From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from [87.239.111.99] (localhost [127.0.0.1]) by dev.tarantool.org (Postfix) with ESMTP id DE3164F18AF; Wed, 4 Mar 2026 18:14:06 +0300 (MSK) DKIM-Filter: OpenDKIM Filter v2.11.0 dev.tarantool.org DE3164F18AF DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tarantool.org; s=dev; t=1772637247; bh=mFRKE3UkrYHYZg+E9hypGXnopUZZfWllsxdUk4EE+rE=; h=Date:To:Cc:References:In-Reply-To:Subject:List-Id: List-Unsubscribe:List-Archive:List-Post:List-Help:List-Subscribe: From:Reply-To:From; b=T1cz7sOm2n9tTO1KF8yCfg2nJA0FWDYdU1ugpVdxuzE6m1M1h95ap182zqEffyuHY dKBem3Timf7BQD18NsvRorcMcs30mo0qiFWmlGU2ZMuA5+x/l4K7Rt0LH359u+wcQM h3tWobMNBTzTJRsUepFZj7Rvf5qlysoirXuKB63I= Received: from send195.i.mail.ru (send195.i.mail.ru [95.163.59.34]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by dev.tarantool.org (Postfix) with ESMTPS id 035754F18AF for ; Wed, 4 Mar 2026 18:14:05 +0300 (MSK) DKIM-Filter: OpenDKIM Filter v2.11.0 dev.tarantool.org 035754F18AF Received: by exim-smtp-558f87dcd7-5s82b with esmtpa (envelope-from ) id 1vxnvI-00000000CGr-3lwP; Wed, 04 Mar 2026 18:14:05 +0300 Content-Type: multipart/alternative; boundary="------------Xah13E70C66pn5MSGsH3UNYk" Message-ID: <07642828-4ad9-4532-a195-b24afa22963f@tarantool.org> Date: Wed, 4 Mar 2026 18:14:04 +0300 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Content-Language: en-US To: Sergey Kaplun Cc: tarantool-patches@dev.tarantool.org References: <20260302081443.1058-1-skaplun@tarantool.org> In-Reply-To: <20260302081443.1058-1-skaplun@tarantool.org> X-Mailru-Src: smtp X-4EC0790: 10 X-7564579A: 78E4E2B564C1792B X-77F55803: 4F1203BC0FB41BD9406AA218EDC7AA27C797EE5BD42DD9ED81C7B95CE15F2629182A05F5380850400D77331908D9EF6A3DE06ABAFEAF67055D240C0101B49D0FD849A4024020CB0E3DE74FFC206C9863 X-7FA49CB5: FF5795518A3D127A4AD6D5ED66289B5278DA827A17800CE7DECE8D0A5E25C0FCEA1F7E6F0F101C67BD4B6F7A4D31EC0BCC500DACC3FED6E28638F802B75D45FF8AA50765F7900637AC83A81C8FD4AD23D82A6BABE6F325AC2E85FA5F3EDFCBAA7353EFBB55337566CF7C7957E47253288E81A9ADB25C98D46E6C6383201F3C989737209B7AB8B9D6389733CBF5DBD5E913377AFFFEAFD269176DF2183F8FC7C0A3E989B1926288338941B15DA834481FCF19DD082D7633A0EF3E4896CB9E6436389733CBF5DBD5E9D5E8D9A59859A8B652D31B9D28593E51CC7F00164DA146DA6F5DAA56C3B73B237318B6A418E8EAB8D32BA5DBAC0009BE9E8FC8737B5C2249373C3576551F00B976E601842F6C81A12EF20D2F80756B5FB606B96278B59C4276E601842F6C81A127C277FBC8AE2E8BFAEB00C13BDC9E8E3AA81AA40904B5D99C9F4D5AE37F343AD1F44FA8B9022EA23BBE47FD9DD3FB595F5C1EE8F4F765FC72CEEB2601E22B093A03B725D353964B0B7D0EA88DDEDAC722CA9DD8327EE4930A3850AC1BE2E735BA6625F88748EAEFC4224003CC83647689D4C264860C145E X-C1DE0DAB: 0D63561A33F958A5E7619267F23452185002B1117B3ED696A552120A8889ED4522DFD5397F446790823CB91A9FED034534781492E4B8EEAD9CFA8CFAC159CE19BDAD6C7F3747799A X-C8649E89: 