Skip to content

winch: Properly zero extend the CAS result#12994

Merged
saulecabrera merged 1 commit intobytecodealliance:mainfrom
saulecabrera:winch-properly-uextend-cmpxchg
Apr 10, 2026
Merged

winch: Properly zero extend the CAS result#12994
saulecabrera merged 1 commit intobytecodealliance:mainfrom
saulecabrera:winch-properly-uextend-cmpxchg

Conversation

@saulecabrera
Copy link
Copy Markdown
Member

Accoding to the spec, the result of a compare-and-swap operation must be zero extended according to the result type. Prior to this commit the implementation was skipping the 32 -> 64 bit case.

When the swap happens, the value in rax remains untouched, however, it's possible that the higher bits are undefined, in which case the zero extension is needed to ensure that the right value is returned.

This bug is only reproducible for values in which the lower bits match the expected value, like in the example included in this commit.

@saulecabrera saulecabrera requested review from a team as code owners April 8, 2026 22:52
@saulecabrera saulecabrera requested review from fitzgen and uweigand and removed request for a team April 8, 2026 22:52
@github-actions github-actions bot added the winch Winch issues or pull requests label Apr 9, 2026
@github-actions
Copy link
Copy Markdown

github-actions bot commented Apr 9, 2026

Subscribe to Label Action

cc @saulecabrera

Details This issue or pull request has been labeled: "winch"

Thus the following users have been cc'd because of the following labels:

  • saulecabrera: winch

To subscribe or unsubscribe from this label, edit the .github/subscribe-to-label.json configuration file.

Learn more.

Copy link
Copy Markdown
Member

@fitzgen fitzgen left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks!

@fitzgen fitzgen added this pull request to the merge queue Apr 9, 2026
@alexcrichton alexcrichton removed this pull request from the merge queue due to a manual request Apr 9, 2026
@alexcrichton
Copy link
Copy Markdown
Member

Manually removing from queue due to failure at https://github.com/bytecodealliance/wasmtime/actions/runs/24209086212/job/70672712892

Accoding to the spec, the result of a compare-and-swap operation must
be zero extended according to the result type. Prior to this commit
the implementation was skipping the 32 -> 64 bit case.

When the swap happens, the value in `rax` remains untouched, however,
it's possible that the higher bits are undefined, in which case the
zero extension is needed to ensure that the right value is returned.

This bug is only reproducible for values in which the lower bits match the
expected value, like in the example included in this commit.
@saulecabrera saulecabrera force-pushed the winch-properly-uextend-cmpxchg branch from 0705b3d to abf278b Compare April 10, 2026 14:27
@saulecabrera
Copy link
Copy Markdown
Member Author

Ok, I've fixed the issues. I'll re-add to the queue.

@saulecabrera saulecabrera enabled auto-merge April 10, 2026 14:39
@saulecabrera saulecabrera added this pull request to the merge queue Apr 10, 2026
Merged via the queue into bytecodealliance:main with commit 0db81cc Apr 10, 2026
48 checks passed
@saulecabrera saulecabrera deleted the winch-properly-uextend-cmpxchg branch April 10, 2026 15:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

winch Winch issues or pull requests

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants