-
Notifications
You must be signed in to change notification settings - Fork 1.6k
Closed
Labels
cranelift:area:regallocIssues related to register allocation.Issues related to register allocation.fuzz-bugBugs found by a fuzzerBugs found by a fuzzer
Description
This input:
(module
(import "" "" (func))
(func
try_table (catch_all 0)
call 0
end
)
)fails with:
$ cargo run compile testcase0.wat --target x86_64-unknown-linux-gnu -Oregalloc-algorithm=single-pass -Wexceptions=y
2025-08-26T18:47:40.840113Z ERROR cranelift_codegen::machinst::compile: Register allocation error for vcode
VCode {
Entry block: 0
Block 0([]):
(original IR block: block0)
(successor: Block 1([]))
Inst 0: args %v192=%rdi
Inst 1: jmp label1
Block 1([]):
(original IR block: block2)
(successor: Block 4([VReg(vreg = 197, class = Int)]))
(successor: Block 2([]))
Inst 2: movq 0x30(%v192), %v200
Inst 3: movq 0x40(%v192), %v199
Inst 4: call *%v200; jmp MachLabel(2); catch [context v192, default: MachLabel(4)]
Block 2([]):
(original IR block: block5)
(successor: Block 3([]))
Inst 5: jmp label3
Block 3([]):
(original IR block: block3)
(successor: Block 5([]))
Inst 6: jmp label5
Block 4([VReg(vreg = 194, class = Int)]):
(original IR block: block4)
(successor: Block 5([]))
Inst 7: jmp label5
Block 5([]):
(original IR block: block1)
Inst 8: rets
}
Error: TooManyLiveRegs
CLIF for error:
function u0:0(i64 vmctx, i64) tail {
gv0 = vmctx
gv1 = load.i64 notrap aligned readonly gv0+8
gv2 = load.i64 notrap aligned gv1+16
gv3 = vmctx
sig0 = (i64 vmctx, i64) tail
stack_limit = gv2
block0(v0: i64, v1: i64):
@001e jump block2
block4(v2: i64):
@001e jump block1
block2:
@0023 v6 = load.i64 notrap aligned readonly can_move v0+48
@0023 v5 = load.i64 notrap aligned readonly can_move v0+64
@0023 try_call_indirect v6(v5, v0), sig0, block5, [ context v0, default: block4(exn0) ]
block5:
@0025 jump block3
block3:
@0026 jump block1
block1:
@0026 return
}
thread '<unnamed>' panicked at cranelift/codegen/src/machinst/compile.rs:79:14:
register allocation: TooManyLiveRegs
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
The original fuzz test case is:
Details
(module
(type (;0;) (func (result i64 f32 f64 v128 i32 i64 f32 v128 i32)))
(type (;1;) (func (param f32 f64 v128 i32 i64 f32 f64 f32 i32 i64 f32 f64 v128) (result i32 i64 f32 f64 i64 i32 i64 i32)))
(import "\u{f3}\u{f4}" "" (table (;0;) 1995 179847 funcref))
(import "" "" (func (;0;) (type 1)))
(import "\u{e5}\u{e6}\u{e7}E" "" (func (;1;) (type 0)))
(import "" "" (global (;0;) (mut i64)))
(memory (;0;) 2316 49871)
(global (;1;) (mut i32) i32.const 1000)
(export "" (global 0))
(export "1" (func 8))
(elem (;0;) (table 0) (i32.const 109) func)
(func (;2;) (type 1) (param f32 f64 v128 i32 i64 f32 f64 f32 i32 i64 f32 f64 v128) (result i32 i64 f32 f64 i64 i32 i64 i32)
(local f32 f64 v128 i32 f64 f32 f64 v128 i32 i64 f32 f64 f32 f64 v128 f64)
global.get 1
i32.eqz
if ;; label = @1
unreachable
end
global.get 1
i32.const 1
i32.sub
global.set 1
block (result i32) ;; label = @1
elem.drop 0
loop ;; label = @2
global.get 1
i32.eqz
if ;; label = @3
unreachable
end
global.get 1
i32.const 1
i32.sub
global.set 1
data.drop 1
data.drop 1
data.drop 1
i64.const 127125275142234563
f32.convert_i64_u
i32.trunc_f32_s
block ;; label = @3
block (type 0) (result i64 f32 f64 v128 i32 i64 f32 v128 i32) ;; label = @4
call 5
f32.const 0x1.p-142 (;=0.00000000000000000000000000000000000000000018;)
i32.trunc_sat_f32_s
i32.sub
v128.load32x2_s offset=3067064003
i16x8.extmul_high_i8x16_u
f64x2.trunc
i32x4.extend_high_i16x8_s
f64x2.convert_low_i32x4_u
i32x4.all_true
v128.load32x2_s offset=96519093
f32x4.floor
i64x2.extract_lane 1
loop ;; label = @5
global.get 1
i32.eqz
if ;; label = @6
