<!DOCTYPE html>
<html data-lt-installed="true">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body style="padding-bottom: 1px;">
<p>Hi, Sergey!</p>
<p>thanks for the fix! Bug is reproduced without fix (I've used
incorrect C flag).</p>
<p>LGTM</p>
<p>Sergey</p>
<div class="moz-cite-prefix">On 3/4/26 13:34, Sergey Kaplun wrote:<br>
</div>
<blockquote type="cite" cite="mid:aagKxk_4a5fXmrsR@root">
<pre wrap="" class="moz-quote-pre">Hi, Sergey!
Thanks for the review!
See my answers below.
On 04.03.26, Sergey Bronnikov wrote:
</pre>
<blockquote type="cite">
<pre wrap="" class="moz-quote-pre">Hi, Sergey,
thanks for the patch! See my comments.
Sergey
On 3/2/26 10:52, Sergey Kaplun wrote:
</pre>
<blockquote type="cite">
<pre wrap="" class="moz-quote-pre">From: Mike Pall <mike>
Reported by Sergey Kaplun.
(cherry picked from commit b1cd2f83b5d085bb71368b87c91a461be77d4364)
`lj_opt_narrow_unm()` in the DUALNUM mode narrows doubles too
optimistic, missing 0 check. In that case, the narrowing of 0 is
incorrect. This leads to the assertion failure in `rec_check_slots()`
for the string obtained from the corresponding number.
This patch fixes it by restricting the check of the given TValue.
Sergey Kaplun:
* added the description and the test for the problem
Part of tarantool/tarantool#12134
---
src/lj_opt_narrow.c | 4 +-
...lj-1418-dualnum-narrowing-minus-0.test.lua | 49 +++++++++++++++++++
2 files changed, 51 insertions(+), 2 deletions(-)
create mode 100644 test/tarantool-tests/lj-1418-dualnum-narrowing-minus-0.test.lua
diff --git a/src/lj_opt_narrow.c b/src/lj_opt_narrow.c
index 6b6f20d3..6e3e9533 100644
--- a/src/lj_opt_narrow.c
+++ b/src/lj_opt_narrow.c
@@ -553,9 +553,9 @@ TRef lj_opt_narrow_unm(jit_State *J, TRef rc, TValue *vc)
rc = conv_str_tonum(J, rc, vc);
if (tref_isinteger(rc)) {
uint32_t k = (uint32_t)numberVint(vc);
- if ((LJ_DUALNUM || k != 0) && k != 0x80000000u) {
+ if ((tvisint(vc) || k != 0) && k != 0x80000000u) {
TRef zero = lj_ir_kint(J, 0);
- if (!LJ_DUALNUM)
+ if (!tvisint(vc))
emitir(IRTGI(IR_NE), rc, zero);
return emitir(IRTGI(IR_SUBOV), zero, rc);
}
diff --git a/test/tarantool-tests/lj-1418-dualnum-narrowing-minus-0.test.lua b/test/tarantool-tests/lj-1418-dualnum-narrowing-minus-0.test.lua
new file mode 100644
index 00000000..84f17953
--- /dev/null
+++ b/test/tarantool-tests/lj-1418-dualnum-narrowing-minus-0.test.lua
@@ -0,0 +1,49 @@
+local tap = require('tap')
+
+-- This test demonstrates LuaJIT's incorrect narrowing
+-- optimization in the DUALNUM mode for 0.
+-- See <a class="moz-txt-link-freetext" href="alsohttps://github.com/LuaJIT/LuaJIT/issues/1418">alsohttps://github.com/LuaJIT/LuaJIT/issues/1418</a>.
+
+local test = tap.test('lj-1418-dualnum-narrowing-minus-0'):skipcond({
+ ['Test requires JIT enabled'] = not jit.status(),
+})
+
</pre>
</blockquote>
<pre wrap="" class="moz-quote-pre">
cannot reproduce an original bug with reverted fix.
CMake configuration: CFLAGS=-DDUALNUM cmake -S . -B build
-DCMAKE_BUILD_TYPE=Debug
</pre>
</blockquote>
<pre wrap="" class="moz-quote-pre">
LuaJIT should be configured like:
| cmake -DLUAJIT_NUMMODE=2 # ...
<snipped>
</pre>
<blockquote type="cite">
<blockquote type="cite">
<pre wrap="" class="moz-quote-pre">+-- Reset hotcounts.
+jit.opt.start('hotloop=1')
+
+-- Hot trace.
+test_non_const_on_trace(2, 3)
+-- Record trace, use non zero result value to record.
</pre>
</blockquote>
<pre wrap="" class="moz-quote-pre">s/non zero/non-zero/
</pre>
</blockquote>
<pre wrap="" class="moz-quote-pre">
Fixed, branch is force-pushed:
===================================================================
diff --git a/test/tarantool-tests/lj-1418-dualnum-narrowing-minus-0.test.lua b/test/tarantool-tests/lj-1418-dualnum-narrowing-minus-0.test.lua
index 84f17953..8f4185ef 100644
--- a/test/tarantool-tests/lj-1418-dualnum-narrowing-minus-0.test.lua
+++ b/test/tarantool-tests/lj-1418-dualnum-narrowing-minus-0.test.lua
@@ -41,7 +41,7 @@ jit.opt.start('hotloop=1')
-- Hot trace.
test_non_const_on_trace(2, 3)
--- Record trace, use non zero result value to record.
+-- Record trace, use non-zero result value to record.
test_non_const_on_trace(2, 3)
-- Misbehaviour on trace with result zero value.
<a class="moz-txt-link-freetext" href="test:is(test_non_const_on_trace(2">test:is(test_non_const_on_trace(2</a>, 1), '-0', 'correct non-const value on trace')
===================================================================
</pre>
<blockquote type="cite">
<blockquote type="cite">
<pre wrap="" class="moz-quote-pre">+test_non_const_on_trace(2, 3)
+-- Misbehaviour on trace with result zero value.
+test:is(test_non_const_on_trace(2, 1), '-0', 'correct non-const value on trace')
+
+test:done(true)
</pre>
</blockquote>
</blockquote>
<pre wrap="" class="moz-quote-pre">
</pre>
</blockquote>
</body>
<lt-container></lt-container>
</html>