Cranelift: Regalloc panic with `splat.f32x4` on AArch64

[afonso360]

👋 Hey,

I was re-running the fuzzer on AArch64 (with #5971) and it found something new.

.clif Test Case

test compile
target aarch64

function %a() -> f32x4 system_v {
block0:
    v16 = f32const 0x1.fffe00p-126
    v25 = splat.f32x4 v16
    return v25
}

Steps to Reproduce

• clif-util test ./the-above.clif

Expected Results

The test to pass.

Actual Results

    Finished dev [unoptimized + debuginfo] target(s) in 0.24s
     Running `/home/afonso/git/wasmtime/target/debug/clif-util test ./lmao.clif`
 ERROR cranelift_codegen::machinst::compile > Register allocation error for vcode
VCode {
  Entry block: 0
  v129 := v130
Block 0:
    (original IR block: block0)
    (instruction range: 0 .. 2)
  Inst 0: movi %v131.2d, #72056494543077120
  Inst 1: ret %v129=v0
}

Error: SSA(VReg(vreg = 130, class = Float), Inst(1))
CLIF for error:
function %a() -> f32x4 system_v {
block0:
    v16 = f32const 0x1.fffe00p-126
    v25 = splat.f32x4 v16  ; v16 = 0x1.fffe00p-126
    return v25
}

thread 'worker #0' panicked at 'register allocation: SSA(VReg(vreg = 130, class = Float), Inst(1))', cranelift/codegen/src/machinst/compile.rs:69:14
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
 ERROR cranelift_filetests::concurrent      > FAIL: panicked in worker #0: register allocation: SSA(VReg(vreg = 130, class = Float), Inst(1))
FAIL ./lmao.clif: panicked in worker #0: register allocation: SSA(VReg(vreg = 130, class = Float), Inst(1))
1 tests
Error: 1 failure

Versions and Environment

Cranelift version or commit: main

Operating system: Linux

Architecture: AArch64

Extra Info

This is reachable via wasm! Here's a .wast reproducer.

(module
  (memory 1)
  (func $bad  (result v128)
    f32.const 0x1.fffe00p-126
    f32x4.splat
  )

  (func $start
        call $bad
        drop
      )
  (start $start)
)

[cfallin]

Taking a look now!

[cfallin]

Fixed in #5987. While strictly speaking this is a panic within regalloc2, it occurs because it's validating its input and the input from lowering is invalid; we might in the future call this sort of bug an "SSA validator error" for better triage (or at least, to freak me out less :-) ).