From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from [87.239.111.99] (localhost [127.0.0.1]) by dev.tarantool.org (Postfix) with ESMTP id 24C6CCD8B85; Fri, 17 May 2024 16:33:35 +0300 (MSK) DKIM-Filter: OpenDKIM Filter v2.11.0 dev.tarantool.org 24C6CCD8B85 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tarantool.org; s=dev; t=1715952815; bh=t0sFURn9scaPku/bas4cszzuqA7jB7VWdjAxrp0EG3E=; h=To:Date:Subject:List-Id:List-Unsubscribe:List-Archive:List-Post: List-Help:List-Subscribe:From:Reply-To:Cc:From; b=dzYPAILzoi1xmMJLudOx0VSJahtAfc+0soWfwoNRxGyWV8uar7LfSuT/rvzIBkKv7 sIavuHntKvAJ9Zq54pYJufBrKfqiHVL0ug8gHlX8IsYgqguUJcFIQ5x4m0AIJYNcil AwyZRqo3spybgaA9Jz//d+65JKM9uZcP4nUu0ntg= Received: from smtp52.i.mail.ru (smtp52.i.mail.ru [95.163.41.88]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by dev.tarantool.org (Postfix) with ESMTPS id A3060CD8B85 for ; Fri, 17 May 2024 16:33:33 +0300 (MSK) DKIM-Filter: OpenDKIM Filter v2.11.0 dev.tarantool.org A3060CD8B85 Received: by smtp52.i.mail.ru with esmtpa (envelope-from ) id 1s7xiG-00000007YZ4-1Sht; Fri, 17 May 2024 16:33:32 +0300 To: Maxim Kokryashkin , Sergey Bronnikov Date: Fri, 17 May 2024 16:29:18 +0300 Message-ID: <20240517132918.25926-1-skaplun@tarantool.org> X-Mailer: git-send-email 2.45.0 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Mailru-Src: smtp X-7564579A: B8F34718100C35BD X-77F55803: 4F1203BC0FB41BD90CF8E60E6BB262B739B27E3B29B033F5A75CB38AA1F8A48F182A05F538085040460B0654F154449191417EB218679B82249D74353F92AAC0AB64730C95F249C687C9673BEE2CBA79 X-7FA49CB5: FF5795518A3D127A4AD6D5ED66289B5278DA827A17800CE7E27C7C60963D4ED9EA1F7E6F0F101C67BD4B6F7A4D31EC0BCC500DACC3FED6E28638F802B75D45FF8AA50765F790063729D9E4EC97225AF68638F802B75D45FF36EB9D2243A4F8B5A6FCA7DBDB1FC311F39EFFDF887939037866D6147AF826D8D1FE371ED12E31510E08F7D2CB9CEF3F72CBC6B40FCA7F04CC7F00164DA146DAFE8445B8C89999728AA50765F7900637D9CFB327BC390E24389733CBF5DBD5E9C8A9BA7A39EFB766F5D81C698A659EA7CC7F00164DA146DA9985D098DBDEAEC80A6B3CD6EB70C818117882F4460429728AD0CFFFB425014E868A13BD56FB6657E2021AF6380DFAD1A18204E546F3947C1D471462564A2E192E808ACE2090B5E1725E5C173C3A84C3ED8438A78DFE0A9E089D37D7C0E48F6C8AA50765F790063757B1FBEA53BC6EDBEFF80C71ABB335746BA297DBC24807EABDAD6C7F3747799A X-C1DE0DAB: 0D63561A33F958A5ACC51A9654FCC70C5002B1117B3ED6966EFE9586E64656D819AC5B239BAD4335823CB91A9FED034534781492E4B8EEADA757276DBF662F3EC79554A2A72441328621D336A7BC284946AD531847A6065A535571D14F44ED41 X-C8649E89: 1C3962B70DF3F0ADBF74143AD284FC7177DD89D51EBB7742DC8270968E61249B1004E42C50DC4CA955A7F0CF078B5EC49A30900B95165D349379E7F8541B6C9A4FB06D1AF010598FD1A21B19DB72E2258AE8949848F54A943F4F69C298768DF61D7E09C32AA3244C45984B9238D203DC0091A80DA37A96F327BEE6BE00059E12EA455F16B58544A21C197AAF4D2E4732A5AE236DF995FB59829709634694AABAED6A17656DB59BCAD427812AF56FC65B X-D57D3AED: 3ZO7eAau8CL7WIMRKs4sN3D3tLDjz0dLbV79QFUyzQ2Ujvy7cMT6pYYqY16iZVKkSc3dCLJ7zSJH7+u4VD18S7Vl4ZUrpaVfd2+vE6kuoey4m4VkSEu530nj6fImhcD4MUrOEAnl0W826KZ9Q+tr5ycPtXkTV4k65bRjmOUUP8cvGozZ33TWg5HZplvhhXbhDGzqmQDTd6OAevLeAnq3Ra9uf7zvY2zzsIhlcp/Y7m53TZgf2aB4JOg4gkr2biojsKvmAUMAIqMetnJbXIRD6Q== X-DA7885C5: E38D08E0C9191B1EF255D290C0D534F9CBF853A24454241C9D1451147E97B011F92C976FFEA1E2A75B1A4C17EAA7BC4BEF2421ABFA55128DAF83EF9164C44C7E X-Mailru-Sender: 689FA8AB762F7393C6D0B12EA33CAA9B02AE15BEF56F2E6E7EB005ECE433AAB18CCDEFF28075FB2CE49D44BB4BD9522A059A1ED8796F048DB274557F927329BE89D5A3BC2B10C37545BD1C3CC395C826B4A721A3011E896F X-Mras: Ok Subject: [Tarantool-patches] [PATCH luajit] Maintain chain invariant in DCE. X-BeenThere: tarantool-patches@dev.tarantool.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Tarantool development patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , From: Sergey Kaplun via Tarantool-patches Reply-To: Sergey Kaplun Cc: tarantool-patches@dev.tarantool.org Errors-To: tarantool-patches-bounces@dev.tarantool.org Sender: "Tarantool-patches" From: Mike Pall Thanks to Peter Cawley. (cherry picked from commit f72c19e482b6f918b7cf42b0436e2b117d160a29) Instructions with strong guards that are sometimes emitted with a guard and sometimes emitted without a guard (like HREFK, CONV, or SLOAD) may be eliminated from the IR chain and replaced with the NOP IR. If the next IR of the same kind on the trace is not eliminated, it may reference the IR NOP instead of an instruction of the same type. This may lead to the corresponding assertion failure in the `rec_check_ir()`. This patch unconditionally links the IRs during chain maintenance in DCE. Sergey Kaplun: * added the description and the test for the problem Part of tarantool/tarantool#9924 --- Be aware that the reproducer from the ticket does not lead to the assertion failure (this is why it is omitted in the test). I suppose it just illustrates the situation when the IR is left off the chain. Although the reproducer is clumsy, I can't simplify it or make it less tricky. Please, ideas are welcome :). Branch: https://github.com/tarantool/luajit/tree/skaplun/lj-1094-ir-chain-dce Related Issues: * https://github.com/tarantool/tarantool/issues/9924 * https://github.com/LuaJIT/LuaJIT/issues/1094 src/lj_opt_dce.c | 2 +- .../lj-1094-ir-chain-dce.test.lua | 51 +++++++++++++++++++ 2 files changed, 52 insertions(+), 1 deletion(-) create mode 100644 test/tarantool-tests/lj-1094-ir-chain-dce.test.lua diff --git a/src/lj_opt_dce.c b/src/lj_opt_dce.c index 2417f324..6948179c 100644 --- a/src/lj_opt_dce.c +++ b/src/lj_opt_dce.c @@ -44,7 +44,6 @@ static void dce_propagate(jit_State *J) IRIns *ir = IR(ins); if (irt_ismarked(ir->t)) { irt_clearmark(ir->t); - pchain[ir->o] = &ir->prev; } else if (!ir_sideeff(ir)) { *pchain[ir->o] = ir->prev; /* Reroute original instruction chain. */ ir->t.irt = IRT_NIL; @@ -53,6 +52,7 @@ static void dce_propagate(jit_State *J) ir->prev = 0; continue; } + pchain[ir->o] = &ir->prev; if (ir->op1 >= REF_FIRST) irt_setmark(IR(ir->op1)->t); if (ir->op2 >= REF_FIRST) irt_setmark(IR(ir->op2)->t); } diff --git a/test/tarantool-tests/lj-1094-ir-chain-dce.test.lua b/test/tarantool-tests/lj-1094-ir-chain-dce.test.lua new file mode 100644 index 00000000..3faae7d4 --- /dev/null +++ b/test/tarantool-tests/lj-1094-ir-chain-dce.test.lua @@ -0,0 +1,51 @@ +local tap = require('tap') + +-- Test file to demonstrate LuaJIT's incorrect maintenance of the +-- IR chain during DCE. +-- See also: https://github.com/LuaJIT/LuaJIT/issues/1094. + +local test = tap.test('lj-1094-ir-chain-dce'):skipcond({ + ['Test requires JIT enabled'] = not jit.status(), +}) + +test:plan(1) + +jit.opt.start('hotloop=1') + +-- XXX: The code below is generated by the fuzzer (locally) and +-- simplified as much as possible. + +-- Simple noop function. +local __newindex = function() end +debug.setmetatable(0, { + __newindex = __newindex, +}) + +local counter = 0 +-- luacheck: no unused +local tab = {} +while true do + -- The loop is still not recorded because the guard always + -- fails. + -- So, just try to compile it and check that there is no + -- assertion failure. + if counter > 2 then break end + counter = counter + 1 + -- The pattern `-#{}` allows us to get CONV IRs. The first + -- appearance of this IR (in the `(-#{}).key`) is considered + -- unused by the compiler due to the corresponding "noop" + -- `__newindex` function. + -- The second usage of conversion (`tab[-#{}]`) is guarded (to + -- the int type), so it can't be eliminated. + -- As a result, the 0048 CONV references the 0039 NOP IR after + -- DCE in the IR chain. + -- XXX: TDUP prevents the corresponding second usage from being + -- eliminated since the table insert semantics may change. + -- XXX: Use some numbers to simplify reading the `jit.dump` + -- output. + tab, tab[-#{}], (-#{}).key = {tdup = 'tdup'}, 1, 2 +end + +test:ok(true, 'no assertion failure') + +test:done(true) -- 2.45.0