From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from [87.239.111.99] (localhost [127.0.0.1]) by dev.tarantool.org (Postfix) with ESMTP id C316314CF825; Wed, 20 Aug 2025 14:49:22 +0300 (MSK) DKIM-Filter: OpenDKIM Filter v2.11.0 dev.tarantool.org C316314CF825 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tarantool.org; s=dev; t=1755690562; bh=klOeT1c0lgkvpLVJ8BZbYEsiAlCvyid1+xirtqTrFw8=; h=To:Date:Subject:List-Id:List-Unsubscribe:List-Archive:List-Post: List-Help:List-Subscribe:From:Reply-To:Cc:From; b=wj6EFXOlqi4D4DDEtp06WEHN3rwwV21+f4jv8yPD/HS/325NnGiE09716YTTRzn6h NMIAA9sEsWxXUR9UGh1yzEyt9f9Iznme2xq1ulpUIEZFwaJ27qFc26+CriGF5g24UL 2/UC2Fmz3LbYLGLCcv8u8LV4MmuVVOf1GeD7empk= Received: from send174.i.mail.ru (send174.i.mail.ru [95.163.59.13]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by dev.tarantool.org (Postfix) with ESMTPS id 9B079385C01 for ; Wed, 20 Aug 2025 14:49:20 +0300 (MSK) DKIM-Filter: OpenDKIM Filter v2.11.0 dev.tarantool.org 9B079385C01 Received: by exim-smtp-7c6894c688-7q9kb with esmtpa (envelope-from ) id 1uohJf-000000009YZ-2UYP; Wed, 20 Aug 2025 14:49:20 +0300 To: Sergey Bronnikov Date: Wed, 20 Aug 2025 14:49:59 +0300 Message-ID: <20250820114959.27378-1-skaplun@tarantool.org> X-Mailer: git-send-email 2.50.1 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Mailru-Src: smtp X-7564579A: 646B95376F6C166E X-77F55803: 4F1203BC0FB41BD98550A906F77D228F7DDDBFBCAD53907EA0C6EAF24A82AA91182A05F5380850401513D87A8CD1CE683DE06ABAFEAF670559935D563600031C040D8D62593039117F2EA087B10D9051 X-7FA49CB5: 4BFC5D8501E51E47CA8F6BE7C18995EBF17A87A28845877645E4C3FB0B7A0EA5A6333920E0F9D84FF01C4FAB541DE28FCE208E8FC270FF883B56EE1CD41719AD6EEED3D1F8F94EF624AD3460B7163A6507627EB66F572D0C63D3EDE7CE9F49F504D6AF0AB02B6E8A0F5A30F1B7D8EFBB148CE4775229B98AE0CF0CE79B3440CDCF310C696883380214A8176813119CCC6BCF00562456A40908BD49AA745F4EB96910215584C2EB58386B6D831821CFCFEDA412B152283F287BD448575E1279A514A8176813119CCC953E0C1C45D6C233C6B827242DAA8E1F1A495265874E50822C0CE862CFDDF4E111CEB150E6113A5DB94301A5F42BD15882F519A0EFA9D3BDFD1713539A3C69E83BDB488C0B47A6F318BB8896F27FB42885BD5A8B2055D3F3F17A87A288458776E0FA4FF3BDD994640E36F106248C3CC5EEA1A822253BD6E0 X-87b9d050: 1 X-C1DE0DAB: B30BEEBCB9DAB3F0F157A9ECCC57034F478DEAD3877DCF16DFD0E4386183C0B8D589FB5266FA3C49BCC2DF43DD22AB26DB841BC0FD54B826D33BB91698B4E84A65C483732B0C61AE0404AC03FA789E4130AFED0B0E96279AAB8C77F2232E6289 X-C8649E89: 1C3962B70DF3F0ADBF74143AD284FC7177DD89D51EBB7742DC8270968E61249B1004E42C50DC4CA955A7F0CF078B5EC49A30900B95165D34C6EC1BD9807109D29C889BA4AF7557571642451FDB55DF3571A2338A61131000621872A2D1153FB91D7E09C32AA3244C5C7235D50354777077DD89D51EBB7742C9DD55238651C337EA455F16B58544A2557BDE0DD54B3590A5AE236DF995FB59829709634694AABAED6A17656DB59BCAD427812AF56FC65B X-D57D3AED: 3ZO7eAau8CL7WIMRKs4sN3D3tLDjz0dLbV79QFUyzQ2Ujvy7cMT6pYYqY16iZVKkSc3dCLJ7zSJH7+u4VD18S7Vl4ZUrpaVfd2+vE6kuoey4m4VkSEu53w8ahmwBjZKM/YPHZyZHvz5uv+WouB9+ObcCpyrx6l7KImUglyhkEat/+ysWwi0gdhEs0JGjl6ggRWTy1haxBpVdbIX1nthFXMZebaIdHP2ghjoIc/363UZI6Kf1ptIMVUcWHxAuDCnG8dB6NDyLJ1c= X-DA7885C5: 4F8F7E8AED2B9A39F255D290C0D534F94ADAD6F83CF1D821F6421961F711D32F3531B3F0189910B25B1A4C17EAA7BC4BEF2421ABFA55128DAF83EF9164C44C7E X-Mailru-Sender: 689FA8AB762F7393FE9E42A757851DB6EF63E7B276F72677744DA4EEC426003F2D668889E33027AFE49D44BB4BD9522A059A1ED8796F048DB274557F927329BE89D5A3BC2B10C37545BD1C3CC395C826B4A721A3011E896F X-Mras: Ok Subject: [Tarantool-patches] [PATCH luajit] x86/x64: Don't use undefined MUL/IMUL zero flag. X-BeenThere: tarantool-patches@dev.tarantool.