| 55105fbc | 13-Jan-2026 |
Chris Fallin <[email protected]> |
Cranelift: x64: fix user-controlled recursion in cmp emission. (#12333)
* Cranelift: x64: fix user-controlled recursion in cmp emission.
We had a set of rules introduced in #11097 that attempted to
Cranelift: x64: fix user-controlled recursion in cmp emission. (#12333)
* Cranelift: x64: fix user-controlled recursion in cmp emission.
We had a set of rules introduced in #11097 that attempted to optimize
the case of testing the result of an `icmp` for a nonzero value. This
allowed optimization of, for example, `(((x == 0) == 0) == 0 ...)` to
a single level, either `x == 0` or `x != 0` depending on even/odd
nesting depth.
Unfortunately this kind of recursion in the backend has a depth
bounded only by the user input, hence creates a DoS vulnerability: the
wrong kind of compiler input can cause a stack overflow in Cranelift
at compilation time. This case is reachable from Wasmtime's Wasm
frontend via the `i32.eqz` operator (for example) as well.
Ideally, this kind of deep rewrite is best done in our mid-end
optimizer, where we think carefully about bounds for recursive
rewrites. The left-hand sides for the backend rules should really be
fixed shapes that correspond to machine instructions, rather than
ad-hoc peephole optimizations in their own right.
This fix thus simply removes the recursion case that causes the
blowup. The patch includes two tests: one with optimizations disabled,
showing correct compilation (without the fix, this case fails to
compile with a stack overflow), and one with optimizations enabled,
showing that the mid-end properly cleans up the nested expression and
we get the expected one-level result anyway.
* Preserve codegen on branches.
This change works by splitting a rule so that the entry point used by
`brif` lowering can still peel off one layer of `icmp` and emit it
directly, without entering the unbounded structural recursion.
It also adds a mid-end rule to catch one case that we were previously
catching in the backend only: `fcmp(...) != 0`.
show more ...
|
| cdc7bfe9 | 08-Dec-2025 |
jameshu15869 <[email protected]> |
Cranelift: Optimize out redundant select + icmp instructions (#12135)
* Implement simple icmp + select optimization
This optimizes the following:
a = select x, k1, k2
b = icmp eq a, k1
to
b = x
Cranelift: Optimize out redundant select + icmp instructions (#12135)
* Implement simple icmp + select optimization
This optimizes the following:
a = select x, k1, k2
b = icmp eq a, k1
to
b = x
We shouldn't trigger this optimization when k1 == k2 because constant
propagation should optimize that case.
* Optimize icmp eq and ne for select-on-icmp (#2)
* Optimize icmp eq and ne for select-on-icmp
When we have a select followed by an icmp and the inner condition
to the select is also an icmp, we can remove the select + icmp and
directly use the inner condition.
We negated the values of the inner_condition via bxor x 1.
* Add trailing newline
* feat: avoid relying on icmp inner_cond
---------
Co-authored-by: school <[email protected]>
Co-authored-by: Edward Wibowo <[email protected]>
* test: add extra test
---------
Co-authored-by: school <[email protected]>
Co-authored-by: Edward Wibowo <[email protected]>
show more ...
|