Optimized (non-relocatable) path miscompiles block/br_if: branch target lands mid-instruction

[avrabe]

Summary

On the optimized (non-relocatable) ARM path (optimizer_bridge.rs::ir_to_arm), a block + br_if lowers to a conditional branch whose target is miscomputed — it lands in the middle of an instruction and does not skip past the block. Surfaced incidentally while validating an unrelated optimized-path change; not present on the --relocatable path.

Repro (generic)

(module
  (memory 1)
  (export "memory" (memory 0))
  (func (export "init_branch") (param $sel i32)
    (i32.store (i32.const 0) (i32.const 11))
    (i32.store (i32.const 4) (i32.const 22))
    (block $skip
      (br_if $skip (i32.eqz (local.get $sel)))
      (i32.store (i32.const 8)  (i32.const 33))
      (i32.store16 (i32.const 12) (i32.const 44)))))

synth compile init_branch.wat -o /tmp/b.elf -b arm --target cortex-m4 --all-exports
arm-none-eabi-objdump -d -M force-thumb /tmp/b.elf

The emitted bne.n targets offset 0xdc, which is the 3rd byte of the movw r9,#8 that begins the conditional block (0xda), rather than the address after the block. Executing init_branch(0) (br_if taken → block should be skipped) under emulation yields wrong memory ({0:33, 4:22, 12:44}) vs wasmtime ground truth ({0:11, 4:22} — fields 8/12 untouched).

Scope

• Only the optimized path. --relocatable (the host-link / native-pointer path) is unaffected.
• The branch-target/offset resolution for block/br_if appears to compute against the wrong instruction index (off by a fraction of an instruction → mid-instruction landing).

Impact

Any non-relocatable compile of a function with block/br_if (or other multi-block control flow that routes through this path) can silently miscompile. Belongs to the patch-accreting-codegen class the VCR-* program (#242) is replacing.

Notes

Found while gating a separate optimized-path perf change (#468) — that change explicitly declines on any control flow, so it is unaffected and does not depend on this fix. Filing separately so the control-flow miscompile is tracked on its own.

[avrabe]

[issue-hunt loop] Fixed in #497 (merged to main as 024be09).

Two root causes: (1) the forward block's End labelled with its own id instead of the closed block's id, so br_if resolved against an id no label held → unpatched offset-0 placeholder (mid-instruction landing); (2) the byte_offsets size estimator sized Strh/Strb/Ldrh/Ldrsh/Ldrb/Ldrsb as 2 bytes when the optimized path emits the 4-byte .w form (high base), drifting the resolved target by 2.

Validated by a new CI-gated unicorn differential (block_brif_483_differential.py) — memory diff vs wasmtime across both branch directions for a forward block and a nested block+br; fails without the fix. Frozen byte gate bit-identical (direct path untouched).

Follow-ups filed: #498 (size-estimator completeness for Cmp/Cmn/Adds/Subs/Popcnt) and #499 (pre-existing spill+control-flow frame not deallocated, made fatal by #490's pop epilogue — #215-class).