1C3962B70DF3F0AD73CAD6646DEDE191716CD42B3DD1D34CAB70F9BE574AE9C625B6776AC983F447FC0B9F89525902EE6F57B2FD27647F25E66C117BDB76D65920D1A726F06C99EAE676D52960DA4640731BA9CBB7C43C97C6ECD6D2EF861E444A2DC20EE25F7420B8341EE9D5BE9A0ACFFE3A484946D36F099160B896B699A4E2DD11A36F8EF9C58CD93680B12512CF4C41F94D744909CE2512F26BEC029E55448553D2254B8D95CD72808BE417F3B9E0E7457915DAA85F X-D57D3AED: 3ZO7eAau8CL7WIMRKs4sN3D3tLDjz0dLbV79QFUyzQ2Ujvy7cMT6pYYqY16iZVKkSc3dCLJ7zSJH7+u4VD18S7Vl4ZUrpaVfd2+vE6kuoey4m4VkSEu53w8ahmwBjZKM/YPHZyZHvz5uv+WouB9+ObcCpyrx6l7KImUglyhkEat/+ysWwi0gdhEs0JGjl6ggRWTy1haxBpVdbIX1nthFXMZebaIdHP2ghjoIc/363UZI6Kf1ptIMVbwN8XFWZxQUj6xtms4/VC8= X-Mailru-Sender: C4F68CFF4024C8867DFDF7C7F25884589C8721AFF371B3AC81508210FEB0A3EAFBABD2EE551472DF52269A4B86A335F9645D15D82EE4B272BD6E4642A116CA93524AA66B5ACBE6721EF430B9A63E2A504198E0F3ECE9B5443453F38A29522196 X-Mras: Ok Subject: Re: [Tarantool-patches] [PATCH luajit] DUALNUM: Add missing type conversion for FORI slots. X-BeenThere: tarantool-patches@dev.tarantool.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Tarantool development patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , From: Sergey Bronnikov via Tarantool-patches Reply-To: Sergey Bronnikov Errors-To: tarantool-patches-bounces@dev.tarantool.org Sender: "Tarantool-patches" This is a multi-part message in MIME format. --------------Xah13E70C66pn5MSGsH3UNYk Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Hi, Sergey, thanks for the patch! The bug cannot be reproduced with reverted fix. CMake: cmake -S . -B build -DCMAKE_BUILD_TYPE=Debug -DLUAJIT_NUMMODE=2 Sergey On 3/2/26 11:14, Sergey Kaplun wrote: > From: Mike Pall > > Reported by Sergey Kaplun. > > (cherry picked from commit 406cf69b3ae0a3ecd5ede2bb97b937b7a5d92074) > > `rec_for_loop()` narrows the FORL index values by getting them from the > runtime. In case when the `start`, `stop`, `step` control variables are > already loaded to the slots, their TRef isn't converted to the > corresponding type. This leads to the following inconsistent IR dump and > to the assertion failure later: > | 0002 > int SLOAD 10 TCI > | 0003 int ADD 0002 +1. > | 0004 > int LE 0003 +1. > | 0005 int ADD 0003 +1. > | 0006 > int GT 0005 +1. > > This patch adds the missing type conversion. > > Sergey Kaplun: > * added the description and the test for the problem > > Part of tarantool/tarantool#12134 > --- > > Branch:https://github.com/tarantool/luajit/tree/skaplun/lj-1413-missing-conv-fori > Related issues: > *https://github.com/LuaJIT/LuaJIT/issues/1413 > *https://github.com/tarantool/tarantool/issues/12134 > > src/lj_record.c | 25 +++++++---- > .../lj-1413-missing-conv-fori.test.lua | 43 +++++++++++++++++++ > 2 files changed, 60 insertions(+), 8 deletions(-) > create mode 100644 test/tarantool-tests/lj-1413-missing-conv-fori.test.lua > > diff --git a/src/lj_record.c b/src/lj_record.c > index ba409a61..abb6334a 100644 > --- a/src/lj_record.c > +++ b/src/lj_record.c > @@ -365,12 +365,27 @@ static TRef fori_load(jit_State *J, BCReg slot, IRType t, int mode) > mode + conv); > } > > +/* Convert FORI argument to expected target type. */ > +static TRef fori_conv(jit_State *J, TRef tr, IRType t) > +{ > + if (t == IRT_INT) { > + if (!tref_isinteger(tr)) > + return emitir(IRTGI(IR_CONV), tr, IRCONV_INT_NUM|IRCONV_CHECK); > + } else { > + if (!tref_isnum(tr)) > + return emitir(IRTN(IR_CONV), tr, IRCONV_NUM_INT); > + } > + return tr; > +} > + > /* Peek before FORI to find a const initializer. Otherwise load from slot. */ > static TRef fori_arg(jit_State *J, const BCIns *fori, BCReg slot, > IRType t, int mode) > { > TRef tr = J->base[slot]; > - if (!tr) { > + if (tr) { > + tr = fori_conv(J, tr, t); > + } else { > tr = find_kinit(J, fori, slot, t); > if (!tr) > tr = fori_load(J, slot, t, mode); > @@ -517,13 +532,7 @@ static LoopEvent rec_for(jit_State *J, const BCIns *fori, int isforl) > lj_assertJ(tref_isnumber_str(tr[i]), "bad FORI argument type"); > if (tref_isstr(tr[i])) > tr[i] = emitir(IRTG(IR_STRTO, IRT_NUM), tr[i], 0); > - if (t == IRT_INT) { > - if (!tref_isinteger(tr[i])) > - tr[i] = emitir(IRTGI(IR_CONV), tr[i], IRCONV_INT_NUM|IRCONV_CHECK); > - } else { > - if (!tref_isnum(tr[i])) > - tr[i] = emitir(IRTN(IR_CONV), tr[i], IRCONV_NUM_INT); > - } > + tr[i] = fori_conv(J, tr[i], t); > } > tr[FORL_EXT] = tr[FORL_IDX]; > stop = tr[FORL_STOP]; > diff --git a/test/tarantool-tests/lj-1413-missing-conv-fori.test.lua b/test/tarantool-tests/lj-1413-missing-conv-fori.test.lua > new file mode 100644 > index 00000000..ba1fa74a > --- /dev/null > +++ b/test/tarantool-tests/lj-1413-missing-conv-fori.test.lua > @@ -0,0 +1,43 @@ > +local tap = require('tap') > + > +-- Test file to demonstrate LuaJIT incorrect recording of FORI > +-- bytecode in the DUALNUM mode. > +-- See also:https://github.com/LuaJIT/LuaJIT/issues/1413. > + > +local test = tap.test('lj-1413-missing-conv-fori'):skipcond({ > + ['Test requires JIT enabled'] = not jit.status(), > +}) > + > +test:plan(1) > + > +local function always_number(val) > + -- Trace 3 starts as a side trace for the first one. > + return tonumber(val) or 1 > +end > + > +jit.opt.start('hotloop=1', 'hotexit=1') > + > +-- Compile the root trace with stitching. > +always_number() > +always_number('') > + > +-- An additional loop to evidentiate the issue for x86 arch in the > +-- DUALNUM mode. > +for _ = 1, 2 do > + -- Use '%' to force number slots. > + for i = always_number(9 % 1), 1 do > + -- The resulting IR for the trace 4 is the following: > + -- | 0002 > int SLOAD 10 TCI > + -- | 0003 int ADD 0002 +1. > + -- | 0004 > int LE 0003 +1. > + -- | 0005 int ADD 0003 +1. > + -- | 0006 > int GT 0005 +1. > + -- > + -- The problem is within the type mismatch between the result > + -- type and the right operand in the IRs. > + for _ = '9' % i, always_number('') do end -- Trace 4. > + end > +end > + > +test:ok(true, 'no assertion failure') > +test:done(true) --------------Xah13E70C66pn5MSGsH3UNYk Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

