* [Tarantool-patches] [PATCH luajit] DUALNUM: Add missing type conversion for FORI slots.
@ 2026-03-02 8:14 Sergey Kaplun via Tarantool-patches
2026-03-04 15:14 ` Sergey Bronnikov via Tarantool-patches
0 siblings, 1 reply; 2+ messages in thread
From: Sergey Kaplun via Tarantool-patches @ 2026-03-02 8:14 UTC (permalink / raw)
To: Sergey Bronnikov; +Cc: tarantool-patches
From: Mike Pall <mike>
Reported by Sergey Kaplun.
(cherry picked from commit 406cf69b3ae0a3ecd5ede2bb97b937b7a5d92074)
`rec_for_loop()` narrows the FORL index values by getting them from the
runtime. In case when the `start`, `stop`, `step` control variables are
already loaded to the slots, their TRef isn't converted to the
corresponding type. This leads to the following inconsistent IR dump and
to the assertion failure later:
| 0002 > int SLOAD 10 TCI
| 0003 int ADD 0002 +1.
| 0004 > int LE 0003 +1.
| 0005 int ADD 0003 +1.
| 0006 > int GT 0005 +1.
This patch adds the missing type conversion.
Sergey Kaplun:
* added the description and the test for the problem
Part of tarantool/tarantool#12134
---
Branch: https://github.com/tarantool/luajit/tree/skaplun/lj-1413-missing-conv-fori
Related issues:
* https://github.com/LuaJIT/LuaJIT/issues/1413
* https://github.com/tarantool/tarantool/issues/12134
src/lj_record.c | 25 +++++++----
.../lj-1413-missing-conv-fori.test.lua | 43 +++++++++++++++++++
2 files changed, 60 insertions(+), 8 deletions(-)
create mode 100644 test/tarantool-tests/lj-1413-missing-conv-fori.test.lua
diff --git a/src/lj_record.c b/src/lj_record.c
index ba409a61..abb6334a 100644
--- a/src/lj_record.c
+++ b/src/lj_record.c
@@ -365,12 +365,27 @@ static TRef fori_load(jit_State *J, BCReg slot, IRType t, int mode)
mode + conv);
}
+/* Convert FORI argument to expected target type. */
+static TRef fori_conv(jit_State *J, TRef tr, IRType t)
+{
+ if (t == IRT_INT) {
+ if (!tref_isinteger(tr))
+ return emitir(IRTGI(IR_CONV), tr, IRCONV_INT_NUM|IRCONV_CHECK);
+ } else {
+ if (!tref_isnum(tr))
+ return emitir(IRTN(IR_CONV), tr, IRCONV_NUM_INT);
+ }
+ return tr;
+}
+
/* Peek before FORI to find a const initializer. Otherwise load from slot. */
static TRef fori_arg(jit_State *J, const BCIns *fori, BCReg slot,
IRType t, int mode)
{
TRef tr = J->base[slot];
- if (!tr) {
+ if (tr) {
+ tr = fori_conv(J, tr, t);
+ } else {
tr = find_kinit(J, fori, slot, t);
if (!tr)
tr = fori_load(J, slot, t, mode);
@@ -517,13 +532,7 @@ static LoopEvent rec_for(jit_State *J, const BCIns *fori, int isforl)
lj_assertJ(tref_isnumber_str(tr[i]), "bad FORI argument type");
if (tref_isstr(tr[i]))
tr[i] = emitir(IRTG(IR_STRTO, IRT_NUM), tr[i], 0);
- if (t == IRT_INT) {
- if (!tref_isinteger(tr[i]))
- tr[i] = emitir(IRTGI(IR_CONV), tr[i], IRCONV_INT_NUM|IRCONV_CHECK);
- } else {
- if (!tref_isnum(tr[i]))
- tr[i] = emitir(IRTN(IR_CONV), tr[i], IRCONV_NUM_INT);
- }
+ tr[i] = fori_conv(J, tr[i], t);
}
tr[FORL_EXT] = tr[FORL_IDX];
stop = tr[FORL_STOP];
diff --git a/test/tarantool-tests/lj-1413-missing-conv-fori.test.lua b/test/tarantool-tests/lj-1413-missing-conv-fori.test.lua
new file mode 100644
index 00000000..ba1fa74a
--- /dev/null
+++ b/test/tarantool-tests/lj-1413-missing-conv-fori.test.lua
@@ -0,0 +1,43 @@
+local tap = require('tap')
+
+-- Test file to demonstrate LuaJIT incorrect recording of FORI
+-- bytecode in the DUALNUM mode.
