From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from [87.239.111.99] (localhost [127.0.0.1]) by dev.tarantool.org (Postfix) with ESMTP id 7F504437874; Thu, 12 Mar 2026 18:55:36 +0300 (MSK) DKIM-Filter: OpenDKIM Filter v2.11.0 dev.tarantool.org 7F504437874 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tarantool.org; s=dev; t=1773330936; bh=UrJX2ZMbKf0uqdVxdJiPgO1SizAZJ45cT0yJCnRE7sE=; h=To:Date:In-Reply-To:References:Subject:List-Id:List-Unsubscribe: List-Archive:List-Post:List-Help:List-Subscribe:From:Reply-To:Cc: From; b=c61tql2tvGX15qngMvbk/knqvtanxC1qibYYK4c+2/P49qL0KTK1p/WbYYiECWqTZ RWz58nAma5iwT5MnAoNEb2R4F+QO142VzGtd/gdbs5oL7hP5wJPik9Dzi1a7dfygL7 2MVPj9mp1N7F0wAGMYy13siNoEwHF+ratGWF6ls8= Received: from send59.i.mail.ru (send59.i.mail.ru [89.221.237.154]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by dev.tarantool.org (Postfix) with ESMTPS id 5AB90437874 for ; Thu, 12 Mar 2026 18:55:05 +0300 (MSK) DKIM-Filter: OpenDKIM Filter v2.11.0 dev.tarantool.org 5AB90437874 Received: by exim-smtp-64cdfc6c8d-cbnzz with esmtpa (envelope-from ) id 1w0iNM-00000000Eh8-1dLQ; Thu, 12 Mar 2026 18:55:04 +0300 To: Sergey Bronnikov Date: Thu, 12 Mar 2026 18:55:56 +0300 Message-ID: <334e8dd174e6f4c9a03b3a5827c36d5353a85238.1773330679.git.skaplun@tarantool.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Mailru-Src: smtp X-4EC0790: 10 X-7564579A: B8F34718100C35BD X-77F55803: 4F1203BC0FB41BD91ABAE9865AC7DC88FC8E858B59FB0AE6643494CB4AC6A528182A05F53808504059EDCDAEDDAF17C53DE06ABAFEAF6705F0306AA480D24DDA4BFFDBE4B98C594A60A5641D7A8B2059 X-7FA49CB5: FF5795518A3D127A4AD6D5ED66289B5278DA827A17800CE7D3E352D4AD7EBF54EA1F7E6F0F101C67BD4B6F7A4D31EC0BCC500DACC3FED6E28638F802B75D45FF8AA50765F7900637AC83A81C8FD4AD23D82A6BABE6F325AC2E85FA5F3EDFCBAA7353EFBB5533756627194F95AE6E7C2DD373A628AAFA5F4BEAF84827A52559EAAE205305BDB2B0A8389733CBF5DBD5E913377AFFFEAFD269176DF2183F8FC7C05A64D9A1E9CA65708941B15DA834481FCF19DD082D7633A0EF3E4896CB9E6436389733CBF5DBD5E9D5E8D9A59859A8B6F459A8243F1D1D44CC7F00164DA146DA6F5DAA56C3B73B237318B6A418E8EAB8D32BA5DBAC0009BE9E8FC8737B5C2249E4C83BE986F2B39D76E601842F6C81A12EF20D2F80756B5FB606B96278B59C4276E601842F6C81A127C277FBC8AE2E8BB4A02512E8976AF43AA81AA40904B5D99C9F4D5AE37F343AD1F44FA8B9022EA23BBE47FD9DD3FB595F5C1EE8F4F765FC72CEEB2601E22B093A03B725D353964B0B7D0EA88DDEDAC722CA9DD8327EE4930A3850AC1BE2E735D2D576BCF940C736C4224003CC83647689D4C264860C145E X-C1DE0DAB: 0D63561A33F958A5E1CA997589A0C3D85002B1117B3ED69684015EF4C2BE122FB74D9144D44E4FCF823CB91A9FED034534781492E4B8EEAD81B3E0F64AD3EF57C79554A2A72441328621D336A7BC284946AD531847A6065A17B107DEF921CE79BDAD6C7F3747799A X-C8649E89: 1C3962B70DF3F0AD73CAD6646DEDE191716CD42B3DD1D34CAB70F9BE574AE9C625B6776AC983F447FC0B9F89525902EE6F57B2FD27647F25E66C117BDB76D659EDBBEF0819E2ADB3BA4F8533CAB2990422407CE3FD10D2810C310CA603259DB2420CE0198838F58BB8341EE9D5BE9A0AC6EEDEA866D5C92E6CD7BC1D24C42D45FCB1347D4DD79B346536EB022892E5344C41F94D744909CECFA6C6B0C050A61A8CAF69B82BA93681CD72808BE417F3B9E0E7457915DAA85F X-D57D3AED: 