Skip to content

Commit e9369be

Browse files
committed
x64: Fix a missing lowering rule for select_spectre_guard (#11242)
This commit fixes an accidental regression from #11097 where a `select_spectre_guard` with a boolean condition that and'd two CCs together would fail to lower and cause a panic during lowering. This was reachable when explicit bounds checks are enabled from wasm, for example. The fix here is to handle the `And` condition in the same way that lowering `select` does which is to model that as it flows into the select helper.
1 parent 72cf4ca commit e9369be

File tree

2 files changed

+72
-3
lines changed

2 files changed

+72
-3
lines changed

cranelift/codegen/src/isa/x64/lower.isle

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3618,10 +3618,15 @@
36183618
(lower_select (is_nonzero_cmp cond) x y))
36193619

36203620
;; Note that for GPR-based spectre guards everything is forced into a register
3621-
;; so go straight to the `lower_select_gpr` helper forcing `x` to be in a `Gpr`
3622-
;; not `GprMem`.
3621+
;; not `GprMem`. The `lower_select_spectre_gpr` helper below handles "and"
3622+
;; conditions which the `lower_select_gpr` helper does not.
36233623
(rule 1 (lower (has_type (is_single_register_gpr_type ty) (select_spectre_guard cond x y)))
3624-
(lower_select_gpr ty (is_nonzero_cmp cond) (put_in_gpr x) y))
3624+
(lower_select_spectre_gpr ty (is_nonzero_cmp cond) (put_in_gpr x) y))
3625+
3626+
(decl lower_select_spectre_gpr (Type CondResult Gpr Gpr) Gpr)
3627+
(rule 0 (lower_select_spectre_gpr ty cond a b) (lower_select_gpr ty cond a b))
3628+
(rule 1 (lower_select_spectre_gpr ty cond @ (CondResult.And _ _ _) a b)
3629+
(lower_select_gpr ty (cond_invert cond) b a))
36253630

36263631
;; Rules for `fcvt_from_sint` ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
36273632

cranelift/filetests/filetests/isa/x64/select.clif

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -193,3 +193,67 @@ block0(v0: i8, v1: f128, v2: f128):
193193
; popq %rbp
194194
; retq
195195

196+
function %select_gpr_with_and_condition(f32, f32, i64, i64) -> i64 {
197+
block0(v0: f32, v1: f32, v2: i64, v3: i64):
198+
v4 = fcmp eq v0, v1
199+
v5 = select v4, v2, v3
200+
return v5
201+
}
202+
203+
; VCode:
204+
; pushq %rbp
205+
; movq %rsp, %rbp
206+
; block0:
207+
; ucomiss %xmm1, %xmm0
208+
; cmovpq %rsi, %rdi
209+
; movq %rdi, %rax
210+
; cmovneq %rsi, %rax
211+
; movq %rbp, %rsp
212+
; popq %rbp
213+
; retq
214+
;
215+
; Disassembled:
216+
; block0: ; offset 0x0
217+
; pushq %rbp
218+
; movq %rsp, %rbp
219+
; block1: ; offset 0x4
220+
; ucomiss %xmm1, %xmm0
221+
; cmovpq %rsi, %rdi
222+
; movq %rdi, %rax
223+
; cmovneq %rsi, %rax
224+
; movq %rbp, %rsp
225+
; popq %rbp
226+
; retq
227+
228+
function %select_spectre_gpr_with_and_condition(f32, f32, i64, i64) -> i64 {
229+
block0(v0: f32, v1: f32, v2: i64, v3: i64):
230+
v4 = fcmp eq v0, v1
231+
v5 = select_spectre_guard v4, v2, v3
232+
return v5
233+
}
234+
235+
; VCode:
236+
; pushq %rbp
237+
; movq %rsp, %rbp
238+
; block0:
239+
; ucomiss %xmm1, %xmm0
240+
; cmovpq %rsi, %rdi
241+
; movq %rdi, %rax
242+
; cmovneq %rsi, %rax
243+
; movq %rbp, %rsp
244+
; popq %rbp
245+
; retq
246+
;
247+
; Disassembled:
248+
; block0: ; offset 0x0
249+
; pushq %rbp
250+
; movq %rsp, %rbp
251+
; block1: ; offset 0x4
252+
; ucomiss %xmm1, %xmm0
253+
; cmovpq %rsi, %rdi
254+
; movq %rdi, %rax
255+
; cmovneq %rsi, %rax
256+
; movq %rbp, %rsp
257+
; popq %rbp
258+
; retq
259+

0 commit comments

Comments
 (0)