+-- See also: https://github.com/LuaJIT/LuaJIT/issues/1413.
+
+local test = tap.test('lj-1413-missing-conv-fori'):skipcond({
+ ['Test requires JIT enabled'] = not jit.status(),
+})
+
+test:plan(1)
+
+local function always_number(val)
+ -- Trace 3 starts as a side trace for the first one.
+ return tonumber(val) or 1
+end
+
+jit.opt.start('hotloop=1', 'hotexit=1')
+
+-- Compile the root trace with stitching.
+always_number()
+always_number('')
+
+-- An additional loop to evidentiate the issue for x86 arch in the
+-- DUALNUM mode.
+for _ = 1, 2 do
+ -- Use '%' to force number slots.
+ for i = always_number(9 % 1), 1 do
+ -- The resulting IR for the trace 4 is the following:
+ -- | 0002 > int SLOAD 10 TCI
+ -- | 0003 int ADD 0002 +1.
+ -- | 0004 > int LE 0003 +1.
+ -- | 0005 int ADD 0003 +1.
+ -- | 0006 > int GT 0005 +1.
+ --
+ -- The problem is within the type mismatch between the result
+ -- type and the right operand in the IRs.
+ for _ = '9' % i, always_number('') do end -- Trace 4.
+ end
+end
+
+test:ok(true, 'no assertion failure')
+test:done(true)
--
2.53.0
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: [Tarantool-patches] [PATCH luajit] DUALNUM: Add missing type conversion for FORI slots.
2026-03-02 8:14 [Tarantool-patches] [PATCH luajit] DUALNUM: Add missing type conversion for FORI slots Sergey Kaplun via Tarantool-patches
@ 2026-03-04 15:14 ` Sergey Bronnikov via Tarantool-patches
0 siblings, 0 replies; 2+ messages in thread
From: Sergey Bronnikov via Tarantool-patches @ 2026-03-04 15:14 UTC (permalink / raw)
To: Sergey Kaplun; +Cc: tarantool-patches
[-- Attachment #1: Type: text/plain, Size: 4751 bytes --]
Hi, Sergey,
thanks for the patch!
The bug cannot be reproduced with reverted fix.
CMake: cmake -S . -B build -DCMAKE_BUILD_TYPE=Debug -DLUAJIT_NUMMODE=2
Sergey
On 3/2/26 11:14, Sergey Kaplun wrote:
> From: Mike Pall <mike>
>
> Reported by Sergey Kaplun.
>
> (cherry picked from commit 406cf69b3ae0a3ecd5ede2bb97b937b7a5d92074)
>
> `rec_for_loop()` narrows the FORL index values by getting them from the
> runtime. In case when the `start`, `stop`, `step` control variables are
> already loaded to the slots, their TRef isn't converted to the
> corresponding type. This leads to the following inconsistent IR dump and
> to the assertion failure later:
> | 0002 > int SLOAD 10 TCI
> | 0003 int ADD 0002 +1.
> | 0004 > int LE 0003 +1.
> | 0005 int ADD 0003 +1.
> | 0006 > int GT 0005 +1.
>
> This patch adds the missing type conversion.
