v0.11.35 arm: i64 unpack miscompile — mask constants materialize into the live u64 pair (r0/r1); silent wrong-code in k_sem_give

[avrabe]

v0.11.35 ARM: i64 unpack miscompile — mask/shift constants land in the live u64 register pair → silent wrong-code (k_sem_give drops its count update; engine_control bench hangs on silicon)

Found while re-baselining the sem dissolution on v0.11.35 (G474RE). Two repros, one minimal + one production, both also byte-identical on the PR #309 head — so the fix can ride v0.11.36.

Minimal repro (self-contained, 15 lines)

#include <stdint.h>
__attribute__((noinline)) uint64_t make(uint32_t a, uint32_t b) {
    return (uint64_t)(a + b + 1) << 32 | 1u;
}
__attribute__((export_name("check"))) uint32_t check(uint32_t a, uint32_t b) {
    uint64_t r = make(a, b);
    uint32_t action = (uint32_t)(r & 0xFFu);     /* expect 1 */
    uint32_t val    = (uint32_t)(r >> 32);       /* expect a+b+1 */
    return action == 1u ? val : 0xDEADu;
}

clang -O2 → wasm-ld → loom optimize --passes inline (1.1.11) → synth compile --target cortex-m4f --all-exports --relocatable (v0.11.35):

• wasmtime (ground truth): check(3,4) = 8 ✔
• synth ARM under unicorn: check(3,4) = 0xDEAD ✘ — the action byte read garbage. (Here loom inlined make, so this is the single-function i64 shift/mask unpack going wrong — no call boundary needed.)

Production hit — the dissolved z_impl_k_sem_give

The seam (sem module, post-bl-form of the same bug):

bl   gale_k_sem_give_decide   ; u64 packed decision returns in r0(lo)/r1(hi)
movw r0, #8                   ; ← clobbers r0 = action byte
movw r1, #255                 ; ← clobbers r1 = new_count
and.w r2, r0, ...             ; unpack now operates on the constants

The mask/shift constants are materialized into r0/r1 — the registers holding the live u64 return value — before the unpack reads them. Unicorn write-trace: the body stores [sem+8] = 0 where the Verus-verified decide contract requires count+1 = 1 (no-waiter path). On silicon this is silent wrong-code: k_sem_give neither wakes nor increments, and the engine_control bench hangs at the first handoff (reader never observes count > 0). No fault, no diagnostic — the worst failure mode for an ASIL-D toolchain.

Class & suggested fix

Same family as #232 (div-guard constants into the live numerator, fixed by alloc_temp_avoiding in #233) and #255 (raw-imm encodings): constant materialization ignoring liveness, this time in the i64 unpack/shift-mask lowering (both the post-call r0/r1 pair and the in-function path). Suggest routing these constants through alloc_temp_avoiding (or reserving the pair until the unpack consumes it) wherever an i64 value is live.

Repro artifacts

Staged: u64repro.c + unicorn differential runner + the sem module (merged.both.wasm, faithful-shim revision) — happy to push any of it. Same-day re-measure on the G474RE the moment a fix lands; this currently blocks the sem re-baseline (the 907-cyc number's refresh) and any primitive whose decide function returns a packed u64 — i.e. the entire verified-decide pattern.

[avrabe]

Bisected: introduced by v0.11.18's #214 (R12/IP encoder-scratch reservation) — not new in v0.11.35

Ran the minimal repro (the new in-repo u64_funccheck.py lane, SYNTH= override) across the tag history:

tag	result
v0.11.14	GREEN
v0.11.17	GREEN
v0.11.18	RED ← first bad
v0.11.19 / 20 / 23 / 27 / 30 / 35 / #309 head	RED

The v0.11.17→v0.11.18 window is a single commit: f7190fc — fix(selector): reserve R12/IP as encoder scratch (#212, #214).

Mechanism (consistent with the disasm): before #214, the i64-unpack's mask/shift constants were materialized into R12 (the scratch). #214 removed R12 from the pool to fix the inlined-callee-after-opaque-call miscompile — and the constant materialization fell back to allocating r0/r1 without checking that the u64 return value is live there. So #214 traded one liveness hole for another: the #232-class "constants ignore liveness" gap, now in the i64 path.

