[Tarantool-patches] [PATCH luajit] Add missing coercion when recording select(string, ...)

[Sergey Bronnikov]

Hi, Sergey,

thanks for the patch!

See minor comment below.

LGTM


On 23.09.2024 14:28, Sergey Kaplun wrote:
> From: Mike Pall <mike>
>
> Thanks to Peter Cawley.
>
> (cherry picked from commit 92b89d005ab721a61bce6d471b052bcb236b81d7)
>
> Before the patch, the recording of `select()` with a string argument
> leads to the following IR:
> | rcx   >  int CONV   "1"   int.num index
> Where the operand has string type instead of number type.
> This leads to the corresponding mcode:
> | cvttsd2si ecx, xmm1
> Where xmm1 has an undefined value. Thus leads to the undefined behaviour
> for the recording trace.
>
> This patch adds the missing coercion.
>
> Sergey Kaplun:
> * added the description and the test for the problem
>
> Part of tarantool/tarantool#10199
> ---
>
> Branch:https://github.com/tarantool/luajit/tree/skaplun/lj-1083-missing-tostring-coercion-in-select
> Related issues:
> *https://github.com/tarantool/tarantool/issues/10199
> *https://github.com/LuaJIT/LuaJIT/issues/1083
>
>   src/lj_record.c                               |  5 ++-
>   ...ssing-tostring-coercion-in-select.test.lua | 39 +++++++++++++++++++
>   2 files changed, 43 insertions(+), 1 deletion(-)
>   create mode 100644 test/tarantool-tests/lj-1083-missing-tostring-coercion-in-select.test.lua
>
> diff --git a/src/lj_record.c b/src/lj_record.c
> index 96fe26d8..311d9fe7 100644
> --- a/src/lj_record.c
> +++ b/src/lj_record.c
> @@ -1871,8 +1871,11 @@ static void rec_varg(jit_State *J, BCReg dst, ptrdiff_t nresults)
>         TRef tr = TREF_NIL;
>         ptrdiff_t idx = lj_ffrecord_select_mode(J, tridx, &J->L->base[dst-1]);
>         if (idx < 0) goto nyivarg;
> -      if (idx != 0 && !tref_isinteger(tridx))
> +      if (idx != 0 && !tref_isinteger(tridx)) {
> +	if (tref_isstr(tridx))
> +	  tridx = emitir(IRTG(IR_STRTO, IRT_NUM), tridx, 0);
>   	tridx = emitir(IRTGI(IR_CONV), tridx, IRCONV_INT_NUM|IRCONV_INDEX);
> +      }
>         if (idx != 0 && tref_isk(tridx)) {
>   	emitir(IRTGI(idx <= nvararg ? IR_GE : IR_LT),
>   	       fr, lj_ir_kint(J, frofs+8*(int32_t)idx));
> diff --git a/test/tarantool-tests/lj-1083-missing-tostring-coercion-in-select.test.lua b/test/tarantool-tests/lj-1083-missing-tostring-coercion-in-select.test.lua
> new file mode 100644
> index 00000000..8089247f
> --- /dev/null
> +++ b/test/tarantool-tests/lj-1083-missing-tostring-coercion-in-select.test.lua
> @@ -0,0 +1,39 @@
> +local tap = require('tap')
> +
> +-- Test file to demonstrate LuaJIT incorrect recording of
> +-- `select()` fast function.
> +-- See also:https://github.com/LuaJIT/LuaJIT/issues/1083.
> +
> +local test = tap.test('lj-1083-missing-tostring-coercion-in-select'):skipcond({
> +  ['Test requires JIT enabled'] = not jit.status(),
> +})
> +
> +test:plan(1)
> +
> +-- Simplify the `jit.dump()` output.
> +local select = select
> +
> +local function test_select(...)
> +  local result
> +  for _ = 1, 4 do
> +    -- Before the patch, with the missed coercion to string, the
> +    -- recording of `select()` below leads to the following IR:
> +    -- | rcx   >  int CONV   "1"   int.num index
> +    -- Where the operand has string type instead of number type.
> +    -- This leads to the corresponding mcode:
> +    -- | cvttsd2si ecx, xmm1
> +    -- Where xmm1 has an undefined value. Thus leads to the
> +    -- incorrect result for the call below.
> +    result = select('1', ...)
> +  end
> +  return result
> +end
> +
> +jit.opt.start('hotloop=1')
> +
> +-- XXX: amount of arguments is empirical, see the comment above.
> +local result = test_select(1, 2, 3, 4)
> +
> +test:is(result, 1, 'corect select result after recording')

s/corect/correct/


> +
> +test:done(true)
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.tarantool.org/pipermail/tarantool-patches/attachments/20240924/0b0f0538/attachment.htm>