From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from [87.239.111.99] (localhost [127.0.0.1]) by dev.tarantool.org (Postfix) with ESMTP id D35751384558; Wed, 14 May 2025 14:56:55 +0300 (MSK) DKIM-Filter: OpenDKIM Filter v2.11.0 dev.tarantool.org D35751384558 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tarantool.org; s=dev; t=1747223815; bh=h0ZBvR79Kbp5t7Ba7twoFzgsl5FnpBZFYDPO0GvEjWQ=; h=To:Date:Subject:List-Id:List-Unsubscribe:List-Archive:List-Post: List-Help:List-Subscribe:From:Reply-To:Cc:From; b=fTrtLgFUb6woOVuSF/5fsvWYNjel8XK9w6GFQMivb3fo3qJie3V+RK9Nko6UvoEOM 0Kt5pSw40LbwjhzIitk49caItxvBIXk10pS0J1p+BinT5EbShe9O4IAkBu98nUzVkk lGwmNHzFWfYrpk4UDbKGEscLiEN0iUrQRkDsHt7E= Received: from send126.i.mail.ru (send126.i.mail.ru [89.221.237.221]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by dev.tarantool.org (Postfix) with ESMTPS id 5634E1384558 for ; Wed, 14 May 2025 14:56:54 +0300 (MSK) DKIM-Filter: OpenDKIM Filter v2.11.0 dev.tarantool.org 5634E1384558 Received: by exim-smtp-6c9b7b7598-v6rdl with esmtpa (envelope-from ) id 1uFAjF-000000006iw-0vC4; Wed, 14 May 2025 14:56:53 +0300 To: Sergey Bronnikov Date: Wed, 14 May 2025 14:56:56 +0300 Message-ID: <20250514115656.13243-1-skaplun@tarantool.org> X-Mailer: git-send-email 2.49.0 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Mailru-Src: smtp X-7564579A: 646B95376F6C166E X-77F55803: 4F1203BC0FB41BD9F7319ED2C58FD622B9004B132EBD30CB9E2CB2592D4B019C182A05F538085040266D8B088FB7C9AF3DE06ABAFEAF670599EC45466AFD7388CCB361DAA2F174D188175C04187C9AB8 X-7FA49CB5: FF5795518A3D127A4AD6D5ED66289B5278DA827A17800CE752E71F0C64B7C834EA1F7E6F0F101C67BD4B6F7A4D31EC0BCC500DACC3FED6E28638F802B75D45FF8AA50765F7900637AC83A81C8FD4AD23D82A6BABE6F325AC2E85FA5F3EDFCBAA7353EFBB5533756683D2E4CC5BF9E7693C1407DD421927B182898E7AA7DB256FA66F647FB587B2FF389733CBF5DBD5E913377AFFFEAFD269176DF2183F8FC7C045A75973B56231AD8941B15DA834481FCF19DD082D7633A0EF3E4896CB9E6436389733CBF5DBD5E9D5E8D9A59859A8B6D6FBC3EC642A93BBCC7F00164DA146DA6F5DAA56C3B73B237318B6A418E8EAB86D1867E19FE14079C09775C1D3CA48CF3D321E7403792E342EB15956EA79C166176DF2183F8FC7C04E672349037D5FA5725E5C173C3A84C3ADE50F0DA4A4E48C35872C767BF85DA2F004C90652538430E4A6367B16DE6309 X-C1DE0DAB: 0D63561A33F958A56BDD5BF695D3E67F5002B1117B3ED696DBBDE0AB1943F913E41E333F9D1358D5823CB91A9FED034534781492E4B8EEADB30A456A8F293845C79554A2A72441328621D336A7BC284946AD531847A6065A535571D14F44ED41 X-C8649E89: 1C3962B70DF3F0ADBF74143AD284FC7177DD89D51EBB7742DC8270968E61249B1004E42C50DC4CA955A7F0CF078B5EC49A30900B95165D34AEC7C2AC3C44791D89F2B5CB763E7AF002C61C11AE28F65DD1BF6F703109EC95338CE863A5B6CA561D7E09C32AA3244C9FBFC8084B8F2F6877DD89D51EBB7742B0F86EAB95066387EA455F16B58544A2557BDE0DD54B3590A5AE236DF995FB59829709634694AABAED6A17656DB59BCAD427812AF56FC65B X-D57D3AED: 3ZO7eAau8CL7WIMRKs4sN3D3tLDjz0dLbV79QFUyzQ2Ujvy7cMT6pYYqY16iZVKkSc3dCLJ7zSJH7+u4VD18S7Vl4ZUrpaVfd2+vE6kuoey4m4VkSEu53w8ahmwBjZKM/YPHZyZHvz5uv+WouB9+ObcCpyrx6l7KImUglyhkEat/+ysWwi0gdhEs0JGjl6ggRWTy1haxBpVdbIX1nthFXMZebaIdHP2ghjoIc/363UZI6Kf1ptIMVT0GoR8ZYDe7kos5ru8I9gM= X-DA7885C5: A3A96BF9D2B72417F255D290C0D534F949AB9BC0857D0D80195DB375D73F9B07B760CD2B8C02D57D5B1A4C17EAA7BC4BEF2421ABFA55128DAF83EF9164C44C7E X-Mailru-Sender: 689FA8AB762F7393FE9E42A757851DB60F7EF769C242A7CA6EE8AA18ACDBFFAABFFE7FE91E8FDF67E49D44BB4BD9522A059A1ED8796F048DB274557F927329BE89D5A3BC2B10C37545BD1C3CC395C826B4A721A3011E896F X-Mras: Ok Subject: [Tarantool-patches] [PATCH luajit] ARM64: Fix IR_SLOAD assembly. X-BeenThere: tarantool-patches@dev.tarantool.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Tarantool development patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , From: Sergey Kaplun via Tarantool-patches Reply-To: Sergey Kaplun Cc: tarantool-patches@dev.tarantool.org Errors-To: tarantool-patches-bounces@dev.tarantool.org Sender: "Tarantool-patches" From: Mike Pall Reported by Gate88. (cherry picked from commit 6c4826f12c4d33b8b978004bc681eb1eef2be977) The issue is in the case when IR SLOAD is unused on a trace, persists only for typecheck, and has the `num` type. In this case, the `dest` register is `RID_NONE`. Hence, the `fmov` instruction is emitted unconditionally, where the destination register is `d0` (`RID_NONE & 31`). So, the value of this register is spoiled. If it holds any value evaluated before and used after this SLOAD, it leads to incorrect behaviour. This patch adds the check that the register is in use before emitting the instruction. Sergey Kaplun: * added the description and the test for the problem Part of tarantool/tarantool#11278 --- Branch: https://github.com/tarantool/luajit/tree/skaplun/lj-903-arm64-unused-number-sload-typecheck Related issues: * https://github.com/LuaJIT/LuaJIT/issues/903 * https://github.com/tarantool/tarantool/issues/11278 src/lj_asm_arm64.h | 2 +- ...m64-unused-number-sload-typecheck.test.lua | 45 +++++++++++++++++++ 2 files changed, 46 insertions(+), 1 deletion(-) create mode 100644 test/tarantool-tests/lj-903-arm64-unused-number-sload-typecheck.test.lua diff --git a/src/lj_asm_arm64.h b/src/lj_asm_arm64.h index 554bb60a..9b27473c 100644 --- a/src/lj_asm_arm64.h +++ b/src/lj_asm_arm64.h @@ -1177,7 +1177,7 @@ dotypecheck: tmp = ra_scratch(as, allow); rset_clear(allow, tmp); } - if (irt_isnum(t) && !(ir->op2 & IRSLOAD_CONVERT)) + if (ra_hasreg(dest) && irt_isnum(t) && !(ir->op2 & IRSLOAD_CONVERT)) emit_dn(as, A64I_FMOV_D_R, (dest & 31), tmp); /* Need type check, even if the load result is unused. */ asm_guardcc(as, irt_isnum(t) ? CC_LS : CC_NE); diff --git a/test/tarantool-tests/lj-903-arm64-unused-number-sload-typecheck.test.lua b/test/tarantool-tests/lj-903-arm64-unused-number-sload-typecheck.test.lua new file mode 100644 index 00000000..748b88e2 --- /dev/null +++ b/test/tarantool-tests/lj-903-arm64-unused-number-sload-typecheck.test.lua @@ -0,0 +1,45 @@ +local tap = require('tap') +-- Test file to demonstrate the incorrect JIT assembling of unused +-- `IR_SLOAD` with number type on arm64. +-- See also https://github.com/LuaJIT/LuaJIT/issue/903. +local test = tap.test('lj-903-arm64-unused-number-sload-typecheck'):skipcond({ + ['Test requires JIT enabled'] = not jit.status(), +}) + +test:plan(1) + +-- Just use any different numbers (but not integers to avoid +-- integer IR type). +local SLOT = 0.1 +local MARKER_VALUE = 4.2 +-- XXX: Special mapping to avoid folding and removing always true +-- comparison. +local anchor = {marker = MARKER_VALUE} + +-- Special function to inline on trace to generate SLOAD +-- typecheck. +local function sload_unused(x) + return x +end + +-- The additional wrapper to use stackslots in the function. +local function test_sload() + local sload = SLOT + for _ = 1, 4 do + -- This line should use the `d0` register. + local marker = anchor.marker - MARKER_VALUE + -- This generates unused IR_SLOAD with typecheck (number). + -- Before the patch, it occasionally overwrites the `d0` + -- register and causes the execution of the branch. + sload_unused(sload) + if marker ~= 0 then + return false + end + end + return true +end + +jit.opt.start('hotloop=1') +test:ok(test_sload(), 'correct SLOAD assembling') + +test:done(true) -- 2.49.0