<!DOCTYPE html>
<html data-lt-installed="true">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body style="padding-bottom: 1px;">
<p>LGTM, thanks!<br>
</p>
<div class="moz-cite-prefix">On 6/25/25 17:41, Sergey Kaplun wrote:<br>
</div>
<blockquote type="cite" cite="mid:aFwKpuXP0OrjVntB@root">
<pre wrap="" class="moz-quote-pre">Hi, Sergey!
Thanks for the review!
Please consider my answers below.
On 25.06.25, Sergey Bronnikov wrote:
</pre>
<blockquote type="cite">
<pre wrap="" class="moz-quote-pre">Hi, Sergey,
thanks for the patch! Please see my comments below.
Sergey
On 6/12/25 12:36, Sergey Kaplun wrote:
</pre>
<blockquote type="cite">
<pre wrap="" class="moz-quote-pre">From: Mike Pall <mike>
Reported by caohongqing.
Fix contributed by Peter Cawley.
(cherry picked from commit 8fbd576fb9414a5fa70dfa6069733d3416a78269)
`asm_hrefk()` uses the check for the offset for the corresponding node
structure. However, the target load is performed from its inner `key`
field with the offset 8. In the case of a huge table, it is possible
that the offset of the node (4095 * 8) is less than 4096 * 8 and can be
emitted via the corresponding instruction as an immediate offset, but
the offset of the `key` field is not. This leads to the corresponding
assertion failure in `emit_lso()`.
</pre>
</blockquote>
<pre wrap="" class="moz-quote-pre">
The issue [1] contains yet another fix in the same place [2]. We decided
to backport the patch
separately. But please mention this in commit message.
1. <a class="moz-txt-link-freetext" href="https://github.com/LuaJIT/LuaJIT/issues/1026">https://github.com/LuaJIT/LuaJIT/issues/1026</a>
2.
<a class="moz-txt-link-freetext" href="https://github.com/LuaJIT/LuaJIT/commit/93ce12ee15abf28ef4cb24ae7e4b8a5b73d75c85">https://github.com/LuaJIT/LuaJIT/commit/93ce12ee15abf28ef4cb24ae7e4b8a5b73d75c85</a>
</pre>
</blockquote>
<pre wrap="" class="moz-quote-pre">
These issues are completely independent, IMO. I would rather not mention
it. Otherwise, by this logic, we should mention every problem related to
the HREFK here.
</pre>
</blockquote>
ok<br>
<blockquote type="cite" cite="mid:aFwKpuXP0OrjVntB@root">
<pre wrap="" class="moz-quote-pre">
</pre>
<blockquote type="cite">
<blockquote type="cite">
<pre wrap="" class="moz-quote-pre">This patch fixes this behaviour by the correct check.
Sergey Kaplun:
* added the description and the test for the problem
Part of tarantool/tarantool#11278
---
Related issues:
*<a class="moz-txt-link-freetext" href="https://github.com/LuaJIT/LuaJIT/issues/1026">https://github.com/LuaJIT/LuaJIT/issues/1026</a>
*<a class="moz-txt-link-freetext" href="https://github.com/tarantool/tarantool/issues/11278">https://github.com/tarantool/tarantool/issues/11278</a>
<a class="moz-txt-link-freetext" href="Branch:https://github.com/tarantool/luajit/tree/skaplun/lj-1026-arm64-invalid-hrefk-offset-check">Branch:https://github.com/tarantool/luajit/tree/skaplun/lj-1026-arm64-invalid-hrefk-offset-check</a>
src/lj_asm_arm64.h | 2 +-
...-arm64-invalid-hrefk-offset-check.test.lua | 48 +++++++++++++++++++
2 files changed, 49 insertions(+), 1 deletion(-)
create mode 100644 test/tarantool-tests/lj-1026-arm64-invalid-hrefk-offset-check.test.lua
diff --git a/src/lj_asm_arm64.h b/src/lj_asm_arm64.h
index 6c7b011f..a7f059a2 100644
--- a/src/lj_asm_arm64.h
+++ b/src/lj_asm_arm64.h
@@ -885,7 +885,7 @@ static void asm_hrefk(ASMState *as, IRIns *ir)
</pre>
</blockquote>
</blockquote>
<pre wrap="" class="moz-quote-pre">
<snipped>
</pre>
<blockquote type="cite">
<blockquote type="cite">
<pre wrap="" class="moz-quote-pre">diff --git a/test/tarantool-tests/lj-1026-arm64-invalid-hrefk-offset-check.test.lua b/test/tarantool-tests/lj-1026-arm64-invalid-hrefk-offset-check.test.lua
new file mode 100644
index 00000000..de243814
--- /dev/null
+++ b/test/tarantool-tests/lj-1026-arm64-invalid-hrefk-offset-check.test.lua
@@ -0,0 +1,48 @@
+local tap = require('tap')
+
+-- Test file to demonstrate LuaJIT misbehaviour when assembling
+-- HREFK instruction on arm64 with the huge offset.
