From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from [87.239.111.99] (localhost [127.0.0.1]) by dev.tarantool.org (Postfix) with ESMTP id 316131628FE2; Mon, 2 Mar 2026 11:13:57 +0300 (MSK) DKIM-Filter: OpenDKIM Filter v2.11.0 dev.tarantool.org 316131628FE2 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tarantool.org; s=dev; t=1772439237; bh=HFOrSk3ehF9piTGhgdFYlw0ymjh09rhwUzVpAJIa6QI=; h=To:Date:Subject:List-Id:List-Unsubscribe:List-Archive:List-Post: List-Help:List-Subscribe:From:Reply-To:Cc:From; b=CtN16FKFmctctmE6E9JSFJb+cv9OUwaB1jsCX1D6DOj6zvqumjdZaR94yhGzwhzb5 o83xvkBDk1AM6WVxUmdg9d4RXQAeKULUtfSkNTVhzGudGd2Nt1a9QtYoXKLlBUSozC eMwA8qu/chKi7eF0nzV5IbezHfNK7SIx/iRXZNgg= Received: from send219.i.mail.ru (send219.i.mail.ru [95.163.59.58]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by dev.tarantool.org (Postfix) with ESMTPS id 53ADF1628FE4 for ; Mon, 2 Mar 2026 11:13:55 +0300 (MSK) DKIM-Filter: OpenDKIM Filter v2.11.0 dev.tarantool.org 53ADF1628FE4 Received: by exim-smtp-558f87dcd7-pvtxq with esmtpa (envelope-from ) id 1vwyPa-00000000AWL-11vI; Mon, 02 Mar 2026 11:13:54 +0300 To: Sergey Bronnikov Date: Mon, 2 Mar 2026 11:14:43 +0300 Message-ID: <20260302081443.1058-1-skaplun@tarantool.org> X-Mailer: git-send-email 2.53.0 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Mailru-Src: smtp X-7564579A: 78E4E2B564C1792B X-77F55803: 4F1203BC0FB41BD9FE49BA1A5307ACBF652C2930A10F32CC143DE2B0554ADE7800894C459B0CD1B994F0415E8BE58C19C591814E25D11F9F448E1335AA2CAC5643BEE8AB7F82FCDF224C9A2F61B97637 X-7FA49CB5: FF5795518A3D127A4AD6D5ED66289B5278DA827A17800CE72F22E6DC541F75D9EA1F7E6F0F101C67BD4B6F7A4D31EC0BCC500DACC3FED6E28638F802B75D45FF8AA50765F7900637AC83A81C8FD4AD23D82A6BABE6F325AC2E85FA5F3EDFCBAA7353EFBB55337566487A753D4C0E5B9C65D8FC99298655C419DB377B60BFDF89FA3ADBEAD6732928389733CBF5DBD5E913377AFFFEAFD269176DF2183F8FC7C078FCF50C7EAF9C588941B15DA834481FCF19DD082D7633A0EF3E4896CB9E6436389733CBF5DBD5E9D5E8D9A59859A8B636DA1BED736F9328CC7F00164DA146DA6F5DAA56C3B73B237318B6A418E8EAB8D32BA5DBAC0009BE9E8FC8737B5C22499415BD0C5D58566676E601842F6C81A12EF20D2F80756B5FB606B96278B59C4276E601842F6C81A127C277FBC8AE2E8B45DDB8CBD1AB320B3AA81AA40904B5D99C9F4D5AE37F343AD1F44FA8B9022EA23BBE47FD9DD3FB595F5C1EE8F4F765FC72CEEB2601E22B093A03B725D353964B0B7D0EA88DDEDAC722CA9DD8327EE4930A3850AC1BE2E7352629B07FD02F83A6C4224003CC83647689D4C264860C145E X-C1DE0DAB: 0D63561A33F958A5874828BA3269C4B05002B1117B3ED69681909ADDF82A2473A13BD6A4B0E00B96823CB91A9FED034534781492E4B8EEADC8D8B8CB12567299C79554A2A72441328621D336A7BC284946AD531847A6065A535571D14F44ED41 X-C8649E89: 1C3962B70DF3F0AD73CAD6646DEDE191716CD42B3DD1D34C77DD89D51EBB774225B6776AC983F447FC0B9F89525902EE6F57B2FD27647F25E66C117BDB76D6599778809FFA05D9E1F3B9AD72B6B92D4022D3A2DFF6A6DE58C7828EFE3229F842743464FE76574C46B8341EE9D5BE9A0A4085DFFBF4027EA6B270739FA5BDCCF418038961CEDCD44D6536EB022892E5344C41F94D744909CECFA6C6B0C050A61A8CAF69B82BA93681CD72808BE417F3B9E0E7457915DAA85F X-D57D3AED: 3ZO7eAau8CL7WIMRKs4sN3D3tLDjz0dLbV79QFUyzQ2Ujvy7cMT6pYYqY16iZVKkSc3dCLJ7zSJH7+u4VD18S7Vl4ZUrpaVfd2+vE6kuoey4m4VkSEu53w8ahmwBjZKM/YPHZyZHvz5uv+WouB9+ObcCpyrx6l7KImUglyhkEat/+ysWwi0gdhEs0JGjl6ggRWTy1haxBpVdbIX1nthFXMZebaIdHP2ghjoIc/363UZI6Kf1ptIMVbwN8XFWZxQUnJZBIHOTSdA= X-Mailru-Sender: 583F1D7ACE8F49BDD951BA70C165859E2717413A13E35ADA87A35C9C7BBE74BEFBE45A66C1FB6D5C23647241908DD939F2400F607609286E924004A7DEC283833C7120B22964430C52B393F8C72A41A84198E0F3ECE9B5443453F38A29522196 X-Mras: Ok Subject: [Tarantool-patches] [PATCH luajit] DUALNUM: Add missing type conversion for FORI slots. X-BeenThere: tarantool-patches@dev.tarantool.