[PATCH] D83169: [WebAssembly] Do not assume br_table range checks will be gt_u

[Thomas Lively via Phabricator via llvm-commits]

tlively created this revision.
tlively added a reviewer: kripken.
Herald added subscribers: llvm-commits, sunfish, aheejin, hiraditya, jgravelle-google, sbc100, dschuff.
Herald added a project: LLVM.
tlively added a comment.

Landing TBR to unbreak stuff faster.


OSS-Fuzz and the Emscripten test suite uncovered some edge cases in
which the range check instruction seemed to be an (i32.const 0) or
other unexpected instruction, triggering an assertion. Unfortunately
the reproducers are rather complicated, so they don't make good unit
tests. This commit removes the bad assertion and conservatively
optimizes range checks only when the range check instruction is
i32.gt_u.


Repository:
  rG LLVM Github Monorepo

https://reviews.llvm.org/D83169

Files:
  llvm/lib/Target/WebAssembly/WebAssemblyFixBrTableDefaults.cpp


Index: llvm/lib/Target/WebAssembly/WebAssemblyFixBrTableDefaults.cpp
===================================================================
--- llvm/lib/Target/WebAssembly/WebAssemblyFixBrTableDefaults.cpp
+++ llvm/lib/Target/WebAssembly/WebAssemblyFixBrTableDefaults.cpp
@@ -76,17 +76,15 @@
 
     // If the range check checks an i64 value, we cannot optimize it out because
     // the i64 index is truncated to an i32, making values over 2^32
-    // indistinguishable from small numbers.
+    // indistinguishable from small numbers. There are also other strange edge
+    // cases that can arise in practice that we don't want to reason about, so
+    // conservatively only perform the optimization if the range check is the
+    // normal case of an i32.gt_u.
     MachineRegisterInfo &MRI = MF.getRegInfo();
     auto *RangeCheck = MRI.getVRegDef(Cond[1].getReg());
     assert(RangeCheck != nullptr);
-    unsigned RangeCheckOp = RangeCheck->getOpcode();
-    assert(RangeCheckOp == WebAssembly::GT_U_I32 ||
-           RangeCheckOp == WebAssembly::GT_U_I64);
-    if (RangeCheckOp == WebAssembly::GT_U_I64) {
-      // Bail out and leave the jump table untouched
+    if (RangeCheck->getOpcode() != WebAssembly::GT_U_I32)
       return nullptr;
-    }
 
     // Remove the dummy default target and install the real one.
     MI.RemoveOperand(MI.getNumExplicitOperands() - 1);


-------------- next part --------------
A non-text attachment was scrubbed...
Name: D83169.275534.patch
Type: text/x-patch
Size: 1383 bytes
Desc: not available
URL: <http://lists.llvm.org/pipermail/llvm-commits/attachments/20200705/48dde3c2/attachment.bin>