unreachable
end
global.get 1
i32.const 1
i32.sub
global.set 1
data.drop 1
data.drop 0
f32.const -0x1.873386p-74 (;=-0.000000000000000000000080898525;)
i64.const -4349457152578708029
loop ;; label = @6
global.get 1
i32.eqz
if ;; label = @7
unreachable
end
global.get 1
i32.const 1
i32.sub
global.set 1
data.drop 1
data.drop 1
data.drop 0
loop ;; label = @7
global.get 1
i32.eqz
if ;; label = @8
unreachable
end
global.get 1
i32.const 1
i32.sub
global.set 1
try_table (catch_all 4 (;@3;)) (catch_all 0 (;@7;)) (catch_all 0 (;@7;)) (catch_all 0 (;@7;)) (catch_all 0 (;@7;)) (catch_all 0 (;@7;)) (catch_all 1 (;@6;)) (catch_all 0 (;@7;)) ;; label = @8
loop ;; label = @9
global.get 1
i32.eqz
if ;; label = @10
unreachable
end
global.get 1
i32.const 1
i32.sub
global.set 1
data.drop 1
loop (type 0) (result i64 f32 f64 v128 i32 i64 f32 v128 i32) ;; label = @10
global.get 1
i32.eqz
if ;; label = @11
unreachable
end
global.get 1
i32.const 1
i32.sub
global.set 1
call 1
block ;; label = @11
data.drop 1
data.drop 1
data.drop 1
data.drop 1
data.drop 1
data.drop 0
elem.drop 0
br 6 (;@5;)
call 7
try_table (catch_all 6 (;@5;)) (catch_all 2 (;@9;)) ;; label = @12
call 5
block (type 0) (result i64 f32 f64 v128 i32 i64 f32 v128 i32) ;; label = @13
try_table (result i32) (catch_all 8 (;@5;)) (catch_all 11 (;@2;)) ;; label = @14
br 2 (;@12;)
call 5
i64x2.shr_s
i64x2.extend_low_i32x4_s
i16x8.extract_lane_u 3
v128.load8_splat offset=3184506367
v128.const i32x4 0xc3b7c3b6 0xc3b9c3b8 0xbbc3ba2a 0xc3b6bcc3
i8x16.max_s
elem.drop 0
elem.drop 0
try_table ;; label = @15
end
unreachable
end
unreachable
end
unreachable
end
unreachable
end
end
unreachable
end
end
end
end
unreachable
end
unreachable
end
unreachable
end
unreachable
end
unreachable
end
unreachable
)
(func (;3;) (type 0) (result i64 f32 f64 v128 i32 i64 f32 v128 i32)
global.get 1
i32.eqz
if ;; label = @1
unreachable
end
global.get 1
i32.const 1
i32.sub
global.set 1
unreachable
)
(func (;4;) (type 1) (param f32 f64 v128 i32 i64 f32 f64 f32 i32 i64 f32 f64 v128) (result i32 i64 f32 f64 i64 i32 i64 i32)
global.get 1
i32.eqz
if ;; label = @1
unreachable
end
global.get 1
i32.const 1
i32.sub
global.set 1
unreachable
)
(func (;5;) (type 0) (result i64 f32 f64 v128 i32 i64 f32 v128 i32)
global.get 1
i32.eqz
if ;; label = @1
unreachable
end
global.get 1
i32.const 1
i32.sub
global.set 1
unreachable
)
(func (;6;) (type 1) (param f32 f64 v128 i32 i64 f32 f64 f32 i32 i64 f32 f64 v128) (result i32 i64 f32 f64 i64 i32 i64 i32)
global.get 1
i32.eqz
if ;; label = @1
unreachable
end
global.get 1
i32.const 1
i32.sub
global.set 1
unreachable
)
(func (;7;) (type 0) (result i64 f32 f64 v128 i32 i64 f32 v128 i32)
global.get 1
i32.eqz
if ;; label = @1
unreachable
end
global.get 1
i32.const 1
i32.sub
global.set 1
unreachable
)
(func (;8;) (type 1) (param f32 f64 v128 i32 i64 f32 f64 f32 i32 i64 f32 f64 v128) (result i32 i64 f32 f64 i64 i32 i64 i32)
global.get 1
i32.eqz
if ;; label = @1
unreachable
end
global.get 1
i32.const 1
i32.sub
global.set 1
unreachable
)
(func (;9;) (type 1) (param f32 f64 v128 i32 i64 f32 f64 f32 i32 i64 f32 f64 v128) (result i32 i64 f32 f64 i64 i32 i64 i32)
global.get 1
i32.eqz
if ;; label = @1
unreachable
end
global.get 1
i32.const 1
i32.sub
global.set 1
unreachable
)
(func (;10;) (type 0) (result i64 f32 f64 v128 i32 i64 f32 v128 i32)
global.get 1
i32.eqz
if ;; label = @1
unreachable
end
global.get 1
i32.const 1
i32.sub
global.set 1
unreachable
)
(data (;0;) "")
(data (;1;) (i32.const 29653281) "\a2\a3\01\a5\a6\00")
)Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
cranelift:area:regallocIssues related to register allocation.Issues related to register allocation.fuzz-bugBugs found by a fuzzerBugs found by a fuzzer