Skip to content

ion: reject a fixed def that conflicts with a clobber - #266

Open
agourakis82 wants to merge 1 commit into
bytecodealliance:mainfrom
agourakis82:fix-issue-222-fixed-def-clobber
Open

agourakis82 wants to merge 1 commit into
bytecodealliance:mainfrom
agourakis82:fix-issue-222-fixed-def-clobber

Conversation

@agourakis82

Copy link
Copy Markdown

Fixes #222.

A clobber is documented as a fixed late def of a throwaway vreg, and Function::inst_clobbers states that naming the same physical register as both a clobber and a fixed def or late use is illegal. The ion allocator modeled that overlap as a non-evictable fixed reservation, then panicked:

Could not allocate minimal bundle, but the allocation problem should be possible to solve

The bundle pinned to that register is minimal, so it cannot be split or moved, and the clobber cannot be evicted. Allocation is impossible. Return RegAllocError::TooManyLiveRegs instead, which is the existing error for impossible fixed constraints.

The regression test is the program from #222: a late def fixed in p0 on an instruction that also clobbers p0.

A clobber is a fixed late def of a throwaway vreg. When a real fixed def occupies that same register, the bundle is minimal and the reservation cannot be evicted, so allocation is impossible. Return TooManyLiveRegs instead of panicking.

Fixes bytecodealliance#222.

Co-Authored-By: Claude <noreply@anthropic.com>
@agourakis82

Copy link
Copy Markdown
Author

I did a small independent read-through and local verification of this PR.

The fix matches the documented inst_clobbers contract: a clobber is modeled as a fixed late def of a throwaway vreg, and the API explicitly says clobbers must not collide with fixed defs or late uses. In the reproducer from #222, v1 fixed(p0) overlaps with Clobber: p0, so the allocation is impossible rather than a solvable bundle-placement problem.

I also verified the new regression test locally at the PR head:

HEAD=3e948a5fcd4e9d590c6d390204d2be7469f34ff0
rustc 1.95.0 (59807616e 2026-04-14)
cargo 1.95.0 (f2d3ce0bd 2026-03-21)
cargo test fixed_def_conflicting_with_clobber_is_an_error -- --nocapture

test ion::tests::fixed_def_conflicting_with_clobber_is_an_error ... ok
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 10 filtered out

So from my review, returning RegAllocError::TooManyLiveRegs here looks consistent with the existing "impossible constraints" path and avoids turning an invalid input into an allocator panic.

@cfallin

cfallin commented Sep 29, 2026

Copy link
Copy Markdown
Member

@agourakis82 to clarify, when you say

I did a small independent read-through and local verification of this PR.

do you mean to say that you did not read the initial diff that you submitted? I am somewhat confused by your use of the word "independent", as you are both the original author and the purported "independent" reader.

(The change looks reasonable, and sorry that I've been slow to review -- very busy -- but now that you post the above, I'd want to get clarification on the development process and your level of involvement before moving forward.)

@agourakis82

Copy link
Copy Markdown
Author

Thanks for asking, and sorry for the confusing wording. I authored the patch and also did a separate pass over the final diff and targeted test after the fact, using AI assistance as a review aid. So "independent" was not meant to imply an independent human reviewer; it was my own follow-up verification pass. I am the human author/reviewer for the change and can answer questions about the code and test.

@cfallin cfallin left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks -- I think the fix is right, but I'd like to see this fuzzed (and not unit-tested -- that's too white-box and leaves interactions with other parts of the allocator untested). Once you've got fuzzing supported, let's fuzz for at least 24 hours on a fast machine to ensure that we don't have unexpected interactions.

Comment thread src/ion/mod.rs
}

#[test]
fn fixed_def_conflicting_with_clobber_is_an_error() {

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't think we need this test: we don't have any other unit tests like this, it's quite verbose, and we can instead test by modifying the fuzzer to generate such cases.

Can you update the fuzzer to generate these cases?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Conflicting defs and clobbers lead to panic rather than clean error from allocator

2 participants