[Tarantool-patches] [PATCH luajit v2] Fix narrowing of unary minus.
Maksim Kokryashkin
max.kokryashkin at gmail.com
Tue Sep 20 14:16:45 MSK 2022
From: Mike Pall <mike>
(cherry picked from commit 1e6e8aaa20626ac94cf907c69b0452f76e9f5fa5)
LuaJIT narrowing optimization during BC_UNM recording may ignore
information about sign of zero for integer types of IR. So far the
resulting value on a trace is not the same as for the interpreter.
However, in DUALNUM mode with using of TValues containing integers the
-0 value is represented in the same way as the 0 value and there is no
difference between them.
This patch fixes the non-DUALNUM mode behaviour. When the zero value is
identified during recording it should be cast to number so IR_CONV is
emitted. Also, this patch adds assertion guard checking that value on
which operation of unary minus is performed isn't zero.
Maxim Kokryashkin:
* added the description and the test for the problem
Resolves tarantool/tarantool#6976
Part of tarantool/tarantool#7230
---
Changes in v2:
- Fixed test and commit message as per review by Sergey
Branch and PR are updated.
src/lj_opt_narrow.c | 9 +++-
.../gh-6976-narrowing-of-unary-minus.test.lua | 51 +++++++++++++++++++
2 files changed, 58 insertions(+), 2 deletions(-)
create mode 100644 test/tarantool-tests/gh-6976-narrowing-of-unary-minus.test.lua
diff --git a/src/lj_opt_narrow.c b/src/lj_opt_narrow.c
index cd96ca4b..bb61f97b 100644
--- a/src/lj_opt_narrow.c
+++ b/src/lj_opt_narrow.c
@@ -551,8 +551,13 @@ TRef lj_opt_narrow_unm(jit_State *J, TRef rc, TValue *vc)
{
rc = conv_str_tonum(J, rc, vc);
if (tref_isinteger(rc)) {
- if ((uint32_t)numberVint(vc) != 0x80000000u)
- return emitir(IRTGI(IR_SUBOV), lj_ir_kint(J, 0), rc);
+ uint32_t k = (uint32_t)numberVint(vc);
+ if ((LJ_DUALNUM || k != 0) && k != 0x80000000u) {
+ TRef zero = lj_ir_kint(J, 0);
+ if (!LJ_DUALNUM)
+ emitir(IRTGI(IR_NE), rc, zero);
+ return emitir(IRTGI(IR_SUBOV), zero, rc);
+ }
rc = emitir(IRTN(IR_CONV), rc, IRCONV_NUM_INT);
}
return emitir(IRTN(IR_NEG), rc, lj_ir_ksimd(J, LJ_KSIMD_NEG));
diff --git a/test/tarantool-tests/gh-6976-narrowing-of-unary-minus.test.lua b/test/tarantool-tests/gh-6976-narrowing-of-unary-minus.test.lua
new file mode 100644
index 00000000..18778a55
--- /dev/null
+++ b/test/tarantool-tests/gh-6976-narrowing-of-unary-minus.test.lua
@@ -0,0 +1,51 @@
+local tap = require('tap')
+local test = tap.test('gh-6976-narrowing-of-unary-minus')
+test:plan(2)
+
+jit.opt.start('hotloop=1', 'hotexit=1')
+
+local function check(routine)
+ jit.off()
+ jit.flush()
+ local interp_res = routine()
+ jit.on()
+ local jit_res = routine()
+
+ for i = 1, #interp_res do
+ if interp_res[i] ~= jit_res[i] then
+ return false
+ end
+ end
+
+ return true
+end
+
+test:ok(
+ check(
+ function()
+ local res = require('table.new')(3, 0)
+ for _ = 1, 3 do
+ local zero = 0
+ zero = -zero
+ table.insert(res, tostring(zero))
+ end
+ return res
+ end
+ ),
+ 'incorrect recording for zero'
+)
+
+test:ok(
+ check(
+ function()
+ local res = require('table.new')(3, 0)
+ for i = 2, 0, -1 do
+ table.insert(res, tostring(-i))
+ end
+ return res
+ end
+ ),
+ 'assertion guard fail'
+)
+
+os.exit(test:check() and 0 or 1)
--
2.32.1 (Apple Git-133)
More information about the Tarantool-patches
mailing list