3ZO7eAau8CL7WIMRKs4sN3D3tLDjz0dLbV79QFUyzQ2Ujvy7cMT6pYYqY16iZVKkSc3dCLJ7zSJH7+u4VD18S7Vl4ZUrpaVfd2+vE6kuoey4m4VkSEu53w8ahmwBjZKM/YPHZyZHvz5uv+WouB9+ObcCpyrx6l7KImUglyhkEat/+ysWwi0gdhEs0JGjl6ggRWTy1haxBpVdbIX1nthFXMZebaIdHP2ghjoIc/363UZI6Kf1ptIMVdbVVJCphTR/00xPKmxn7Jw= X-Mailru-Sender: 583F1D7ACE8F49BDD951BA70C165859E46DE9E99F290A01B08AF9BFB128101EEAE4A3BD0E36408D961B7DBDA62385F35F2400F607609286E924004A7DEC283833C7120B22964430C52B393F8C72A41A84198E0F3ECE9B5443453F38A29522196 X-Mras: Ok Subject: [Tarantool-patches] [PATCH luajit 1/2] Prevent recording of loops with -0 step or NaN values. X-BeenThere: tarantool-patches@dev.tarantool.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Tarantool development patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , From: Sergey Kaplun via Tarantool-patches Reply-To: Sergey Kaplun Cc: tarantool-patches@dev.tarantool.org Errors-To: tarantool-patches-bounces@dev.tarantool.org Sender: "Tarantool-patches" From: Mike Pall Thanks to Sergey Kaplun. (cherry picked from commit 54cce2e1719a15fc33e40c57dbc3d62e9c104b03) The -0 step and NaN control variable values may lead to the traces with always failed guards. This patch forbids recording of such traces since these traces are not very useful. Unfortunately, this breaks for loop recording in DUALNUM mode. This will be fixed in the next commit. Sergey Kaplun: * added the description and the test for the problem Part of tarantool/tarantool#12134 --- src/lj_record.c | 6 ++ .../lj-1432-minus-zero-step.test.lua | 57 +++++++++++++ .../lj-1433-nan-for-control-var.test.lua | 79 +++++++++++++++++++ 3 files changed, 142 insertions(+) create mode 100644 test/tarantool-tests/lj-1432-minus-zero-step.test.lua create mode 100644 test/tarantool-tests/lj-1433-nan-for-control-var.test.lua diff --git a/src/lj_record.c b/src/lj_record.c index 81da43f5..a3a68b57 100644 --- a/src/lj_record.c +++ b/src/lj_record.c @@ -509,6 +509,12 @@ static LoopEvent rec_for(jit_State *J, const BCIns *fori, int isforl) LoopEvent ev; TRef stop; IRType t; + /* Avoid semantic mismatches and always failing guards. */ + if (tvisnan(&tv[FORL_IDX]) || + tvisnan(&tv[FORL_STOP]) || + tvisnan(&tv[FORL_STEP]) || + tvismzero(&tv[FORL_STEP])) + lj_trace_err(J, LJ_TRERR_GFAIL); if (isforl) { /* Handle FORL/JFORL opcodes. */ TRef idx = tr[FORL_IDX]; if (mref(J->scev.pc, const BCIns) == fori && tref_ref(idx) == J->scev.idx) { diff --git a/test/tarantool-tests/lj-1432-minus-zero-step.test.lua b/test/tarantool-tests/lj-1432-minus-zero-step.test.lua new file mode 100644 index 00000000..112153dc --- /dev/null +++ b/test/tarantool-tests/lj-1432-minus-zero-step.test.lua @@ -0,0 +1,57 @@ +local tap = require('tap') + +-- Test file to check the correct recording of -0 step for value. +-- See also https://github.com/LuaJIT/LuaJIT/issues/1432. + +local test = tap.test('lj-1432-minus-zero-step'):skipcond({ + ['Test requires JIT enabled'] = not jit.status(), +}) + +test:plan(2) + +local traceinfo = require('jit.util').traceinfo + +local function trace_slot() + local counter = 0 + local slot = -0 + -- Run the inner trace several times. Before the patch, it leads + -- to several child traces due to the always failed guards. + while true do + if counter > 5 then break end + counter = counter + 1; + -- luacheck: ignore + for _ = 1, 1, slot do + break + end + end +end + +local function trace_const() + local counter = 0 + -- Run the inner trace several times. Before the patch, it leads + -- to several child traces due to the always failed guards. + while true do + if counter > 5 then break end + counter = counter + 1; + -- luacheck: ignore + for _ = 1, 1, -0 do + break + end + end +end + +local function test_trace_recorded(test_payload) + jit.flush() + -- Reset hotcounters. + jit.opt.start('hotloop=1', 'hotexit=1') + test_payload() + return traceinfo(1) +end + +-- The -0 step leads to the always failed guard, so such traces +-- are now aborted and not recorded. + +test:ok(not test_trace_recorded(trace_slot), 'no trace recorded -0 as slot') +test:ok(not test_trace_recorded(trace_const), 'no trace recorded -0 as const') + +test:done(true) diff --git a/test/tarantool-tests/lj-1433-nan-for-control-var.test.lua b/test/tarantool-tests/lj-1433-nan-for-control-var.test.lua new file mode 100644 index 00000000..1f67f0ad --- /dev/null +++ b/test/tarantool-tests/lj-1433-nan-for-control-var.test.lua @@ -0,0 +1,79 @@ +local tap = require('tap') + +-- Test file to check the correct recording of for control +-- variable with NaN value. +-- See also https://github.com/LuaJIT/LuaJIT/issues/1433. + +local test = tap.test('lj-1433-nan-for-control-var'):skipcond({ + ['Test requires JIT enabled'] = not jit.status(), +}) + +test:plan(3) + +local traceinfo = require('jit.util').traceinfo + +local function trace_nan_start() + local counter = 0 + -- XXX: Use NaN as stack slot, not upvalue. + local nan = 0 / 0 + -- Run the inner trace several times. Before the patch, it leads + -- to the trace with always fail guard. + while true do + if counter > 5 then break end + counter = counter + 1; + -- luacheck: ignore + for _ = nan, 1, 1 do + break + end + end +end + +local function trace_nan_stop() + local counter = 0 + -- XXX: Use NaN as stack slot, not upvalue. + local nan = 0 / 0 + -- Run the inner trace several times. Before the patch, it leads + -- to the trace with always fail guard. + while true do + if counter > 5 then break end + counter = counter + 1; + -- luacheck: ignore + for _ = 1, nan, 1 do + break + end + end +end + +local function trace_nan_step() + local counter = 0 + -- XXX: Use NaN as stack slot, not upvalue. + local nan = 0 / 0 + -- Run the inner trace several times. Before the patch, it leads + -- to several child traces due to the always failed guards. + while true do + if counter > 5 then break end + counter = counter + 1; + -- luacheck: ignore + for _ = 1, 1, nan do + break + end + end +end + +local function test_trace_recorded(test_payload) + jit.flush() + -- Reset hotcounters. + jit.opt.start('hotloop=1', 'hotexit=1') + test_payload() + return traceinfo(1) +end + +-- The NaN control vars leads to the always failed guard, so such +-- traces are now aborted and not recorded. + +test:ok(not test_trace_recorded(trace_nan_start), 'no trace recorded NaN start') +test:ok(not test_trace_recorded(trace_nan_stop), 'no trace recorded NaN stop') +test:ok(not test_trace_recorded(trace_nan_step), 'no trace recorded NaN step') + +test:done(true) + -- 2.53.0