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Tarantool development patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , From: Sergey Kaplun via Tarantool-patches Reply-To: Sergey Kaplun Cc: tarantool-patches@dev.tarantool.org Errors-To: tarantool-patches-bounces@dev.tarantool.org Sender: "Tarantool-patches" From: Mike Pall Reported by VrIgHtEr. (cherry picked from commit c92d0cb19263e7e302b4740ba6617a32c201c613) When emitting the arithmetic operations on registers via the `asm_intarith()`, the next `test` instruction may be dropped since the flag register is modified by the arithmetic instruction to be emitted. But the `imul` instruction [1] doesn't modify ZF, so its value is undefined. This patch prevents dropping the `test` instruction if the emitted instruction is `imul`. Sergey Kaplun: * added the description and the test for the problem [1]: https://www.felixcloutier.com/x86/imul Part of tarantool/tarantool#11691 --- Branch: https://github.com/tarantool/luajit/tree/skaplun/lj-1376-undefined-mul-test-flag Related issues: * https://github.com/tarantool/tarantool/issues/11691 * https://github.com/LuaJIT/LuaJIT/issues/1376 src/lj_asm_x86.h | 3 +- .../lj-1376-undefined-mul-test-flag.test.lua | 38 +++++++++++++++++++ 2 files changed, 40 insertions(+), 1 deletion(-) create mode 100644 test/tarantool-tests/lj-1376-undefined-mul-test-flag.test.lua diff --git a/src/lj_asm_x86.h b/src/lj_asm_x86.h index 89e83205..0e3a473c 100644 --- a/src/lj_asm_x86.h +++ b/src/lj_asm_x86.h @@ -2061,7 +2061,8 @@ static void asm_intarith(ASMState *as, IRIns *ir, x86Arith xa) RegSet allow = RSET_GPR; Reg dest, right; int32_t k = 0; - if (as->flagmcp == as->mcp) { /* Drop test r,r instruction. */ + if (as->flagmcp == as->mcp && xa != XOg_X_IMUL) { + /* Drop test r,r instruction. */ MCode *p = as->mcp + ((LJ_64 && *as->mcp < XI_TESTb) ? 3 : 2); MCode *q = p[0] == 0x0f ? p+1 : p; if ((*q & 15) < 14) { diff --git a/test/tarantool-tests/lj-1376-undefined-mul-test-flag.test.lua b/test/tarantool-tests/lj-1376-undefined-mul-test-flag.test.lua new file mode 100644 index 00000000..f6c02a00 --- /dev/null +++ b/test/tarantool-tests/lj-1376-undefined-mul-test-flag.test.lua @@ -0,0 +1,38 @@ +local tap = require('tap') + +-- Test file to demonstrate incorrect assembling optimization +-- for x86/x64 CPUs. +-- See also: https://github.com/LuaJIT/LuaJIT/issues/1376. + +local test = tap.test('lj-1376-undefined-mul-test-flag'):skipcond({ + ['Test requires JIT enabled'] = not jit.status(), +}) + +test:plan(1) + +local a, b = 0ULL, 0ULL + +jit.opt.start('hotloop=1') +for _ = 1, 4 do + -- Before the patch, the `test` instruction is dropped by + -- assuming the `imul` instruction before it modifies the flags + -- register. It results in the following mcode: + -- | imul r15, rbp + -- | jnz 0x559415b10060 ->5 + -- Instead of the following: + -- | imul r15, rbp + -- | test r15, r15 + -- | jnz 0x559415b10060 ->5 + -- This leads to the incorrect branch being taken. + if a * b ~= 0ULL then + test:fail('the impossible branch is taken') + test:done(true) + end + -- XXX: Need to update multiplier to stay in the variant part of + -- the loop, since invariant contains IR_NOP (former unused + -- IR_CNEW) between IRs, and the optimization is not applied. + b = b + 1 +end + +test:ok(true, 'no dropping of test instruction') +test:done(true) -- 2.50.1