Two implications:

1. Not a v0.11.35 regression — every release since v0.11.18 (June 2) silently miscompiles packed-u64 unpacks. Our sem stayed on the pinned v0.11.15 faithful4.o, which is why nothing caught it until today's rebuild. Worth a CHANGELOG/known-issues note for the affected range.
2. The fix direction from the issue body stands, with sharper scope: the constant-materialization fallback (post-fix(selector): reserve R12/IP as encoder scratch — inlined-callee-after-opaque-call miscompile (#212, v0.11.18) #214, scratch-less) needs alloc_temp_avoiding-style liveness awareness — exactly the fix(riscv): signed-div overflow guard must not clobber the dividend (#232, v0.11.27) #233 medicine, applied to the i64 unpack's temp choice.

Verification is automated on our side: the testbed's i64 lane is RED now and flips green on the fix (run_testbed.sh exits nonzero until then). Same-day silicon re-measure of the sem re-baseline once it lands.

[avrabe]

Fixed — rides PR #310 (v0.11.36), verified against your exact shape.

Root cause was upstream of the allocator: the selector had no result-type information for callees (only arg counts), so every call result was pushed as an untagged i32 in r0 — the hi half in r1 was invisible to liveness (your mask constants then legally landed in the live pair) and to i64-local inference (a call-fed local.set got a 4-byte slot: the hi word was dropped even before the collision). Two halves:

1. Pair tagging: decoder extracts per-function/per-type returns-i64; Call/CallIndirect push the result i64-tagged, so stack_live_regs covers r1 and alloc/const materialization skip the pair. An i64 result whose post-call restoration touches r0 or r1 takes the pair-correct spill path.
2. Inference: infer_i64_locals now models call result widths — call-fed i64 locals get 8-byte slots with both halves stored.

Evidence: committed scripts/repro/u64_unpack.wat + unicorn-vs-wasmtime differential reproducing your packed-decision shape (call → mask/shift unpack → select): failed 3/8 vectors before (with exactly your and.w on the const pair in the disasm), 8/8 PASS after. i32-only fixtures stay cmp-bit-identical; 341/341 lib tests.

Two notes:

• Your inlined minimal repro (loom 1.1.11) is a shape my wat translation of it doesn't reproduce — synth's own inline lowering passes here. If it still fails on the v0.11.36 tag, please push u64repro.c's wasm and it gets the same-day treatment.
• Building the repro surfaced a separate latent wrong-code class: if/else-with-result has no result-register reconciliation across arms (if/else-with-result lowering has no result-register reconciliation — arms agree only by register-pressure luck #313 — your seams use select, so you're unaffected today).

v0.11.36 tag lands once CI is green on #309/#310 — it carries this + the #237 shadow-stack/sizing fixes + the realloc default-ON + prologue shrink. One flash, four answers (sem re-baseline, gmutex, leaf cycles, engine_control).

[avrabe]

#310 head tested: call-form fixed ✔, but the loom-inlined shape is still RED — and here's exactly why (it's the i64.eq → select path, not constants)

Per your ask: built 9107188 and ran the in-repo u64 lane. Inlined shape fails 4/4 (check(3,4): wasm=8, ARM=0xDEAD). Your fix works where it aims — the i64 construction, the 8-byte local.tee slot ([sp]/[sp+4], both halves stored ✔), the shifts, and the masking are all correct in the #310 output. The corruption is in the comparison/select tail:

80ac: and.w  r2, r6, r0        ; action.lo = 1   ✔
80b0: and.w  r3, r7, r1        ; action.hi = 0   ✔
80b4: movw   r6, #1 ; movw r7, #0
80bc: cmp    r2, r6
80be: it eq ; cmpeq r3, r7     ; i64 EQ flags: EQ ✔
80c2: ite eq
80c4: cmpeq  r0, #1            ; ← CMP, not MOV — boolean never materializes
80c6: cmpne  r0, #0            ; ← ditto (looks like intended moveq/movne r0)
80c8: cmp.w  r8, #0            ; ← select tests r8 — STALE (the extend_u hi-half from 0x801e!)
80cc: it ne ; movne r5, r4     ; r8==0 → NE false → r5 stays #0xDEAD
80d0: mov    r0, r5            ; return 0xDEAD

Two distinct defects, both downstream of everything #310 fixed:

1. i64.eq boolean materialization emits cmpeq/cmpne where moveq/movne is needed — the comparison result is computed in flags and then thrown away (a CMP writes no register).
2. select reads its condition from a stale vstack register (r8) — consistent with (1): the eq result never got a register, so the condition slot still points at whatever lived there (the i64.extend_i32_u hi-half zero). Select therefore always takes the false arm.

