ISLE: guard against stale generated source in default build config.

[cfallin]

Currently, the build.rs script that generates Rust source from the
ISLE DSL will only do this generation if the rebuild-isle Cargo
feature is specified. By default, it is not. This is based on the
principle that we (the build script) do not modify the source tree as
managed by git; git-managed files are strictly a human-managed and
human-edited resource. By adding the opt-in Cargo feature, a developer
is requesting the build script to perform an explicit action. (In my
understanding at least, this principle comes from the general philosophy
of hermetic builds: the output should be a pure function of the input,
and part of this is that the input is read-only. If we modify the source
tree, then all bets are off.)

Unfortunately, requiring the opt-in feature also creates a footgun that
is easy to hit: if a developer modifies the ISLE DSL source, but forgets
to specify the Cargo feature, then the compiler will silently be built
successfully with stale source, and will silently exclude any changes
that were made.

The generated source is checked into git for a good reason: we want DSL
compiler to not affect build times for the overwhelmingly common case
that Cranelift is used as a dependency but the backends are not being
actively developed. (This overhead comes mainly from building islec
itself.)

So, what to do? This PR implements a middle ground first described in
this conversation, in which we:

• Generate a hash (SHA-512) of the ISLE DSL source and produce a
  "manifest" of ISLE inputs alongside the generated source; and
• Always read the ISLE DSL source, and see if the manifest is still
  valid, on builds that do not have the opt-in "rebuild" feature.

This allows us to know whether the ISLE compiler output would have been
the same (modulo changes to the DSL compiler itself, which are
out-of-scope here), without actually building the ISLE compiler and
running it.

If the compiler-backend developer modifies an ISLE source file and then
tries to build cranelift-codegen without adding the rebuild-isle
Cargo feature, they get the following output:

  Error: the ISLE source files that resulted in the generated Rust source

        * src/isa/x64/lower/isle/generated_code.rs

  have changed but the generated source was not rebuilt! These ISLE source
  files are:

         * src/clif.isle
         * src/prelude.isle
         * src/isa/x64/inst.isle
         * src/isa/x64/lower.isle

  Please add `--features rebuild-isle` to your `cargo build` command
  if you wish to rebuild the generated source, then include these changes
  in any git commits you make that include the changes to the ISLE.

  For example:

    $ cargo build -p cranelift-codegen --features rebuild-isle

  (This build script cannot do this for you by default because we cannot
  modify checked-into-git source without your explicit opt-in.)

which will tell them exactly what they need to do to fix the problem!

Note that I am leaving the "Rebuild ISLE" CI job alone for now, because
otherwise, we are trusting whomever submits a PR to generate the correct
generated source. In other words, the manifest is a communication from
the checked-in tree to the developer, but we still need to verify that
the checked-in generated Rust source and the manifest are correct with
respect to the checked-in ISLE source.

[github-actions]

Subscribe to Label Action

cc @cfallin, @fitzgen

This issue or pull request has been labeled: "cranelift", "cranelift:area:x64", "isle"

Thus the following users have been cc'd because of the following labels:

• cfallin: isle
• fitzgen: isle

To subscribe or unsubscribe from this label, edit the .github/subscribe-to-label.json configuration file.

Learn more.

[alexcrichton]

Seems reasonable to me! One thing I might recommend though is to use this logic even if rebuild-isle is specified, since that helps cut down on spurious rebuilds since we don't overwrite source files with their same contents. I'm imagining something like:

fn main() {
    maybe_rebuild_isle();
}

fn maybe_rebuild_isle() {
    let manifest = isle_manifest();

    if !manifest.up_to_date() {
        rebuild_isle(&manifest);
    }
}

#[cfg(feature = "rebuild-isle")]
fn rebuild_isle(manifest: &Manifest) {
    // do the actual build
}

#[cfg(not(feature = "rebuild-isle"))]
fn rebuild_isle(_manifest: &Manifest) {
    panic!("ISLE needs a rebuild but `rebuild-isle` isn't specified");
}

Otherwise one of the downsides today is that if you rebuild ISLE it tricks Cargo into thinking that the files changed so everything is always rebuilt, causing somewhat unnecessary rebuilds.

---

Another thing I think we might need to address (which I suspect is why Windows is failing CI) is that line endings can change which can tamper with a source file's checksum. I think that's fine though we can do a replace("\r\n", "\n") before we calculate the checksum of the file and that should do the trick.

[cfallin]

@alexcrichton That's an excellent idea -- I've refactored now so that it always computes the manifest, and then either rebuilds or errors out when a recompilation is required, depending on the rebuild-isle feature. Let me know what you think!

[cfallin]

Just an interesting data point: some of the latest CI failures were because this PR needed a rebase, so the manifest hashes were out-of-date with respect to latest main. This is actually what we want and I'm happy to see it worked: otherwise, if we allow merges of non-rebased ISLE source, the checked-in generated source will go through a git merge as well and who knows how well that'd correspond (due to e.g. renumbered temps, different trie build orders, etc).

Also I had to disable the ISLE build logic via a special Cargo feature in the "Meta deterministic check"; as explained in the commit message, this runs the build script outside of the source tree, which worked previously because the default build options did not look for ISLE source, but now they do. The CI job is checking other output (unrelated to ISLE) though, so this seems fine.

[alexcrichton]

I'm not too stoked about the stuff to deal with the deterministic check, but it's pretty minor and we can live with it. I don't think it's ever actually caught anything, so I'd be in favor of removing it myself or, as you mentioned, figuring out a better way to test it.

[cfallin]

Cool, yeah, we can maybe think more about this at the same time that we think about whether we want to check in the meta-DSL-generated source too (which IIRC we've discussed as a way to reduce compile time). I'll leave it as-is for this PR and create a followup issue to track it.