+-- See <a class="moz-txt-link-freetext" href="also:https://github.com/LuaJIT/LuaJIT/issues/1026">also:https://github.com/LuaJIT/LuaJIT/issues/1026</a>.
+local test = tap.test('lj-1026-arm64-invalid-hrefk-offset-check'):skipcond({
+ ['Test requires JIT enabled'] = not jit.status(),
</pre>
</blockquote>
<pre wrap="" class="moz-quote-pre">It is an ARM-specific patch, should we add a condition for ARM here?
</pre>
</blockquote>
<pre wrap="" class="moz-quote-pre">
It is a good question. It was once discussed, and we decided not to add
the skip condition to make other architectures more covered by tests too
(for example, we may check MIPS/PPC in the same test if we want to
support them).
</pre>
</blockquote>
Ok.<br>
<blockquote type="cite" cite="mid:aFwKpuXP0OrjVntB@root">
<pre wrap="" class="moz-quote-pre">
</pre>
<blockquote type="cite">
<blockquote type="cite">
<pre wrap="" class="moz-quote-pre">+})
+
+test:plan(1)
+
+-- The assertion fails since in HREFK we are checking the offset
+-- from the hslots of the table of the Node structure itself
</pre>
</blockquote>
<pre wrap="" class="moz-quote-pre">s/Node/`Node`/
</pre>
</blockquote>
<pre wrap="" class="moz-quote-pre">
Fixed. See the iterative patch below.
===================================================================
diff --git a/test/tarantool-tests/lj-1026-arm64-invalid-hrefk-offset-check.test.lua b/test/tarantool-tests/lj-1026-arm64-invalid-hrefk-offset-check.test.lua
index de243814..caa6291d 100644
--- a/test/tarantool-tests/lj-1026-arm64-invalid-hrefk-offset-check.test.lua
+++ b/test/tarantool-tests/lj-1026-arm64-invalid-hrefk-offset-check.test.lua
@@ -10,7 +10,7 @@ local test = tap.test('lj-1026-arm64-invalid-hrefk-offset-check'):skipcond({
<a class="moz-txt-link-freetext" href="test:plan(1)">test:plan(1)</a>
-- The assertion fails since in HREFK we are checking the offset
--- from the hslots of the table of the Node structure itself
+-- from the hslots of the table of the `Node` structure itself
-- instead of its inner field `key` (with additional 8 bytes).
-- So to test this, we generate a big table with constant keys
-- and compile a trace for each HREFK possible.
===================================================================
Branch is force-pushed.
</pre>
<blockquote type="cite">
<blockquote type="cite">
<pre wrap="" class="moz-quote-pre">+-- instead of its inner field `key` (with additional 8 bytes).
+-- So to test this, we generate a big table with constant keys
+-- and compile a trace for each HREFK possible.
+
+local big_tab = {}
+-- The map of the characters to generate constant string keys.
+-- The offset of the node should be 4096 * 8. It takes at least
+-- 1365 keys to hit this value. The maximum possible slots in the
+-- hash part is 2048, so to fill it with the maximum density (with
+-- the way below), we need 45 * 45 = 2025 keys.
+local chars = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRS'
+for c1 <a class="moz-txt-link-freetext" href="inchars:gmatch('.')">inchars:gmatch('.')</a> do
+ for c2 <a class="moz-txt-link-freetext" href="inchars:gmatch('.')">inchars:gmatch('.')</a> do
+ big_tab[c1 .. c2] = 1
+ end
+end
+
+jit.opt.start('hotloop=1')
+
+-- Generate bunch of traces.
+for c1 <a class="moz-txt-link-freetext" href="inchars:gmatch('.')">inchars:gmatch('.')</a> do
+ for c2 <a class="moz-txt-link-freetext" href="inchars:gmatch('.')">inchars:gmatch('.')</a> do
+ loadstring([=[
+ local t = ...
+ for i = 1, 4 do
+ -- HREFK generation.
+ t[ ']=] .. c1 .. c2 .. [=[' ] = i
+ end
+ ]=])(big_tab)
+ end
+end
+
+test:ok(true, 'no assertion failed')
</pre>
</blockquote>
<pre wrap="" class="moz-quote-pre">
I would replace testcase description to something like "emitted assembly
is correct".
Feel free to ignore.
</pre>
</blockquote>
<pre wrap="" class="moz-quote-pre">
It triggers the assertion in the first place, so ignoring.
</pre>
<blockquote type="cite">
<pre wrap="" class="moz-quote-pre">
</pre>
<blockquote type="cite">
<pre wrap="" class="moz-quote-pre">+
+test:done(true)
</pre>
</blockquote>
</blockquote>
<pre wrap="" class="moz-quote-pre">
</pre>
</blockquote>
</body>
<lt-container></lt-container>
</html>