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Tarantool development patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , From: Sergey Kaplun via Tarantool-patches Reply-To: Sergey Kaplun Cc: tarantool-patches@dev.tarantool.org Errors-To: tarantool-patches-bounces@dev.tarantool.org Sender: "Tarantool-patches" From: Mike Pall Reported by Sergey Kaplun. (cherry picked from commit 406cf69b3ae0a3ecd5ede2bb97b937b7a5d92074) `rec_for_loop()` narrows the FORL index values by getting them from the runtime. In case when the `start`, `stop`, `step` control variables are already loaded to the slots, their TRef isn't converted to the corresponding type. This leads to the following inconsistent IR dump and to the assertion failure later: | 0002 > int SLOAD 10 TCI | 0003 int ADD 0002 +1. | 0004 > int LE 0003 +1. | 0005 int ADD 0003 +1. | 0006 > int GT 0005 +1. This patch adds the missing type conversion. Sergey Kaplun: * added the description and the test for the problem Part of tarantool/tarantool#12134 --- Branch: https://github.com/tarantool/luajit/tree/skaplun/lj-1413-missing-conv-fori Related issues: * https://github.com/LuaJIT/LuaJIT/issues/1413 * https://github.com/tarantool/tarantool/issues/12134 src/lj_record.c | 25 +++++++---- .../lj-1413-missing-conv-fori.test.lua | 43 +++++++++++++++++++ 2 files changed, 60 insertions(+), 8 deletions(-) create mode 100644 test/tarantool-tests/lj-1413-missing-conv-fori.test.lua diff --git a/src/lj_record.c b/src/lj_record.c index ba409a61..abb6334a 100644 --- a/src/lj_record.c +++ b/src/lj_record.c @@ -365,12 +365,27 @@ static TRef fori_load(jit_State *J, BCReg slot, IRType t, int mode) mode + conv); } +/* Convert FORI argument to expected target type. */ +static TRef fori_conv(jit_State *J, TRef tr, IRType t) +{ + if (t == IRT_INT) { + if (!tref_isinteger(tr)) + return emitir(IRTGI(IR_CONV), tr, IRCONV_INT_NUM|IRCONV_CHECK); + } else { + if (!tref_isnum(tr)) + return emitir(IRTN(IR_CONV), tr, IRCONV_NUM_INT); + } + return tr; +} + /* Peek before FORI to find a const initializer. Otherwise load from slot. */ static TRef fori_arg(jit_State *J, const BCIns *fori, BCReg slot, IRType t, int mode) { TRef tr = J->base[slot]; - if (!tr) { + if (tr) { + tr = fori_conv(J, tr, t); + } else { tr = find_kinit(J, fori, slot, t); if (!tr) tr = fori_load(J, slot, t, mode); @@ -517,13 +532,7 @@ static LoopEvent rec_for(jit_State *J, const BCIns *fori, int isforl) lj_assertJ(tref_isnumber_str(tr[i]), "bad FORI argument type"); if (tref_isstr(tr[i])) tr[i] = emitir(IRTG(IR_STRTO, IRT_NUM), tr[i], 0); - if (t == IRT_INT) { - if (!tref_isinteger(tr[i])) - tr[i] = emitir(IRTGI(IR_CONV), tr[i], IRCONV_INT_NUM|IRCONV_CHECK); - } else { - if (!tref_isnum(tr[i])) - tr[i] = emitir(IRTN(IR_CONV), tr[i], IRCONV_NUM_INT); - } + tr[i] = fori_conv(J, tr[i], t); } tr[FORL_EXT] = tr[FORL_IDX]; stop = tr[FORL_STOP]; diff --git a/test/tarantool-tests/lj-1413-missing-conv-fori.test.lua b/test/tarantool-tests/lj-1413-missing-conv-fori.test.lua new file mode 100644 index 00000000..ba1fa74a --- /dev/null +++ b/test/tarantool-tests/lj-1413-missing-conv-fori.test.lua @@ -0,0 +1,43 @@ +local tap = require('tap') + +-- Test file to demonstrate LuaJIT incorrect recording of FORI +-- bytecode in the DUALNUM mode. +-- See also: https://github.com/LuaJIT/LuaJIT/issues/1413. + +local test = tap.test('lj-1413-missing-conv-fori'):skipcond({ + ['Test requires JIT enabled'] = not jit.status(), +}) + +test:plan(1) + +local function always_number(val) + -- Trace 3 starts as a side trace for the first one. + return tonumber(val) or 1 +end + +jit.opt.start('hotloop=1', 'hotexit=1') + +-- Compile the root trace with stitching. +always_number() +always_number('') + +-- An additional loop to evidentiate the issue for x86 arch in the +-- DUALNUM mode. +for _ = 1, 2 do + -- Use '%' to force number slots. + for i = always_number(9 % 1), 1 do + -- The resulting IR for the trace 4 is the following: + -- | 0002 > int SLOAD 10 TCI + -- | 0003 int ADD 0002 +1. + -- | 0004 > int LE 0003 +1. + -- | 0005 int ADD 0003 +1. + -- | 0006 > int GT 0005 +1. + -- + -- The problem is within the type mismatch between the result + -- type and the right operand in the IRs. + for _ = '9' % i, always_number('') do end -- Trace 4. + end +end + +test:ok(true, 'no assertion failure') +test:done(true) -- 2.53.0