Hi, Sergey,

thanks for the patch!

The bug cannot be reproduced with reverted fix.

CMake: cmake -S . -B build -DCMAKE_BUILD_TYPE=Debug -DLUAJIT_NUMMODE=2


Sergey

On 3/2/26 11:14, Sergey Kaplun wrote:
From: Mike Pall <mike>

Reported by Sergey Kaplun.

(cherry picked from commit 406cf69b3ae0a3ecd5ede2bb97b937b7a5d92074)

`rec_for_loop()` narrows the FORL index values by getting them from the
runtime. In case when the `start`, `stop`, `step` control variables are
already loaded to the slots, their TRef isn't converted to the
corresponding type. This leads to the following inconsistent IR dump and
to the assertion failure later:
| 0002 > int SLOAD  10   TCI
| 0003   int ADD    0002  +1.
| 0004 > int LE     0003  +1.
| 0005   int ADD    0003  +1.
| 0006 > int GT     0005  +1.

This patch adds the missing type conversion.

Sergey Kaplun:
* added the description and the test for the problem

Part of tarantool/tarantool#12134
---

Branch: https://github.com/tarantool/luajit/tree/skaplun/lj-1413-missing-conv-fori
Related issues:
* https://github.com/LuaJIT/LuaJIT/issues/1413
* https://github.com/tarantool/tarantool/issues/12134

 src/lj_record.c                               | 25 +++++++----
 .../lj-1413-missing-conv-fori.test.lua        | 43 +++++++++++++++++++
 2 files changed, 60 insertions(+), 8 deletions(-)
 create mode 100644 test/tarantool-tests/lj-1413-missing-conv-fori.test.lua

diff --git a/src/lj_record.c b/src/lj_record.c
index ba409a61..abb6334a 100644
--- a/src/lj_record.c
+++ b/src/lj_record.c
@@ -365,12 +365,27 @@ static TRef fori_load(jit_State *J, BCReg slot, IRType t, int mode)
 		mode + conv);
 }
 
+/* Convert FORI argument to expected target type. */
+static TRef fori_conv(jit_State *J, TRef tr, IRType t)
+{
+  if (t == IRT_INT) {
+    if (!tref_isinteger(tr))
+      return emitir(IRTGI(IR_CONV), tr, IRCONV_INT_NUM|IRCONV_CHECK);
+  } else {
+    if (!tref_isnum(tr))
+      return emitir(IRTN(IR_CONV), tr, IRCONV_NUM_INT);
+  }
+  return tr;
+}
+
 /* Peek before FORI to find a const initializer. Otherwise load from slot. */
 static TRef fori_arg(jit_State *J, const BCIns *fori, BCReg slot,
 		     IRType t, int mode)
 {
   TRef tr = J->base[slot];
-  if (!tr) {
+  if (tr) {
+    tr = fori_conv(J, tr, t);
+  } else {
     tr = find_kinit(J, fori, slot, t);
     if (!tr)
       tr = fori_load(J, slot, t, mode);
@@ -517,13 +532,7 @@ static LoopEvent rec_for(jit_State *J, const BCIns *fori, int isforl)
       lj_assertJ(tref_isnumber_str(tr[i]), "bad FORI argument type");
       if (tref_isstr(tr[i]))
 	tr[i] = emitir(IRTG(IR_STRTO, IRT_NUM), tr[i], 0);
-      if (t == IRT_INT) {
-	if (!tref_isinteger(tr[i]))
-	  tr[i] = emitir(IRTGI(IR_CONV), tr[i], IRCONV_INT_NUM|IRCONV_CHECK);
-      } else {
-	if (!tref_isnum(tr[i]))
-	  tr[i] = emitir(IRTN(IR_CONV), tr[i], IRCONV_NUM_INT);
-      }
+      tr[i] = fori_conv(J, tr[i], t);
     }
     tr[FORL_EXT] = tr[FORL_IDX];
     stop = tr[FORL_STOP];
diff --git a/test/tarantool-tests/lj-1413-missing-conv-fori.test.lua b/test/tarantool-tests/lj-1413-missing-conv-fori.test.lua
new file mode 100644
index 00000000..ba1fa74a
--- /dev/null
+++ b/test/tarantool-tests/lj-1413-missing-conv-fori.test.lua
@@ -0,0 +1,43 @@
+local tap = require('tap')
+
+-- Test file to demonstrate LuaJIT incorrect recording of FORI
+-- bytecode in the DUALNUM mode.
+-- See also: https://github.com/LuaJIT/LuaJIT/issues/1413.
+
+local test = tap.test('lj-1413-missing-conv-fori'):skipcond({
+  ['Test requires JIT enabled'] = not jit.status(),
+})
+
+test:plan(1)
+
+local function always_number(val)
+  -- Trace 3 starts as a side trace for the first one.
+  return tonumber(val) or 1
+end
+
+jit.opt.start('hotloop=1', 'hotexit=1')
+
+-- Compile the root trace with stitching.
+always_number()
+always_number('')
+
+-- An additional loop to evidentiate the issue for x86 arch in the
+-- DUALNUM mode.
+for _ = 1, 2 do
+  -- Use '%' to force number slots.
+  for i = always_number(9 % 1), 1 do
+    -- The resulting IR for the trace 4 is the following:
+    -- | 0002 > int SLOAD  10   TCI
+    -- | 0003   int ADD    0002  +1.
+    -- | 0004 > int LE     0003  +1.
+    -- | 0005   int ADD    0003  +1.
+    -- | 0006 > int GT     0005  +1.
+    --
+    -- The problem is within the type mismatch between the result
+    -- type and the right operand in the IRs.
+    for _ = '9' % i, always_number('') do end -- Trace 4.
+  end
+end
+
+test:ok(true, 'no assertion failure')
+test:done(true)
--------------Xah13E70C66pn5MSGsH3UNYk--