>
> Sergey Kaplun:
> * added the description and the test for the problem
>
> Part of tarantool/tarantool#12134
> ---
>
> Branch:https://github.com/tarantool/luajit/tree/skaplun/lj-1413-missing-conv-fori
> Related issues:
> *https://github.com/LuaJIT/LuaJIT/issues/1413
> *https://github.com/tarantool/tarantool/issues/12134
>
> src/lj_record.c | 25 +++++++----
> .../lj-1413-missing-conv-fori.test.lua | 43 +++++++++++++++++++
> 2 files changed, 60 insertions(+), 8 deletions(-)
> create mode 100644 test/tarantool-tests/lj-1413-missing-conv-fori.test.lua
>
> diff --git a/src/lj_record.c b/src/lj_record.c
> index ba409a61..abb6334a 100644
> --- a/src/lj_record.c
> +++ b/src/lj_record.c
> @@ -365,12 +365,27 @@ static TRef fori_load(jit_State *J, BCReg slot, IRType t, int mode)
> mode + conv);
> }
>
> +/* Convert FORI argument to expected target type. */
> +static TRef fori_conv(jit_State *J, TRef tr, IRType t)
> +{
> + if (t == IRT_INT) {
> + if (!tref_isinteger(tr))
> + return emitir(IRTGI(IR_CONV), tr, IRCONV_INT_NUM|IRCONV_CHECK);
> + } else {
> + if (!tref_isnum(tr))
> + return emitir(IRTN(IR_CONV), tr, IRCONV_NUM_INT);
> + }
> + return tr;
> +}
> +
> /* Peek before FORI to find a const initializer. Otherwise load from slot. */
> static TRef fori_arg(jit_State *J, const BCIns *fori, BCReg slot,
> IRType t, int mode)
> {
> TRef tr = J->base[slot];
> - if (!tr) {
> + if (tr) {
> + tr = fori_conv(J, tr, t);
> + } else {
> tr = find_kinit(J, fori, slot, t);
> if (!tr)
> tr = fori_load(J, slot, t, mode);
> @@ -517,13 +532,7 @@ static LoopEvent rec_for(jit_State *J, const BCIns *fori, int isforl)
> lj_assertJ(tref_isnumber_str(tr[i]), "bad FORI argument type");
> if (tref_isstr(tr[i]))
> tr[i] = emitir(IRTG(IR_STRTO, IRT_NUM), tr[i], 0);
> - if (t == IRT_INT) {
> - if (!tref_isinteger(tr[i]))
> - tr[i] = emitir(IRTGI(IR_CONV), tr[i], IRCONV_INT_NUM|IRCONV_CHECK);
> - } else {
> - if (!tref_isnum(tr[i]))
> - tr[i] = emitir(IRTN(IR_CONV), tr[i], IRCONV_NUM_INT);
> - }
> + tr[i] = fori_conv(J, tr[i], t);
> }
> tr[FORL_EXT] = tr[FORL_IDX];
> stop = tr[FORL_STOP];
> diff --git a/test/tarantool-tests/lj-1413-missing-conv-fori.test.lua b/test/tarantool-tests/lj-1413-missing-conv-fori.test.lua
> new file mode 100644
> index 00000000..ba1fa74a
> --- /dev/null
> +++ b/test/tarantool-tests/lj-1413-missing-conv-fori.test.lua
> @@ -0,0 +1,43 @@
> +local tap = require('tap')
> +
> +-- Test file to demonstrate LuaJIT incorrect recording of FORI
> +-- bytecode in the DUALNUM mode.
> +-- See also:https://github.com/LuaJIT/LuaJIT/issues/1413.
> +
> +local test = tap.test('lj-1413-missing-conv-fori'):skipcond({
> + ['Test requires JIT enabled'] = not jit.status(),
> +})
> +
> +test:plan(1)
> +
> +local function always_number(val)
> + -- Trace 3 starts as a side trace for the first one.
> + return tonumber(val) or 1
> +end
> +
> +jit.opt.start('hotloop=1', 'hotexit=1')
> +
> +-- Compile the root trace with stitching.
> +always_number()
> +always_number('')
> +
> +-- An additional loop to evidentiate the issue for x86 arch in the
> +-- DUALNUM mode.
> +for _ = 1, 2 do
> + -- Use '%' to force number slots.
> + for i = always_number(9 % 1), 1 do
> + -- The resulting IR for the trace 4 is the following:
> + -- | 0002 > int SLOAD 10 TCI
> + -- | 0003 int ADD 0002 +1.
> + -- | 0004 > int LE 0003 +1.
> + -- | 0005 int ADD 0003 +1.
> + -- | 0006 > int GT 0005 +1.
> + --
> + -- The problem is within the type mismatch between the result
> + -- type and the right operand in the IRs.
> + for _ = '9' % i, always_number('') do end -- Trace 4.
> + end
> +end
> +
> +test:ok(true, 'no assertion failure')
> +test:done(true)
[-- Attachment #2: Type: text/html, Size: 5407 bytes --]
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-03-04 15:14 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-03-02 8:14 [Tarantool-patches] [PATCH luajit] DUALNUM: Add missing type conversion for FORI slots Sergey Kaplun via Tarantool-patches
2026-03-04 15:14 ` Sergey Bronnikov via Tarantool-patches
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox