From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from [87.239.111.99] (localhost [127.0.0.1]) by dev.tarantool.org (Postfix) with ESMTP id D8F9E50375F; Fri, 9 Jun 2023 12:37:37 +0300 (MSK) DKIM-Filter: OpenDKIM Filter v2.11.0 dev.tarantool.org D8F9E50375F DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tarantool.org; s=dev; t=1686303457; bh=5tbA3ERtYCSpJoM9cMMbLpxeAtXraNft3MmpGsf6oRo=; h=To:Date:In-Reply-To:References:Subject:List-Id:List-Unsubscribe: List-Archive:List-Post:List-Help:List-Subscribe:From:Reply-To:Cc: From; b=l6mutDJrLRHg4xQh4svF77NvOV2LXrVgFa2lZnJ9w7Tx73xSIZjQEJ3yTq/O1HfbI 8iwtC1As2JekolyIcEa+rwKW2cG3g6Mf7jybr137jqiGhS+FTPb5o0HdqKbwxwJdB+ r9mcCl5qhjzDUVpelxcfftCuzssq1IX3f02NN0as= Received: from smtp63.i.mail.ru (smtp63.i.mail.ru [95.163.41.100]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dev.tarantool.org (Postfix) with ESMTPS id 8962E50375F for ; Fri, 9 Jun 2023 12:37:07 +0300 (MSK) DKIM-Filter: OpenDKIM Filter v2.11.0 dev.tarantool.org 8962E50375F Received: by smtp63.i.mail.ru with esmtpa (envelope-from ) id 1q7YYM-00CuxR-J1; Fri, 09 Jun 2023 12:37:07 +0300 To: Maxim Kokryashkin , Sergey Bronnikov Date: Fri, 9 Jun 2023 12:32:52 +0300 Message-Id: <2e92221ec1d4e8222be8cbd89b4d0e047bc9b795.1686299850.git.skaplun@tarantool.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Mailru-Src: smtp X-4EC0790: 10 X-7564579A: 646B95376F6C166E X-77F55803: 4F1203BC0FB41BD965EFE7F2AC62B27A4FBE589D5EF957DC135893A82E067D8F182A05F5380850407E59E8837A636ADD887DDEE080EB849DA4EF035D6544B569025833BDA1320839 X-7FA49CB5: FF5795518A3D127A4AD6D5ED66289B5278DA827A17800CE797F4D2EDC29AFAF7EA1F7E6F0F101C67BD4B6F7A4D31EC0BCC500DACC3FED6E28638F802B75D45FF8AA50765F7900637CD1DFD3ABA64F6568638F802B75D45FF36EB9D2243A4F8B5A6FCA7DBDB1FC311F39EFFDF887939037866D6147AF826D817E9336716315CE3F58A3BA22319605F117882F4460429724CE54428C33FAD305F5C1EE8F4F765FC566404C906FA8ADEA471835C12D1D9774AD6D5ED66289B52BA9C0B312567BB23117882F4460429728776938767073520CCD848CCB6FE560CE5D25F19253116ADD2E47CDBA5A96583BA9C0B312567BB2376E601842F6C81A19E625A9149C048EE41BF15D38FB6CB3A9100238FE36DC7A2D8FC6C240DEA7642DBF02ECDB25306B2B78CF848AE20165D0A6AB1C7CE11FEE3B2DECCBDF547A30576E601842F6C81A1F004C906525384303E02D724532EE2C3F43C7A68FF6260569E8FC8737B5C2249957A4DEDD2346B42E827F84554CEF50127C277FBC8AE2E8BA83251EDC214901ED5E8D9A59859A8B6A45692FFBBD75A6A089D37D7C0E48F6C5571747095F342E88FB05168BE4CE3AF X-C1DE0DAB: 0D63561A33F958A5E47C2723BA8A154F88FADD76790359D7B10A93F47782DDB6F87CCE6106E1FC07E67D4AC08A07B9B0CE135D2742255B359C5DF10A05D560A950611B66E3DA6D700B0A020F03D25A0997E3FB2386030E77 X-C8649E89: 1C3962B70DF3F0ADE00A9FD3E00BEEDF3FED46C3ACD6F73ED3581295AF09D3DF87807E0823442EA2ED31085941D9CD0AF7F820E7B07EA4CF523D3F090C752FA1E04B415EB7182C830C6E4111A46715320B89AD3C3CDA37FA1F616861E982FD8FB5655EA6190D4CDA5650AB8A79D652C546D955F2627D88AEA74DFFEFA5DC0E7F02C26D483E81D6BE5EF9655DD6DEA7D65774BB76CC95456EEC5B5AD62611EEC62B5AFB4261A09AF0 X-D57D3AED: 3ZO7eAau8CL7WIMRKs4sN3D3tLDjz0dLbV79QFUyzQ2Ujvy7cMT6pYYqY16iZVKkSc3dCLJ7zSJH7+u4VD18S7Vl4ZUrpaVfd2+vE6kuoey4m4VkSEu530nj6fImhcD4MUrOEAnl0W826KZ9Q+tr5ycPtXkTV4k65bRjmOUUP8cvGozZ33TWg5HZplvhhXbhDGzqmQDTd6OAevLeAnq3Ra9uf7zvY2zzsIhlcp/Y7m53TZgf2aB4JOg4gkr2biojRLo8CqjALXjz3xUN8HHrTg== X-Mailru-Sender: 11C2EC085EDE56FAC07928AF2646A769AC9C826F19392A52887DDEE080EB849DBC4EE72AB2E748C5DEDBA653FF35249392D99EB8CC7091A70E183A470755BFD208F19895AA18418972D6B4FCE48DF648AE208404248635DF X-Mras: Ok Subject: [Tarantool-patches] [PATCH luajit 1/2] Fix use-def analysis for BC_VARG. X-BeenThere: tarantool-patches@dev.tarantool.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Tarantool development patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , From: Sergey Kaplun via Tarantool-patches Reply-To: Sergey Kaplun Cc: tarantool-patches@dev.tarantool.org Errors-To: tarantool-patches-bounces@dev.tarantool.org Sender: "Tarantool-patches" From: Mike Pall Reported by Ryan Lucia. (cherry-picked from commit 2801500a26084491ae035170cad4700513790890) Use-def analizis for BC_VARG has to strong limit for the top/maxslot, so no slots may considered as used. This leads to addititional SLOAD on trace with incorrect value used later. This patch disables the use-def analisis for BC_VARG as NIY. Sergey Kaplun: * added the description and the test for the problem Part of tarantool/tarantool#8516 Relates to tarantool/tarantool#8718 --- src/lj_snap.c | 4 +- .../lj-704-bc-varg-use-def.test.lua | 65 +++++++++++++++++++ 2 files changed, 68 insertions(+), 1 deletion(-) create mode 100644 test/tarantool-tests/lj-704-bc-varg-use-def.test.lua diff --git a/src/lj_snap.c b/src/lj_snap.c index a8b49fcb..5bbe8498 100644 --- a/src/lj_snap.c +++ b/src/lj_snap.c @@ -267,7 +267,7 @@ static BCReg snap_usedef(jit_State *J, uint8_t *udf, if (!(op == BC_ISTC || op == BC_ISFC)) DEF_SLOT(bc_a(ins)); break; case BCMbase: - if (op >= BC_CALLM && op <= BC_VARG) { + if (op >= BC_CALLM && op <= BC_ITERN) { BCReg top = (op == BC_CALLM || op == BC_CALLMT || bc_c(ins) == 0) ? maxslot : (bc_a(ins) + bc_c(ins)+LJ_FR2); if (LJ_FR2) DEF_SLOT(bc_a(ins)+1); @@ -278,6 +278,8 @@ static BCReg snap_usedef(jit_State *J, uint8_t *udf, for (s = 0; s < bc_a(ins); s++) DEF_SLOT(s); return 0; } + } else if (op == BC_VARG) { + return maxslot; /* NYI: punt. */ } else if (op == BC_KNIL) { for (s = bc_a(ins); s <= bc_d(ins); s++) DEF_SLOT(s); } else if (op == BC_TSETM) { diff --git a/test/tarantool-tests/lj-704-bc-varg-use-def.test.lua b/test/tarantool-tests/lj-704-bc-varg-use-def.test.lua new file mode 100644 index 00000000..c3ba65dd --- /dev/null +++ b/test/tarantool-tests/lj-704-bc-varg-use-def.test.lua @@ -0,0 +1,65 @@ +local tap = require('tap') +-- Test file to demonstrate LuaJIT misbehaviour in use-def +-- snapshot analysis for BC_VARG. +-- See also https://github.com/LuaJIT/LuaJIT/issues/704. +local test = tap.test('lj-704-bc-varg-use-def'):skipcond({ + ['Test requires JIT enabled'] = not jit.status(), +}) + +test:plan(1) + +-- XXX: we don't really need to store this builtins, but this is +-- reduces `jitdump()` output for reader significantly. +local fmod = math.fmod +local pcall = pcall + +-- Use the 2 values for `fmod()` to produce non-zero value for +-- the call on trace (the last one call). +local ARG_ON_RECORDING = 6 +local ON_TRACE_VALUE = ARG_ON_RECORDING + 1 + +-- The `jitdump()` output was like the following before the patch: +-- 0003 > num SLOAD #1 T +-- .... SNAP #1 [`wrap()`|---- pcall|`varg()`|----] +-- 0004 } tab TNEW #3 #0 +-- 0005 > num SLOAD #4 T +-- 0006 p32 FLOAD 0004 tab.array +-- 0007 p32 AREF 0006 +1 +-- 0008 } num ASTORE 0007 0005 +-- .... SNAP #2 [`wrap()`|---- pcall|math.fmod|+6 0005] +-- +-- The first snapshot misses the 0003 IR in the last slot to be +-- used in the `fmod()` later, so it leads to the additional +-- 0005 SLOAD #4, and storing it in the second snapshot. +-- +-- The correct snapshot content after the patch is the following: +-- .... SNAP #1 [`wrap()`|---- pcall|`varg()`|0003] +-- .... +-- .... SNAP #2 [`wrap()`|---- pcall|math.fmod|+6 0003] +local function varg(...) + -- Generate snapshot after `pcall()` with missing slot. + -- The snapshot is generated before each TNEW after the commit + -- 7505e78bd6c24cac6e93f5163675021734801b65 ("Handle on-trace + -- OOM errors from helper functions.") + local slot = ({...})[1] + -- Forcify stitch and usage of vararg slot. + return fmod(ARG_ON_RECORDING, slot) +end + +jit.opt.start('hotloop=1') + +local _, result +local function wrap(arg) + -- `pcall()` is needed to emit snapshot to handle on-trace + -- errors. + _, result = pcall(varg, arg) +end +-- Record trace with the 0 result. +wrap(ARG_ON_RECORDING) +wrap(ARG_ON_RECORDING) +-- Record trace with the non-zero result. +wrap(ON_TRACE_VALUE) + +test:ok(result ~= 0, 'use-def analysis for BC_VARG') + +os.exit(test:check() and 0 or 1) -- 2.34.1