2452d388c5d9c14009442e2e0beb01d7/library/std/src/sys_common/backtrace.rs:47:5
8: 0x7f213d78c824 - std::sys_common::backtrace::print::h6de4bd76b46f8a90
at /rustc/46b180ec2452d388c5d9c14009442e2e0beb01d7/library/std/src/sys_common/backtrace.rs:34:9
9: 0x7f213d78f52b - std::panicking::default_hook::{{closure}}::hf548fd40a9216b9d
10: 0x7f213d78f287 - std::panicking::default_hook::hce3f5ab890486de1
at /rustc/46b180ec2452d388c5d9c14009442e2e0beb01d7/library/std/src/panicking.rs:292:9
11: 0x7f21406593bc - std[40371b03452e9629]::panicking::update_hook::<alloc[1c695e7685c40be4]::boxed::Box<rustc_driver_impl[e020cafba1d663ef]::install_ice_hook::{closure#0}>>::{closure#0}
12: 0x7f213d78fc90 - <alloc::boxed::Box<F,A> as core::ops::function::Fn<Args>>::call::h3f8fec9da151cd79
at /rustc/46b180ec2452d388c5d9c14009442e2e0beb01d7/library/alloc/src/boxed.rs:2030:9
13: 0x7f213d78fc90 - std::panicking::rust_panic_with_hook::h4cae9e0f3cf6214b
at /rustc/46b180ec2452d388c5d9c14009442e2e0beb01d7/library/std/src/panicking.rs:783:13
14: 0x7f213d78f9d2 - std::panicking::begin_panic_handler::{{closure}}::h3d1abdf9392922f6
at /rustc/46b180ec2452d388c5d9c14009442e2e0beb01d7/library/std/src/panicking.rs:657:13
15: 0x7f213d78cf26 - std::sys_common::backtrace::__rust_end_short_backtrace::h68b8a42a6ea5942d
at /rustc/46b180ec2452d388c5d9c14009442e2e0beb01d7/library/std/src/sys_common/backtrace.rs:171:18
16: 0x7f213d78f704 - rust_begin_unwind
at /rustc/46b180ec2452d388c5d9c14009442e2e0beb01d7/library/std/src/panicking.rs:645:5
17: 0x7f213d7d9f75 - core::panicking::panic_fmt::he5f6ace403ad1db0
at /rustc/46b180ec2452d388c5d9c14009442e2e0beb01d7/library/core/src/panicking.rs:72:14
18: 0x7f213415225d - <cranelift_codegen[a09255f40a5caa31]::machinst::lower::Lower<cranelift_codegen[a09255f40a5caa31]::isa::x64::lower::isle::generated_code::MInst>>::lower::<cranelift_codegen[a09255f40a5caa31]::isa::x64::X64Backend>
19: 0x7f213418c27b - cranelift_codegen[a09255f40a5caa31]::machinst::compile::compile::<cranelift_codegen[a09255f40a5caa31]::isa::x64::X64Backend>
20: 0x7f2134215199 - <cranelift_codegen[a09255f40a5caa31]::isa::x64::X64Backend as cranelift_codegen[a09255f40a5caa31]::isa::TargetIsa>::compile_function
21: 0x7f2134299c47 - <cranelift_codegen[a09255f40a5caa31]::context::Context>::compile_stencil
22: 0x7f2134299947 - <cranelift_codegen[a09255f40a5caa31]::context::Context>::compile_and_emit
23: 0x7f213406b751 - <cranelift_object[b63c4d02444cd865]::backend::ObjectModule as cranelift_module[4d4182e78a0bce0]::module::Module>::define_function_with_control_plane
24: 0x7f21340262bd - rustc_codegen_cranelift[e89abcfa756346c6]::driver::aot::module_codegen::{closure#1}
25: 0x7f2133fc3946 - std[40371b03452e9629]::sys_common::backtrace::__rust_begin_short_backtrace::<rustc_codegen_cranelift[e89abcfa756346c6]::driver::aot::module_codegen::{closure#1}, core[94452985e868f073]::result::Result<rustc_codegen_cranelift[e89abcfa756346c6]::driver::aot::ModuleCodegenResult, alloc[1c695e7685c40be4]::string::String>>
26: 0x7f2133fd1bc4 - <<std[40371b03452e9629]::thread::Builder>::spawn_unchecked_<rustc_codegen_cranelift[e89abcfa756346c6]::driver::aot::module_codegen::{closure#1}, core[94452985e868f073]::result::Result<rustc_codegen_cranelift[e89abcfa756346c6]::driver::aot::ModuleCodegenResult, alloc[1c695e7685c40be4]::string::String>>::{closure#1} as core[94452985e868f073]::ops::function::FnOnce<()>>::call_once::{shim:vtable#0}
27: 0x7f213d799435 - <alloc::boxed::Box<F,A> as core::ops::function::FnOnce<Args>>::call_once::h9aa150da2b8878a0
at /rustc/46b180ec2452d388c5d9c14009442e2e0beb01d7/library/alloc/src/boxed.rs:2016:9
28: 0x7f213d799435 - <alloc::boxed::Box<F,A> as core::ops::function::FnOnce<Args>>::call_once::h9e33e08a039d33be
at /rustc/46b180ec2452d388c5d9c14009442e2e0beb01d7/library/alloc/src/boxed.rs:2016:9
29: 0x7f213d799435 - std::sys::pal::unix::thread::Thread::new::thread_start::h15066c44878d31b1
at /rustc/46b180ec2452d388c5d9c14009442e2e0beb01d7/library/std/src/sys/pal/unix/thread.rs:108:17
30: 0x7f213d58155a - <unknown>
31: 0x7f213d5fea3c - <unknown>
32: 0x0 - <unknown>
error: the compiler unexpectedly panicked. this is a bug.
note: using internal features is not supported and expected to cause internal compiler errors when used incorrectly
note: please attach the file at `/tmp/im/rustc-ice-2024-03-09T17_53_46-2793847.txt` to your bug report
note: compiler flags: -Z codegen-backend=cranelift
query stack during panic:
end of query stack
warning: 4 warnings emitted
Yes, it reproduces on x86_64.
I'm not sure if f32x2 is allowed at all by the x86_64 systemv calling convention. It is on aarch64 though (float32x2_t
in arm_neon.h
for C).
In any case I opened https://github.com/bytecodealliance/wasmtime/issues/8075 to suggest adding load.f32x2
support.
Reproduction is in Custom MIR. Not sure if this can be triggered from surface rust
On latest cdae185e3022b6e7c6c7fe363353fe1176a06604