You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copying from one slot to another should add a copy of every constraint that
includes the RHS of the assignment to the copy postcondition (with the RHS
renamed, in the constraint, to the new LHS slot).
In other words:
let int x = 10;
let int y = 11;
check lt(x,y); // postcond = { lt(x,y) }
let int z = x; // postcond = { lt(x,y), lt(z,y) }
Unless some horrible complications arise that make this impossible, I believe
the current rules permit this propagation to work.
Phase 2b RCA update (2026-04-25): The bug pattern reported here ('LLVM SH4 tail-call-opt drops arg-setup across extern "C"') is not a tail-call-opt issue. Phase 2b SDAG capture identified the root cause as our own SuperHFixupCallClobber.cpp post-PEI peephole pass.
The pass walks backwards from each JSR @rN looking for a MOV32PCR that defined $rN and, if it sees an intervening def of $rN (a 'clobber'), inserts a fresh $r1 = MOV32PCR <CPI> before the JSR and rewrites the JSR target to $r1. The flaw: it doesn't bail on intervening kills of $rN. If an unrelated MOV32PCR loaded a static-global address into $rN, that address was used+killed by an immediate consumer (e.g., another MOV32mr), and $rN was later reused as a legitimate JSR-target carrier (e.g., $r0 = MOV32mrd $r14, 0 for a stack-spilled fn-ptr), the pass mis-identifies the unrelated MOV32PCR as the JSR's source and rewrites the JSR target to load the unrelated global address.
In the relibc_start_v1 main() call site this manifested as: $r5 silently aliased to *(&environ) (CSE-collapse against the prior environ load) and JSR @r1 jumping to literal &argv (.bss).
Fix: bail when the backward walk sees a killed $CallReg USE — the kill flag marks the last use of the value held in CallReg from its previous def; any earlier MOV32PCR was meant for that consumer, not for the JSR. Lands in rustx-sh4 v4.4.63. Phase 2b artifacts: /var/tmp/sh4-issue18-phase2/. Arbiter contract #44.
Activity
graydon commentedon Jan 27, 2011
Shifted to rustc
catamorphism commentedon Jul 9, 2011
Fixed in 182c413
Merge pull request rust-lang#35 from sfackler/socketpair
Merge pull request rust-lang#35 from mrhota/undoc_appendix
define FileMap; fix rust-lang#35
Fixes rust-lang#35: Code coverage fixes
Auto merge of rust-lang#118488 - andjo403:remove_deadlock, r=SparrowLii
Auto merge of rust-lang#118488 - andjo403:remove_deadlock, r=SparrowLii
Rollup merge of rust-lang#118488 - andjo403:remove_deadlock, r=Sparro…
Auto merge of rust-lang#118488 - andjo403:remove_deadlock, r=SparrowLii
Merge rust-lang#35
Merge rust-lang#35
Merge rust-lang#35
jsloan-red-button commentedon Apr 25, 2026
Phase 2b RCA update (2026-04-25): The bug pattern reported here ('LLVM SH4 tail-call-opt drops arg-setup across extern "C"') is not a tail-call-opt issue. Phase 2b SDAG capture identified the root cause as our own
SuperHFixupCallClobber.cpppost-PEI peephole pass.The pass walks backwards from each
JSR @rNlooking for aMOV32PCRthat defined$rNand, if it sees an intervening def of$rN(a 'clobber'), inserts a fresh$r1 = MOV32PCR <CPI>before the JSR and rewrites the JSR target to $r1. The flaw: it doesn't bail on intervening kills of $rN. If an unrelated MOV32PCR loaded a static-global address into $rN, that address was used+killed by an immediate consumer (e.g., another MOV32mr), and $rN was later reused as a legitimate JSR-target carrier (e.g.,$r0 = MOV32mrd $r14, 0for a stack-spilled fn-ptr), the pass mis-identifies the unrelated MOV32PCR as the JSR's source and rewrites the JSR target to load the unrelated global address.In the relibc_start_v1 main() call site this manifested as: $r5 silently aliased to *(&environ) (CSE-collapse against the prior environ load) and
JSR @r1jumping to literal &argv (.bss).Fix: bail when the backward walk sees a
killed $CallRegUSE — the kill flag marks the last use of the value held in CallReg from its previous def; any earlier MOV32PCR was meant for that consumer, not for the JSR. Lands in rustx-sh4 v4.4.63. Phase 2b artifacts:/var/tmp/sh4-issue18-phase2/. Arbiter contract #44.feat: support variadic (rust-lang#35)
Merge pull request rust-lang#35 from makai410/changes