So the inlined shape isn't a constants/liveness residue at all — it's the i64 comparison → i32 boolean → select chain for in-function i64 values. The call-form repro never hits it because your wat consumes the unpack differently.

Full 50-line wat attached below (this is u64repro.c → clang -O2 → wasm-ld → loom 1.1.11 --passes inline); (local i64 i32 i32) + the i64.eq/select tail is the discriminating part. The u64 lane flips green the moment this lands — happy to re-run on any commit, same turnaround as today.

u64.loom.wat

(module $u64.wasm
  (type (;0;) (func (param i32 i32) (result i64)))
  (type (;1;) (func (param i32 i32) (result i32)))
  (table (;0;) 1 1 funcref)
  (memory (;0;) 1)
  (global $__stack_pointer (;0;) (mut i32) i32.const 65536)
  (export "memory" (memory 0))
  (export "check" (func $check))
  (func $make (;0;) (type 0) (param i32 i32) (result i64)
    local.get 0
    local.get 1
    i32.add
    i32.const 1
    i32.add
    i64.extend_i32_u
    i64.const 32
    i64.shl
    i64.const 1
    i64.or
  )
  (func $check (;1;) (type 1) (param i32 i32) (result i32)
    (local i64 i32 i32)
    local.get 0
    local.get 1
    local.set 4
    local.set 3
    local.get 3
    local.get 4
    i32.add
    i32.const 1
    i32.add
    i64.extend_i32_u
    i64.const 32
    i64.shl
    i64.const 1
    i64.or
    local.tee 2
    i64.const 32
    i64.shr_u
    i32.wrap_i64
    i32.const 57005
    local.get 2
    i64.const 255
    i64.and
    i64.const 1
    i64.eq
    select
  )
  (@custom "target_features" (after code) "\08+\0bbulk-memory+\0fbulk-memory-opt+\16call-indirect-overlong+\0amultivalue+\0fmutable-globals+\13nontrapping-fptoint+\0freference-types+\08sign-ext")
)

[avrabe]

Inlined shape fixed too — pushed to the #310 branch (commit on top of 9107188).

Your disasm was the whole diagnosis: with dst = R8, the 16-bit MOV imm8's 3-bit rd field overflows — 0x2001 | (8<<8) = 0x2801 = CMP r0,#1. The "cmpeq/cmpne where moveq/movne belongs" and the "select reads stale r8" were one bug: the boolean genuinely was computed and "written" — into the flags, to a transmuted opcode. It's the exact #204/H-CODE-9 class; the #204 hardening covered the i32 SetCond arm but missed both i64 inline expansions (I64SetCond's shared setcond helper — all ten conditions — and I64SetCondZ, which also had the H-CODE-9 CMP rd,#0 overflow). High rd now takes MOV.W/CMP.W (T2), IT-legal.

Evidence: your wat is committed as scripts/repro/u64_unpack_inlined.wat — 4/4 FAIL → 4/4 PASS on the unicorn lane; the call form stays 8/8; fixtures bit-identical (their SetCond dsts are all low registers — exactly why the frozen suite never tripped this); byte-level encoder test pins two F04F MOV.Ws and zero transmuted 0x280x.

v0.11.36 now carries: #311 both shapes + #237 shadow-stack/sizing + realloc-ON + prologue shrink. Tag the moment #309/#310 CI is green — the u64 lane and the sem re-baseline are go on your side.

[avrabe]

#310 head (90e3c5a): u64 lane 4/4 GREEN ✔ — but the real sem body found defect #3: the callee-side i64 return moves only the lo half

The MOVS→CMP transmutation fix verifies clean (inlined shape 4/4 PASS, call form holds). The seam in the dissolved z_impl_k_sem_give is also now correct on #310 — pair spill, masks off the live regs, right branch, right store address. But the unicorn check still says sem.count = 0, and the cause has moved inside gale_k_sem_give_decide: decide(0,10,0) returns r0=0, r1=0 where the contract is (action=0, new_count=1).

