Repository: bytecodealliance/wasmtime
Pull request #7616 (2023-11-30 14:05:02)

Revert "winch: Ensure stack pointer for br_table"
Reverts bytecodealliance/wasmtime#7602

The fuzzer reported other issues related to `br_table`. I'd like to revert this change temporarily to:

* Come up with the proper fix for this and the new edge cases.
* Leave the fuzzer running locally a bit more to ensure that the fix handles all the possible edge cases. 


Patch:
diff --git a/winch/codegen/src/visitor.rs b/winch/codegen/src/visitor.rs
index 64726aadf..8a26cda94 100644
--- a/winch/codegen/src/visitor.rs
+++ b/winch/codegen/src/visitor.rs
@@ -1225,8 +1225,7 @@ where
         let labels: SmallVec<[_; 5]> = (0..len).map(|_| self.masm.get_label()).collect();
 
         let default_index = control_index(targets.default(), self.control_frames.len());
-        let default_frame = &self.control_frames[default_index];
-        let default_result = default_frame.as_target_results();
+        let default_result = self.control_frames[default_index].as_target_results();
 
         let (index, tmp) = if let Some(data) = default_result {
             let index_and_tmp = self.context.without::<(TypedReg, _), M, _>(
@@ -1246,10 +1245,6 @@ where
             )
         };
 
-        let (_, offset) = default_frame.base_stack_len_and_sp();
-        // Ensure that the stack pointer is correctly positioned before
-        // jumping to the jump table code.
-        self.masm.ensure_sp_for_jump(offset);
         self.masm.jmp_table(&labels, index.into(), tmp);
 
         for (t, l) in targets


Test patch:
diff --git a/tests/misc_testsuite/winch/br_table.wast b/tests/misc_testsuite/winch/br_table.wast
index 6a7a8c288..54784e13d 100644
--- a/tests/misc_testsuite/winch/br_table.wast
+++ b/tests/misc_testsuite/winch/br_table.wast
@@ -11,25 +11,6 @@
     (block (drop (i64.ctz (br_table 0 0 (i32.const 0)))))
   )
 
-  (func (export "type-f32")
-    (block (drop (f32.neg (br_table 0 0 (i32.const 0)))))
-  )
-  (func (export "type-f64")
-    (block (drop (f64.neg (br_table 0 0 (i32.const 0)))))
-  )
-
-  (func (export "type-i32-value") (result i32)
-    (block (result i32) (i32.ctz (br_table 0 0 (i32.const 1) (i32.const 0))))
-  )
-  (func (export "type-i64-value") (result i64)
-    (block (result i64) (i64.ctz (br_table 0 0 (i64.const 2) (i32.const 0))))
-  )
-  (func (export "type-f32-value") (result f32)
-    (block (result f32) (f32.neg (br_table 0 0 (f32.const 3) (i32.const 0))))
-  )
-  (func (export "type-f64-value") (result f64)
-    (block (result f64) (f64.neg (br_table 0 0 (f64.const 4) (i32.const 0))))
-  )
   (func (export "empty") (param i32) (result i32)
     (block (br_table 0 (local.get 0)) (return (i32.const 21)))
     (i32.const 22)
@@ -1142,12 +1123,6 @@
 
 (assert_return (invoke "type-i32"))
 (assert_return (invoke "type-i64"))
-(assert_return (invoke "type-f32"))
-(assert_return (invoke "type-f64"))
-(assert_return (invoke "type-i32-value") (i32.const 1))
-(assert_return (invoke "type-i64-value") (i64.const 2))
-(assert_return (invoke "type-f32-value") (f32.const 3))
-(assert_return (invoke "type-f64-value") (f64.const 4))
 
 (assert_return (invoke "empty" (i32.const 0)) (i32.const 22))
 (assert_return (invoke "empty" (i32.const 1)) (i32.const 22))
diff --git a/tests/misc_testsuite/winch/misc.wast b/tests/misc_testsuite/winch/misc.wast
deleted file mode 100644
index 481fba8dd..000000000
--- a/tests/misc_testsuite/winch/misc.wast
+++ /dev/null
@@ -1,15 +0,0 @@
-;; Additional run tests for Winch not covered in the official spec test suite.
-
-(module
-  (func (export "br-table-ensure-sp") (result i32)
-    (block (result i32)
-       (i32.const 0)
-    )
-    (i32.const 0)
-    (i32.const 0)
-    (br_table 0)
-  )
-)
-
-(assert_return (invoke "br-table-ensure-sp") (i32.const 0))
-
diff --git a/winch/filetests/filetests/x64/br_table/ensure_sp_state.wat b/winch/filetests/filetests/x64/br_table/ensure_sp_state.wat
deleted file mode 100644
index 413469403..000000000
--- a/winch/filetests/filetests/x64/br_table/ensure_sp_state.wat
+++ /dev/null
@@ -1,34 +0,0 @@
-;;! target = "x86_64"
-
-(module
-  (func (export "") (result i32)
-    block (result i32)
-       i32.const 0
-    end
-    i32.const 0
-    i32.const 0
-    br_table 0
-  )
-)
-;;    0:	 55                   	push	rbp
-;;    1:	 4889e5               	mov	rbp, rsp
-;;    4:	 4883ec08             	sub	rsp, 8
-;;    8:	 4c893424             	mov	qword ptr [rsp], r14
-;;    c:	 b800000000           	mov	eax, 0
-;;   11:	 4883ec04             	sub	rsp, 4
-;;   15:	 890424               	mov	dword ptr [rsp], eax
-;;   18:	 b900000000           	mov	ecx, 0
-;;   1d:	 b800000000           	mov	eax, 0
-;;   22:	 4883c404             	add	rsp, 4
-;;   26:	 ba00000000           	mov	edx, 0
-;;   2b:	 39ca                 	cmp	edx, ecx
-;;   2d:	 0f42ca               	cmovb	ecx, edx
-;;   30:	 4c8d1d0a000000       	lea	r11, [rip + 0xa]
-;;   37:	 4963148b             	movsxd	rdx, dword ptr [r11 + rcx*4]
-;;   3b:	 4901d3               	add	r11, rdx
-;;   3e:	 41ffe3               	jmp	r11
-;;   41:	 0400                 	add	al, 0
-;;   43:	 0000                 	add	byte ptr [rax], al
-;;   45:	 4883c408             	add	rsp, 8
-;;   49:	 5d                   	pop	rbp
-;;   4a:	 c3                   	ret