dd09865611
When one branch target label in a MachBuffer is redirected to another, we eventually fix up branches targetting the first to refer to the redirected target instead. Separately, we have a branch-folding optimization that, when an unconditional branch occurs as the only instruction in a block (right at a label) and the previous instruction is also an unconditional branch (hence no fallthrough), we can elide that block entirely and redirect the label. Finally, we prevented infinite loops when resolving label aliases by chasing only one alias deep. Unfortunately, these three facts interacted poorly, and this is a result of our correctness arguments assuming a fully-general "redirect" that was not limited to one indirection level. In particular, we could have some label A that redirected to B, then remove the block at B because it is just a single branch to C, redirecting B to C. A would still redirect to B, though, without chasing to C, and hence a branch to B would fall through to the unrelated block that came after block B. Thanks to @bnjbvr for finding this bug while debugging the x64 backend and reducing a failure to the function in issue #2082. (This is a very subtle bug and it seems to have been quite difficult to chase; my apologies!) The fix is to (i) chase redirects arbitrarily deep, but also (ii) ensure that we do not form a cycle of redirects. The latter is done by very carefully checking the existing fully-resolved target of the label we are about to redirect *to*; if it resolves back to the branch that is causing this redirect, then we avoid making the alias. The comments in this patch make a slightly more detailed argument why this should be correct. Unfortunately we cannot directly test the CLIF that @bnjbvr reduced because we don't have a way to assert anything about the machine-code that comes after the branch folding and emission. However, the dedicated unit tests in this patch replicate an equivalent folding case, and also test that we handle branch cycles properly (as argued above). Fixes #2082.
This crate contains the core Cranelift code generator. It translates code from an intermediate representation into executable machine code.