<HTML><BODY><div>Hi again!</div><div>I forgot to mention another important nit — the</div><div>Tarantool CI is incomplete, there are 20 runs missing.</div><div>I think you should trigger them again, just to make sure</div><div>everything is ok.</div><div data-signature-widget="container"><div data-signature-widget="content"><div>--<br>Best regards,</div><div>Maxim Kokryashkin</div></div></div><div> </div><div> </div><blockquote style="border-left:1px solid #0857A6; margin:10px; padding:0 0 0 10px;">Понедельник, 15 мая 2023, 13:30 +03:00 от Maxim Kokryashkin via Tarantool-patches <tarantool-patches@dev.tarantool.org>:<br> <div id=""><div class="js-helper js-readmsg-msg"><div><div id="style_16841466301581942697_BODY"><div class="cl_151017"><div>Hi, Sergey!</div><div>Thanks for the patch!</div><div>LGTM, except for several nits below.</div><div> </div><blockquote style="border-left:1px solid #0857A6;margin:10px;padding:0 0 0 10px;"><div> <blockquote style="border-left:1px solid #0857A6;margin:10px;padding:0 0 0 10px;"><div id=""><div class="js-helper_mr_css_attr js-readmsg-msg_mr_css_attr"><div><div id="style_16837544441997619215_BODY_mr_css_attr">From: Mike Pall <mike><br><br>(cherry picked from commit d4c0c6e17ef7edf1f2893bc807746b80612e63e9)<br><br>During loop unrolling IR instructions are coped, substituted and<br>re-emitted for the FOLD/CSE/etc. pipeline. Assume, we have the following<br>loop-carried dependency: we create a new table or load some stored one<br>depends on iteration number. In case when we copy the emitted ALOAD IR</div></div></div></div></blockquote><div>Typo: s/depends on iteration/depending on the iteration/</div><div>Typo: s/In case when/If/</div><blockquote style="border-left:1px solid #0857A6;margin:10px;padding:0 0 0 10px;"><div><div class="js-helper_mr_css_attr js-readmsg-msg_mr_css_attr"><div><div>instruction (from from the stored table), we copy it as is, including</div></div></div></div></blockquote><div>Typo: s/from from/from/</div><blockquote style="border-left:1px solid #0857A6;margin:10px;padding:0 0 0 10px;"><div><div class="js-helper_mr_css_attr js-readmsg-msg_mr_css_attr"><div><div>loading type. But the ALOAD from the new table created (on the previous</div></div></div></div></blockquote><div>Typo: s/loading/load/</div><blockquote style="border-left:1px solid #0857A6;margin:10px;padding:0 0 0 10px;"><div><div class="js-helper_mr_css_attr js-readmsg-msg_mr_css_attr"><div><div>iteration) should have nil type, so the assertion in `fwd_ahload()` is<br>failed.<br><br>This patch replaces the assertion to `return 0` to avoid the assertion</div></div></div></div></blockquote><div>Typo: s/assertion to/assertion with/</div><blockquote style="border-left:1px solid #0857A6;margin:10px;padding:0 0 0 10px;"><div><div class="js-helper_mr_css_attr js-readmsg-msg_mr_css_attr"><div><div>failure and stop forwarding in such situations.<br><br>But the emitted type-guarded ALOAD will lead to the persistent failure<br>of the assertion guard on the trace. Hence, another one fix should be</div></div></div></div></blockquote><div>Typo: s/another one/another/</div><blockquote style="border-left:1px solid #0857A6;margin:10px;padding:0 0 0 10px;"><div><div class="js-helper_mr_css_attr js-readmsg-msg_mr_css_attr"><div><div>added. Also, TDUP IR is affected, too.<br>See also the issue mentioned in the test.<br><br>Sergey Kaplun:<br>* added the description and the test for the problem<br><br>Part of tarantool/tarantool#8516<br>---<br><br>Branch: <a href="https://github.com/tarantool/luajit/tree/skaplun/lj-994-instable-types-during-loop-unroll" target="_blank">https://github.com/tarantool/luajit/tree/skaplun/lj-994-instable-types-during-loop-unroll</a><br>PR: <a href="https://github.com/tarantool/tarantool/pull/8642" target="_blank">https://github.com/tarantool/tarantool/pull/8642</a><br>Related issues:<br>* <a href="https://github.com/tarantool/tarantool/issues/8516" target="_blank">https://github.com/tarantool/tarantool/issues/8516</a><br>* <a href="https://github.com/LuaJIT/LuaJIT/issues/994" target="_blank">https://github.com/LuaJIT/LuaJIT/issues/994</a><br><br>I don't mention the 994 intentionally to avoid Mike bothering. Also, it<br>isn't the origin of this commit. Quite the opposite: as a result of this<br>backporting the following issue was created.<br><br>I prefer to backport the patches (this one and the prospective for 994)<br>separately. So, after this patch is backported, it doesn't add any<br>critical bugs (always failing guard just creates a new side trace), but<br>helps to avoid conflicts for future backporting (sadly remembered<br>"Improve assertions.").