[Tarantool-patches] [PATCH luajit] Fix maxslots when recording BC_TSETM.

[Maxim Kokryashkin]

Hi, Sergey!
Thanks for the patch!
Please consider my comments below.

On Fri, Aug 25, 2023 at 06:00:24PM +0300, Sergey Kaplun wrote:
> From: Mike Pall <mike>
> 
> Analyzed by Sergey Kaplun.
> 
> (cherry-picked from commit 0cc5fdfbc0810073485150eb184dc358dab507d9)
> 
> Recording of the `BC_TSETM` bytecode may keep too optimistic JIT
> maxslot. In that case, the slot above the top of the Lua stack may be
Typo: s/too optimistic JIT maxslot./the JIT maxslot too optimistic./
> considered used. When any VM event handler is called before the
> recording of the next instruction, this leads to an assertion failure in
> `rec_check_slots()`.
> 
> This patch sets the `ra` as a maxslot, as far as the `ra` - 1 contains a
> table, which is always the highest slot after this bytecode. Also, it
> adds an assertion that we check slots below the top of the Lua stack.
> 
> Sergey Kaplun:
> * added the description and the test for the problem
> 
> Part of tarantool/tarantool#8825
> ---
> 
> Branch: https://github.com/tarantool/luajit/tree/skaplun/lj-1025-tsetm-maxslot
> Tarantool PR: https://github.com/tarantool/tarantool/pull/9040
> Issues:
> * https://github.com/LuaJIT/LuaJIT/issues/1025
> * https://github.com/tarantool/tarantool/issues/8825
> 
>  src/lj_record.c                               |  2 +
>  .../lj-1025-tsetm-maxslot.test.lua            | 52 +++++++++++++++++++
>  2 files changed, 54 insertions(+)
>  create mode 100644 test/tarantool-tests/lj-1025-tsetm-maxslot.test.lua
> 
> diff --git a/src/lj_record.c b/src/lj_record.c
> index 34d1210a..58b040ec 100644
> --- a/src/lj_record.c
> +++ b/src/lj_record.c
> @@ -115,6 +115,7 @@ static void rec_check_slots(jit_State *J)
>        cTValue *tv = &base[s];
>        IRRef ref = tref_ref(tr);
>        IRIns *ir = NULL;  /* Silence compiler. */
> +      lj_assertJ(tv < J->L->top, "slot %d above top of Lua stack", s);
>        if (!LJ_FR2 || ref || !(tr & (TREF_FRAME | TREF_CONT))) {
>  	lj_assertJ(ref >= J->cur.nk && ref < J->cur.nins,
>  		   "slot %d ref %04d out of range", s, ref - REF_BIAS);
> @@ -2342,6 +2343,7 @@ void lj_record_ins(jit_State *J)
>  
>    case BC_TSETM:
>      rec_tsetm(J, ra, (BCReg)(J->L->top - J->L->base), (int32_t)rcv->u32.lo);
> +    J->maxslot = ra;  /* The table slot at ra-1 is the highest used slot. */
>      break;
>  
>    case BC_TNEW:
> diff --git a/test/tarantool-tests/lj-1025-tsetm-maxslot.test.lua b/test/tarantool-tests/lj-1025-tsetm-maxslot.test.lua
> new file mode 100644
> index 00000000..7ae0a99d
> --- /dev/null
> +++ b/test/tarantool-tests/lj-1025-tsetm-maxslot.test.lua
> @@ -0,0 +1,52 @@
> +local tap = require('tap')
> +
> +-- Test file to demonstrate LuaJIT incorrect recording of `TSETM`
> +-- bytecode.
> +-- See also: https://github.com/LuaJIT/LuaJIT/issues/1025.
> +
> +local test = tap.test('lj-1025-tsetm-maxslot'):skipcond({
> +  ['Test requires JIT enabled'] = not jit.status(),
> +})
> +
> +test:plan(1)
> +
> +local jit_dump = require('jit.dump')
> +
> +local TEST_VALUE = '5'
> +local TEST_IDX = 5
> +
> +local function slot5()
> +  return nil, nil, nil, nil, TEST_VALUE
> +end
Why the fifth slot? Drop a comment.
> +
> +local storage
> +local function test_tsetm(...)
> +  -- Usage of `TSETM` bytecode.
> +  storage = {slot5()}
> +  -- Use this function again to trick use-def analysis and avoid
> +  -- cleaning JIT slots, so the last JIT slot contains
> +  -- `TEST_VALUE`.
> +  return slot5(...)
> +end
> +
> +-- Wrapper to avoid the recording of just the inner `slot5()`
> +-- function.
> +local function wrap()
> +  test_tsetm()
> +end
> +
> +jit.opt.start('hotloop=1')
> +-- We need to call the VM event handler after each recorded bytecode
> +-- instruction to pollute the Lua stack and the issue
> +-- becomes observable.
Typo: s/and the issue becomes/and make the issue/
> +jit_dump.start('b', '/dev/null')
> +
> +-- Compile and execute the trace with `TSETM`.
> +wrap()
> +wrap()
> +wrap()
> +
> +test:is(storage[TEST_IDX], TEST_VALUE,
> +        'BC_TSETM recording with enabled jit.dump')
> +
> +test:done(true)
> -- 
> 2.41.0
>