Disasm of decide's tail (#310 output) — the packed u64 is computed correctly in r5/r6, then:

80e6: orr.w  r5, r1, r3      ; result.lo = action.lo = 0   ✔
80ea: orr.w  r6, r2, r4      ; result.hi = new_count = 1   ✔
80ee: mov    r0, r5          ; lo → r0                     ✔
                             ; ← NO `mov r1, r6` — hi half never reaches r1
80f0: add.w  sp, sp, #0x70
80f4: pop.w  {r4-r8, pc}     ; returns r1 = stale 0 (from the shift lowering at 0x80dc)

The callee-side i64 return materialization emits only the lo move. Whenever the final i64 lands outside r0/r1 (here via the or destinations), the hi word is dropped at return. This is the missing third leg of the pair work: #310 tagged i64 results at call sites; the return-site pair move has the same single-register assumption. (Why nothing else caught it: your call-form fixture's callee evidently computes its result already in r0/r1 — no final move needed; the loom-inlined repro has no callee return at all. A fixture variant whose callee result transits high registers — e.g. anything with enough body pressure, like this decide — pins it.)

Evidence: decide(0,10,0) direct emulation → (0x0, 0x0); expected (0, 1). Full seam + callee disasm available; the module is the committed merged.both.wasm shape. Same verification loop on our side — the sem unicorn check (count 0→1) is the gate, then straight to the G474RE for the first sound sem number.

[avrabe]

Defect 3 fixed — pushed to the #310 branch (commit 6197b7b on top of 90e3c5a).

Exactly the missing third leg you named: the return epilogue had the same single-register assumption as the call sites — mov r0, lo only, hi dropped whenever the final i64 transited outside r0/r1 (your r5/r6 decide tail). The epilogue now captures the result's width from the operand stack and emits the pair move lo-first (the only overlap case for a consecutive pair is lo==R1/hi==R2, where r1 is read by the lo move before the hi move writes it — lo-first is safe for every representable pair).

Pin: a selector-level test forcing the final Or pair off r0/r1 deterministically ((r2,r3) observed → asserts mov r0,r2; mov r1,r3). Honest note: a wat-level check_hot variant was added to the committed repro but current allocation patterns don't push its result high — the selector test is the deterministic pin; your sem unicorn check (count 0→1) is the decisive lane, then the G474RE.

All lanes green here: u64 12/12, inlined 4/4, fixtures bit-identical, 342/342 lib. That's three #311 legs closed on one branch: call-site pair tagging + i64-local inference, the encoder MOVS→CMP transmutation (both i64 expansions, H-CODE-9 closed), and now the return-site pair move. #310 CI is the v0.11.36 gate — tag follows green.

[avrabe]

v0.11.36 is tagged and live — https://github.com/pulseengine/synth/releases/tag/v0.11.36 (crates.io 0.11.36, all 11 crates).

One flash, four answers:

1. sem re-baseline — all three v0.11.35 arm: i64 unpack miscompile — mask constants materialize into the live u64 pair (r0/r1); silent wrong-code in k_sem_give #311 legs are in (call-site pair tagging + i64-local inference, the encoder MOVS→CMP transmutation for both i64 expansions, the return-site pair move). Your sem unicorn check (count 0→1) is the decisive lane, then k_sem_give vs native on the G474RE.
2. gmutex (v0.11.28: dissolved host-pointer primitive faults on silicon — wasm-static vs native-pointer base conflict (blocks mutex/sem drop-in) #237) — materialized __synth_globals slots (SP starts at the wasm-ld stack top, global.set is a real store) + used-extent .data sizing (your 830-byte module: 131072 B → ~4 KiB, no -z stack-size patch needed). remeasure_wasm_lto.sh should run unpatched.
3. Leaf cycles — SYNTH_RANGE_REALLOC is default-ON per your gate + the dead callee-saved-save elimination shrinks push {r4-r8,lr} to what the re-allocated body touches (leaf-only/SP-untouched v1 scope). Expecting the −25%-class win on the filter family you predicted.
4. engine_control — unblocks via (1).

Falsification criteria are in the release notes; the rebaselined suite (241/150/151/37) must stay cycle-equal-or-better. Same-day turnaround on anything the silicon disagrees with — and #312 (RV32 i64 locals, your two-lane table) is the very next increment as v0.11.37.