<br><br> src/lj_opt_mem.c | 3 +-<br> ...instable-types-during-loop-unroll.test.lua | 53 +++++++++++++++++++<br> 2 files changed, 55 insertions(+), 1 deletion(-)<br> create mode 100644 test/tarantool-tests/lj-994-instable-types-during-loop-unroll.test.lua<br><br>diff --git a/src/lj_opt_mem.c b/src/lj_opt_mem.c<br>index cc177d39..c8265b4f 100644<br>--- a/src/lj_opt_mem.c<br>+++ b/src/lj_opt_mem.c<br>@@ -180,7 +180,8 @@ static TRef fwd_ahload(jit_State *J, IRRef xref)<br> }<br> ref = store->prev;<br> }<br>- lua_assert(ir->o != IR_TNEW || irt_isnil(fins->t));<br>+ if (ir->o == IR_TNEW && !irt_isnil(fins->t))<br>+ return 0; /* Type instability in loop-carried dependency. */<br> if (irt_ispri(fins->t)) {<br> return TREF_PRI(irt_type(fins->t));<br> } else if (irt_isnum(fins->t) || (LJ_DUALNUM && irt_isint(fins->t)) ||<br>diff --git a/test/tarantool-tests/lj-994-instable-types-during-loop-unroll.test.lua b/test/tarantool-tests/lj-994-instable-types-during-loop-unroll.test.lua<br>new file mode 100644<br>index 00000000..435f6e0e<br>--- /dev/null<br>+++ b/test/tarantool-tests/lj-994-instable-types-during-loop-unroll.test.lua<br>@@ -0,0 +1,53 @@<br>+local tap = require('tap')<br>+<br>+local test = tap.test('lj-994-instable-types-during-loop-unroll'):skipcond({<br>+ ['Test requires JIT enabled'] = not jit.status(),<br>+})<br>+<br>+-- Test file to demonstrate LuaJIT misbehaviour during loop<br>+-- unrolling and load forwarding for newly created tables.<br>+-- See also <a href="https://github.com/LuaJIT/LuaJIT/issues/994" target="_blank">https://github.com/LuaJIT/LuaJIT/issues/994</a>.<br>+<br>+-- TODO: test that compiled traces don't always exit by the type<br>+-- guard. See also the comment for the TDUP test chunk.<br>+test:plan(1)<br>+<br>+-- TNEW.<br>+local result<br>+local stored_tab = {1}<br>+local slot = {}<br>+local key = 1<br>+<br>+jit.opt.start('hotloop=1')<br>+-- The trouble happens during loop unrolling when we copy<br>+-- `>+ num ALOAD` IR in the context of the table on the previous<br>+-- iteration instead of a new one created via TNEW containing no<br>+-- values (so type nil should be used instead of num).<br>+for _ = 1, 5 do<br>+ local t = slot<br>+ -- Use non-constant key to avoid LJ_TRERR_GFAIL and undoing the<br>+ -- loop.</div></div></div></div></blockquote><div>Typo: s/Use/Use a/</div><blockquote style="border-left:1px solid #0857A6;margin:10px;padding:0 0 0 10px;"><div><div class="js-helper_mr_css_attr js-readmsg-msg_mr_css_attr"><div><div>+ result = t[key]<br>+ -- Swap table loaded by SLOAD to the created via TNEW.<br>+ slot = _ % 2 ~= 0 and stored_tab or {}<br>+end<br>+test:is(result, nil, 'TNEW load forwarding was successful')</div></div></div></div></blockquote><div>Nit: not sure about that assertion. AFAICS, we want to check whether we</div><div>have failed on assertion and not the validity of `result` variable. Feel free</div><div>to ignore.</div><blockquote style="border-left:1px solid #0857A6;margin:10px;padding:0 0 0 10px;"><div><div class="js-helper_mr_css_attr js-readmsg-msg_mr_css_attr"><div><div>+<br>+-- TDUP.<br>+--[[<br>+-- FIXME: Disable test case for now. Enable, with another one</div></div></div></div></blockquote><div>Typo: s/another one/another/</div><blockquote style="border-left:1px solid #0857A6;margin:10px;padding:0 0 0 10px;"><div><div class="js-helper_mr_css_attr js-readmsg-msg_mr_css_attr"><div><div>+-- backported commit with a fix for the aforementioned issue<br>+-- (and after patch "Improve assertions.").<br>+-- Test taken trace exits too.<br>+for _ = 1, 5 do<br>+ local t = slot<br>+ -- Now use constant key slot to get necessary branch.<br>+ -- LJ_TRERR_GFAIL isn't triggered here.<br>+ -- See `fwd_ahload()` in <src/lj_opt_mem.c> for details.<br>+ result = t[1]<br>+ slot = _ % 2 ~= 0 and stored_tab or {true}<br>+end<br>+test:is(result, true, 'TDUP load forwarding was successful')<br>+]]</div></div></div></div></blockquote><div>Nit: Not sure if it is good to add this test here. Maybe it is better</div><div>to create a ticket in our repo and move that chunk there. Feel free</div><div>to ignore.</div><blockquote style="border-left:1px solid #0857A6;margin:10px;padding:0 0 0 10px;"><div><div class="js-helper_mr_css_attr js-readmsg-msg_mr_css_attr"><div><div>+<br>+os.exit(test:check() and 0 or 1)<br>--<br>2.34.1</div></div></div></div></blockquote><div><div>--<br>Best regards,</div><div>Maxim Kokryashkin</div></div><div> </div></div></blockquote></div></div></div></div></div></blockquote><div> </div></BODY></HTML>