test(vcr-oracle): #509 oracle-first — value-returning-branch drop on the shipped path (#242)#529
Merged
Merged
Conversation
…anch drop on the shipped path (#242, #509) No new external signal this issue-hunt pass (gates #418/#472/#396-emitter still await external triggers; no new issues/comments since watermark; deps unchanged). Bounded behavior-frozen #242 increment: land the oracle for the confirmed, still-open, SHIPPED-path #509 miscompile (distinct defect class from #518 — block-arity value-carry, not i64 params). #509: the DIRECT selector (so the --relocatable/shipped path) drops the CARRIED VALUE of a value-returning branch. Measured vs wasmtime under unicorn: - br_table value-carry (pick): dispatched arms drop the carry — pick(1) -> 2 vs wasmtime 12 (returns 0+2, the carried 10 lost). Broken on BOTH paths. - br_if value-carry (pick_brif): taken arm drops the carry — pick_brif(1) -> 0 vs 10 on the direct/shipped path. - ctrl (branchless value-returning block): correct on both paths — the discriminator proving the defect is the branch value-carry, not result-typed blocks in general. Richer than the issue stated: the DEFAULT (optimized) path handles br_if value-carry but still drops br_table value-carry, so the bug is non-uniform. Frozen-safe (no codegen touched; frozen anchors 3/3 green): - scripts/repro/br_value_509.wat + br_table_value_509_differential.py: stable characterization (EXPECT_MISCOMPILE; exit 0 = bug-as-documented). The gated block-arity fix flips it to the correctness gate. - Corrected a STALE over-claim: br_table_507_differential.py's header advertised a "value-returning" shape its FIXTURES never contained (only the two void-dispatch shapes) — now points at the #509 oracle for that case. - roadmap VCR-ORACLE-001 #509 entry: record the oracle + measurements. The byte-changing block-arity fix stays a separate gated step (decoder -> WasmOp::Block/Loop/If arity + result-register convention), not this idle tick. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Issue-hunt pass with no new external signal (gates #418/#472/#396-emitter still await external triggers; no new issues/comments since the watermark; deps unchanged). Bounded behavior-frozen #242 increment: land the oracle for the confirmed, still-open, shipped-path #509 miscompile — a distinct defect class from #518 (block-arity value-carry, not i64 params).
#509 — value carried over a branch is dropped (direct/shipped path)
Measured vs wasmtime under unicorn:
pick): dispatched arms drop the carry —pick(1)→ 2 vs wasmtime 12 (returns0+2, the carried10lost). Broken on both paths.pick_brif): taken arm drops the carry —pick_brif(1)→ 0 vs 10 on the direct/shipped path.ctrl(branchless value-returning block): correct on both paths — the discriminator proving the defect is the branch value-carry, not result-typed blocks in general.Richer than the issue stated: the default (optimized) path handles
br_ifvalue-carry but still dropsbr_tablevalue-carry, so the bug is non-uniform across paths.Changes (frozen-safe — no codegen touched; frozen anchors 3/3 green)
scripts/repro/br_value_509.wat+br_table_value_509_differential.py: stable characterization (EXPECT_MISCOMPILE; exit 0 = bug-as-documented). The gated block-arity fix flips it to the correctness gate.br_table_507_differential.py's header advertised a "value-returning" shape itsFIXTURESnever contained (only the two void-dispatch shapes) — now points at the Direct selector miscompiles value-returning br_table — carried value dropped (affects --relocatable/shipped path) #509 oracle for the carried-value case.VCR-ORACLE-001Direct selector miscompiles value-returning br_table — carried value dropped (affects --relocatable/shipped path) #509 entry: record the oracle + measurements.The byte-changing block-arity fix (decoder →
WasmOp::Block/Loop/Ifarity + result-register convention) stays a separate gated step.Refs #242, #509.
🤖 Generated with Claude Code