<HTML><BODY><div>Hi, Sergey!</div><div>Thanks for the fixes!</div><div>LGTM</div><div> </div><blockquote style="border-left:1px solid #0857A6; margin:10px; padding:0 0 0 10px;"><div> <blockquote style="border-left:1px solid #0857A6; margin:10px; padding:0 0 0 10px;"><div id=""><div class="js-helper js-readmsg-msg"><div><div id="style_16747169861188406182_BODY">Hi, Maxim!<br><br>Thanks for the review!<br><br>On 24.01.23, Maxim Kokryashkin wrote:<br>><br>> Hi, Sergey!<br>> Thanks for the patch!<br>> Please consider my comments below.<br>> <br>> > <br>> >>From: Mike Pall <mike><br>> >><br>> >>(cherry picked from commit 522d2073da4be2af79db4728cbb375db0fbdfc48)<br>> >><br>> >>`asm_intarith()` function may try to drop `test r, r` instruction before<br>> >Please note that "r" is an allocated register for the instruction.<br>> >>the Jcc instruction. However, in case when Jcc instruction is "Jump<br>> >Typo: s/in case when/in cases where/<br><br>Fixed.<br><br>> >>short if ..." instruction (i.e. has no 0F opcode prefix like "Jump near<br>> >>if ..."), the `test` instruction is dropped when shouldn't be, due to<br>> >Typo: s/when/when it/<br>> >>memory miss. As the result, the loop can't be realigned later in<br>> >Typo: s/memory/a memory/<br>> >Also, that part about the memory miss is unclear, it would be better if you<br>> >could clarify it a bit.<br>> >>`asm_loop_fixup` due to target to jump isn't aligned and the assertion<br>> >Typo: s/isn’t aligned/being misaligned/<br><br>Fixed.<br><br>> >>fails.<br>> >><br>> >>This patch adds the additional check for 0F opcode in `asm_intarith()`.<br>> >Typo: s/for 0F/for the 0F/<br><br>Fixed, thanks!<br><br>> >><br>> >>Sergey Kaplun:<br>> >>* added the description and the test for the problem<br>> >><br>> >>Part of tarantool/tarantool#8069<br><br>The new commit message is the following:<br><br>| x86/x64: Fix loop realignment.<br>|<br>| (cherry picked from commit 522d2073da4be2af79db4728cbb375db0fbdfc48)<br>|<br>| `asm_intarith()` function may try to drop `test r, r` (where `r` is an<br>| allocated register) instruction before the Jcc instruction. However, in<br>| cases when Jcc instruction is "Jump short if ..." instruction (i.e. has<br>| no 0F opcode prefix like "Jump near if ..."), the `test` instruction is<br>| dropped when it shouldn't be, due to usage for the comparison the next<br>| byte after instruction itself. As the result, the loop can't be<br>| realigned later in `asm_loop_fixup` due to target to jump being<br>| misaligned and the assertion fails.<br>|<br>| This patch adds the additional check for the 0F opcode in<br>| `asm_intarith()`.<br>|<br>| Sergey Kaplun:<br>| * added the description and the test for the problem<br>|<br>| Part of tarantool/tarantool#8069<br><br>Branch is force pushed.<br><br>> >>---<br>> >> src/lj_asm_x86.h | 5 +++--<br>> >> .../lj-556-fix-loop-realignment.test.lua | 18 ++++++++++++++++++<br>> >> 2 files changed, 21 insertions(+), 2 deletions(-)<br>> >> create mode 100644 test/tarantool-tests/lj-556-fix-loop-realignment.test.lua<br>> >><br>> >>diff --git a/src/lj_asm_x86.h b/src/lj_asm_x86.h<br>> >>index 8efda8e5..e6c42c6d 100644<br>> >>--- a/src/lj_asm_x86.h<br>> >>+++ b/src/lj_asm_x86.h<br>> >>@@ -2068,8 +2068,9 @@ static void asm_intarith(ASMState *as, IRIns *ir, x86Arith xa)<br>> >> int32_t k = 0;<br>> >> if (as->flagmcp == as->mcp) { /* Drop test r,r instruction. */<br>> >> MCode *p = as->mcp + ((LJ_64 && *as->mcp < XI_TESTb) ? 3 : 2);<br>> >>- if ((p[1] & 15) < 14) {<br>> >>- if ((p[1] & 15) >= 12) p[1] -= 4; /* L <->S, NL <-> NS */<br>> >>+ MCode *q = p[0] == 0x0f ? p+1 : p;<br>> >>+ if ((*q & 15) < 14) {<br>> >>+ if ((*q & 15) >= 12) *q -= 4; /* L <->S, NL <-> NS */<br>> >> as->flagmcp = NULL;<br>> >> as->mcp = p;<br>> >> } /* else: cannot transform LE/NLE to cc without use of OF. */<br>> >>diff --git a/test/tarantool-tests/lj-556-fix-loop-realignment.test.lua b/test/tarantool-tests/lj-556-fix-loop-realignment.test.lua<br>> >>new file mode 100644<br>> >>index 00000000..9a8e6098<br>> >>--- /dev/null<br>> >>+++ b/test/tarantool-tests/lj-556-fix-loop-realignment.test.lua<br>> >>@@ -0,0 +1,18 @@<br>> >>+local tap = require('tap')<br>> >>+<br>> >>+local test = tap.test('lj-505-fold-icorrect-behavior')<br>> >>+test:plan(1)<br>> >>+<br>> >>+-- Test file to demonstrate JIT misbehaviour for loop realignment<br>> >>+-- in LUAJIT_NUMMODE=2. See also<br>> >>+-- <a href="https://github.com/LuaJIT/LuaJIT/issues/556" target="_blank">https://github.com/LuaJIT/LuaJIT/issues/556</a> .<br>> >>+<br>> >>+jit.opt.start('hotloop=1')<br>> >>+<br>> >>+local s = 4<br>> >>+while s > 0 do<br>> >>+ s = s - 1<br>> >>+end<br>> >>+<br>> >>+test:ok(true, 'loop is compiled and ran successfully')<br>> >>+os.exit(test:check() and 0 or 1)<br>> >>--<br>> >The test works just fine with HEAD on <br>> >f7d61d96 ci: introduce workflow for exotic builds.<br>> > <br>> >Tested configurations: <br>> >LJ_64: True, LJ_GC64: True, LJ_DUALNUM: True<br>> >LJ_64: True, LJ_GC64: False, LJ_DUALNUM: True<br><br>It's strange...<br>I use the following build command:<br>| $ cmake . -DCMAKE_BUILD_TYPE=Debug -DLUA_USE_APICHECK=ON -DLUA_USE_ASSERT=ON -DLUAJIT_ENABLE_GC64=OFF -DLUAJIT_NUMMODE=2 && make -j<br>and get the following assertion:<br>| asm_loop_fixup: Assertion `((intptr_t)target & 15) == 0' failed.<br>What command do you use to build LuaJIT?</div></div></div></div></blockquote><div>PEBKAC, I forgot to add the LUA_USE_ASSERT flag.</div><blockquote style="border-left:1px solid #0857A6; margin:10px; padding:0 0 0 10px;"><div><div class="js-helper js-readmsg-msg"><div><div>> >--<br>> >Best regards,<br>> >Maxim Kokryashkin<br>> > <br><br>--<br>Best regards,<br>Sergey Kaplun</div></div></div></div></blockquote><div><div>--<br>Best regards,</div><div>Maxim Kokryashkin</div></div><div> </div></div></blockquote></BODY></HTML>