<!DOCTYPE html>
<html data-lt-installed="true">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body style="padding-bottom: 1px;">
<p>Hi, Sergey,</p>
<p>thanks for the patch!</p>
<p>See minor comment below.</p>
<p>LGTM<br>
</p>
<p><br>
</p>
<div class="moz-cite-prefix">On 23.09.2024 14:28, Sergey Kaplun
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:20240923112852.26851-1-skaplun@tarantool.org">
<pre class="moz-quote-pre" wrap="">From: Mike Pall <mike>
Thanks to Peter Cawley.
(cherry picked from commit 92b89d005ab721a61bce6d471b052bcb236b81d7)
Before the patch, the recording of `select()` with a string argument
leads to the following IR:
| rcx > int CONV "1" int.num index
Where the operand has string type instead of number type.
This leads to the corresponding mcode:
| cvttsd2si ecx, xmm1
Where xmm1 has an undefined value. Thus leads to the undefined behaviour
for the recording trace.
This patch adds the missing coercion.
Sergey Kaplun:
* added the description and the test for the problem
Part of tarantool/tarantool#10199
---
Branch: <a class="moz-txt-link-freetext" href="https://github.com/tarantool/luajit/tree/skaplun/lj-1083-missing-tostring-coercion-in-select">https://github.com/tarantool/luajit/tree/skaplun/lj-1083-missing-tostring-coercion-in-select</a>
Related issues:
* <a class="moz-txt-link-freetext" href="https://github.com/tarantool/tarantool/issues/10199">https://github.com/tarantool/tarantool/issues/10199</a>
* <a class="moz-txt-link-freetext" href="https://github.com/LuaJIT/LuaJIT/issues/1083">https://github.com/LuaJIT/LuaJIT/issues/1083</a>
src/lj_record.c | 5 ++-
...ssing-tostring-coercion-in-select.test.lua | 39 +++++++++++++++++++
2 files changed, 43 insertions(+), 1 deletion(-)
create mode 100644 test/tarantool-tests/lj-1083-missing-tostring-coercion-in-select.test.lua
diff --git a/src/lj_record.c b/src/lj_record.c
index 96fe26d8..311d9fe7 100644
--- a/src/lj_record.c
+++ b/src/lj_record.c
@@ -1871,8 +1871,11 @@ static void rec_varg(jit_State *J, BCReg dst, ptrdiff_t nresults)
TRef tr = TREF_NIL;
ptrdiff_t idx = lj_ffrecord_select_mode(J, tridx, &J->L->base[dst-1]);
if (idx < 0) goto nyivarg;
- if (idx != 0 && !tref_isinteger(tridx))
+ if (idx != 0 && !tref_isinteger(tridx)) {
+ if (tref_isstr(tridx))
+ tridx = emitir(IRTG(IR_STRTO, IRT_NUM), tridx, 0);
tridx = emitir(IRTGI(IR_CONV), tridx, IRCONV_INT_NUM|IRCONV_INDEX);
+ }
if (idx != 0 && tref_isk(tridx)) {
emitir(IRTGI(idx <= nvararg ? IR_GE : IR_LT),
fr, lj_ir_kint(J, frofs+8*(int32_t)idx));
diff --git a/test/tarantool-tests/lj-1083-missing-tostring-coercion-in-select.test.lua b/test/tarantool-tests/lj-1083-missing-tostring-coercion-in-select.test.lua
new file mode 100644
index 00000000..8089247f
--- /dev/null
+++ b/test/tarantool-tests/lj-1083-missing-tostring-coercion-in-select.test.lua
@@ -0,0 +1,39 @@
+local tap = require('tap')
+
+-- Test file to demonstrate LuaJIT incorrect recording of
+-- `select()` fast function.
+-- See also: <a class="moz-txt-link-freetext" href="https://github.com/LuaJIT/LuaJIT/issues/1083">https://github.com/LuaJIT/LuaJIT/issues/1083</a>.
+
+local test = tap.test('lj-1083-missing-tostring-coercion-in-select'):skipcond({
+ ['Test requires JIT enabled'] = not jit.status(),
+})
+
+test:plan(1)
+
+-- Simplify the `jit.dump()` output.
+local select = select
+
+local function test_select(...)
+ local result
+ for _ = 1, 4 do
+ -- Before the patch, with the missed coercion to string, the
+ -- recording of `select()` below leads to the following IR:
+ -- | rcx > int CONV "1" int.num index
+ -- Where the operand has string type instead of number type.
+ -- This leads to the corresponding mcode:
+ -- | cvttsd2si ecx, xmm1
+ -- Where xmm1 has an undefined value. Thus leads to the
+ -- incorrect result for the call below.
+ result = select('1', ...)</pre>
</blockquote>
<blockquote type="cite"
cite="mid:20240923112852.26851-1-skaplun@tarantool.org">
<pre class="moz-quote-pre" wrap="">
+ end
+ return result
+end
+
+jit.opt.start('hotloop=1')
+
+-- XXX: amount of arguments is empirical, see the comment above.
+local result = test_select(1, 2, 3, 4)
+
+test:is(result, 1, 'corect select result after recording')</pre>
</blockquote>
<p>s/corect/correct/</p>
<p><br>
</p>
<blockquote type="cite"
cite="mid:20240923112852.26851-1-skaplun@tarantool.org">
<pre class="moz-quote-pre" wrap="">
+
+test:done(true)
</pre>
</blockquote>
</body>
<lt-container></lt-container>
</html>