v0.11.26 RV32: i32.div_s overflow guard clobbers dividend register (signed div-by-const → wrong result)

[avrabe]

v0.11.26 RV32 regression: i32.div_s overflow guard clobbers the dividend register → wrong result

Severity: silent miscompile (wrong value, no error). Introduced by #231 (caller-saved-preference allocator), which merged + shipped in v0.11.26 before I could flag it. I left the detail on #231 post-merge (comment) but it shipped, so raising it here for visibility.

Repro

int32_t filter_axis_decide(int32_t prev, int32_t gyro, int32_t accel) {
    int32_t gyro_term = prev + gyro;
    return (gyro_term * 980 + accel * 20) / 1000;   // signed div by constant
}

clang --target=wasm32 -O2 → wasm-ld → loom optimize --passes inline → synth compile -b riscv -t rv32imac --relocatable.

filter_axis_decide(1000, 100, 500) returns 0, expected 1088. Reproducible 3/3 on qemu_riscv32. The loom.wasm is correct (wasmtime --invoke → 1088), so it's RV32 codegen. ARM (--target cortex-m4f) is unaffected (only the RV32 pool changed in #231).

Root cause (v0.11.26 disasm)

20: add  t0,t0,t1      # t0 = numerator (live, needed by the div)
24: li   t1,1000        # divisor
28: bnez t1,30          # divisor != 0 -> ok
30: lui  t0,0x80000     # INT_MIN const into t0  <-- CLOBBERS the numerator
34: bne  t0,t0,44       # t0==t0 (always false) -- was meant to test numerator==INT_MIN
38: li   t0,-1          # -1 const into t0  <-- clobbers again
3c: bne  t1,t0,44       # 1000 != -1 -> taken
44: div  t0,t0,t1       # t0 = (-1)/1000 = 0   <-- dividend gone

The signed-division numerator==INT_MIN && divisor==-1 overflow guard materializes its INT_MIN and −1 comparison constants into t0 — the register holding the live numerator. v0.11.25 kept the numerator in a callee-saved reg (s2) clear of the guard temps and was correct.

Diagnosis

The dividend's live range extends across the overflow-guard basic blocks to the div, but the new lowest-free allocator treats t0 as free after the add and reassigns it to the guard constants. Same class as #226 (liveness across a branch region), resurfaced by the lowest-free allocation order. The 5 differential fixtures stayed green because none is a signed-div-by-constant leaf — worth adding one as a fixture.

What would help

A fix that keeps the dividend live until the div (or sinks the guard-constant materialization into the taken edges, not the fall-through that reaches the div). I have all four wasm-cross-LTO leaves wired on qemu_riscv32 and will re-measure the instant a fix lands — the rest of #231 is a real win (filter/control/controller all drop to 0 callee-saved spills; control_step icount 141→129, controller_step 114→100), so this is the one thing standing between v0.11.26 and a clean RV32 leaf-codegen release.

[avrabe]

Fixed in v0.11.27 (PR just opened). Root cause confirmed exactly as you diagnosed: the INT_MIN/-1 guard popped the dividend/divisor off the vstack, so live_regs no longer protected them, and the lowest-free allocator reused the dividend's register for the INT_MIN constant — clobbering it before the bne read it. Round-robin in v0.11.25 marched elsewhere and masked it.

Fix: new alloc_temp_avoiding(&[dividend, divisor]) for the guard constants. Bundled your suggested fixture (signed_div_const.wat + a differential): filter_axis_decide(1000,100,500) = 1088 now, 5/5 vectors match wasmtime including the INT_MIN overflow edge and negatives. All five prior fixtures stay bit-identical, so the #231 caller-saved win is preserved (leaves still spill 0 callee-saved regs).

Also applied the same guard fix to the i64 INT64_MIN/-1 path defensively — though i64 div_s is unreachable until i64 params land, so I've flagged the broader i64 magnitude-reduction register discipline for re-verification at that point rather than claiming it fixed. Please re-measure the four leaves on qemu_riscv32 once v0.11.27 lands.

[avrabe]

v0.11.27 verified on all four wasm-cross-LTO leaves on qemu_riscv32 — fix confirmed, win intact. Built #233 from source, installed, ran the testbed's RV32 functional lane + icount harness (-icount shift=0, min-over-200, overhead-subtracted).

Functional: ALL GREEN — filter_axis=1088, controller_step=97419164, control_step=2165333, flat_flight=0x07fdf307 (state pitch=937 roll=−396 yaw=230). filter_axis and flat_flight (which embeds it) were both broken on v0.11.26 and are correct again.

icounts vs the v0.11.25 baseline (all now at 0 callee-saved spills):

leaf	v0.11.25	v0.11.27	native	ratio v25→v27
filter_axis	37	23	17	2.18× → 1.35×
control_step	141	129	62	2.27× → 2.08×
controller_step	114	100	49	2.33× → 2.04×
flat_flight (composed)	193	181	75	2.57× → 2.41×

(control_step includes my ~6-cyc s11 table trampoline.) The leaves move most — filter_axis nearly halves its overhead (2.18×→1.35×) because its tiny body was almost all prologue spill. The composed flat_flight moves least (2.57×→2.41×), exactly as you called it: it needs the cross-statement local promotion + const-CSE part of Opt-3, not just caller-saved preference. So that's the clear next lever for the composed path.

Thanks for the fast turnaround and for bundling signed_div_const.wat as a fixture — that closes it on your side. On mine, I added an RV32 functional regression lane to our testbed (compiles synth -b riscv, runs the actual RV32 output on qemu, asserts the verified values) so this class of miscompile can't reach a measurement silently again — it flagged this one as FAIL filter_axis got=0, now PASS. Standing by for the const-CSE / local-promotion increment to re-measure the composed path.