From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from [87.239.111.99] (localhost [127.0.0.1]) by dev.tarantool.org (Postfix) with ESMTP id E18B5508F3B; Wed, 4 Mar 2026 15:41:16 +0300 (MSK) DKIM-Filter: OpenDKIM Filter v2.11.0 dev.tarantool.org E18B5508F3B DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tarantool.org; s=dev; t=1772628077; bh=+x+iZauwoYGSZ5dso4ALCqe/VB2bHhTfF3VofsimFLA=; h=Date:To:Cc:References:In-Reply-To:Subject:List-Id: List-Unsubscribe:List-Archive:List-Post:List-Help:List-Subscribe: From:Reply-To:From; b=SJZl5zBmrRXjaccsOM6GJw1FX3NdwlynVEzhgF3DcizpdUz6XyRYCzBQjtOGuEIHd GPFOF3OILl9KTCj1nFo/yhtTNOVS7MaKNI+i1x+b+xsVy/ltZxjst9SBtlSHIE3ScC XrgkT67UgfbuQUAZlTvAxtlQODRuHnhKCOQi6XGs= Received: from send172.i.mail.ru (send172.i.mail.ru [95.163.59.11]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by dev.tarantool.org (Postfix) with ESMTPS id 195FF508F3B for ; Wed, 4 Mar 2026 15:41:15 +0300 (MSK) DKIM-Filter: OpenDKIM Filter v2.11.0 dev.tarantool.org 195FF508F3B Received: by exim-smtp-558f87dcd7-s52vp with esmtpa (envelope-from ) id 1vxlXO-00000000Tdh-0CiZ; Wed, 04 Mar 2026 15:41:14 +0300 Content-Type: multipart/alternative; boundary="------------03LgShelIvpdKHnuMika0JG5" Message-ID: <4a4ee08a-8f18-4a2e-ac02-5a7f633c0459@tarantool.org> Date: Wed, 4 Mar 2026 15:41:13 +0300 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Content-Language: en-US To: Sergey Kaplun Cc: tarantool-patches@dev.tarantool.org References: <6efe3fc943083c79b3f82b6246f0bd3cfa276d14.1772437706.git.skaplun@tarantool.org> <4ec5bb78-26ca-4d2b-9d6f-d06c13a513c2@tarantool.org> In-Reply-To: X-Mailru-Src: smtp X-4EC0790: 10 X-7564579A: 646B95376F6C166E X-77F55803: 4F1203BC0FB41BD9FE49BA1A5307ACBF1C1BD57BFC988F7EF7F8D7D731B23D2900894C459B0CD1B9811A0AED408E5E55A421357250EF31AD18AE2C67DBC936EE9494317BD3910212EDD16E8EE75FCBE4 X-7FA49CB5: FF5795518A3D127A4AD6D5ED66289B5278DA827A17800CE795530B80AF2ADB7BEA1F7E6F0F101C67BD4B6F7A4D31EC0BCC500DACC3FED6E28638F802B75D45FF8AA50765F7900637AC83A81C8FD4AD23D82A6BABE6F325AC2E85FA5F3EDFCBAA7353EFBB55337566CF7C7957E4725328BA0E72D62D438278B22129699F8C3A3C180066E2C57C9E91389733CBF5DBD5E913377AFFFEAFD269176DF2183F8FC7C091DAD9F922AA71188941B15DA834481FCF19DD082D7633A0EF3E4896CB9E6436389733CBF5DBD5E9D5E8D9A59859A8B6D6FBC3EC642A93BBCC7F00164DA146DA6F5DAA56C3B73B237318B6A418E8EAB8D32BA5DBAC0009BE9E8FC8737B5C2249CB3CB8E9EF962DC476E601842F6C81A12EF20D2F80756B5FB606B96278B59C4276E601842F6C81A127C277FBC8AE2E8BE270C32E94023BD73AA81AA40904B5D99C9F4D5AE37F343AD1F44FA8B9022EA23BBE47FD9DD3FB595F5C1EE8F4F765FC72CEEB2601E22B093A03B725D353964B0B7D0EA88DDEDAC722CA9DD8327EE4930A3850AC1BE2E735BA6625F88748EAEFC4224003CC83647689D4C264860C145E X-C1DE0DAB: 0D63561A33F958A5956470C57769DC125002B1117B3ED69602676A2C95D545315D145BB8EF0DE66B823CB91A9FED034534781492E4B8EEAD003C2D46C52F18F2BDAD6C7F3747799A X-C8649E89: 1C3962B70DF3F0AD73CAD6646DEDE191716CD42B3DD1D34CAB70F9BE574AE9C625B6776AC983F447FC0B9F89525902EE6F57B2FD27647F25E66C117BDB76D6594F32E74DB73B7B0449A929501A91BB3AB09DD2297E19605920F641DDC6BE57CC53B8FBCA47F8CF0EB8341EE9D5BE9A0A80081CA92D19A0B320EE654F0FD4D5CF279A769C81F6D37F8CD93680B12512CF4C41F94D744909CE2512F26BEC029E55448553D2254B8D95CD72808BE417F3B9E0E7457915DAA85F X-D57D3AED: 3ZO7eAau8CL7WIMRKs4sN3D3tLDjz0dLbV79QFUyzQ2Ujvy7cMT6pYYqY16iZVKkSc3dCLJ7zSJH7+u4VD18S7Vl4ZUrpaVfd2+vE6kuoey4m4VkSEu53w8ahmwBjZKM/YPHZyZHvz5uv+WouB9+ObcCpyrx6l7KImUglyhkEat/+ysWwi0gdhEs0JGjl6ggRWTy1haxBpVdbIX1nthFXMZebaIdHP2ghjoIc/363UZI6Kf1ptIMVbwN8XFWZxQUiOOKDbGg9/Q= X-Mailru-Sender: C4F68CFF4024C8867DFDF7C7F25884587CFC82FCFEFF436095D4C5B18C328FC03E75C57F8A996F169E58066177F6FD9C645D15D82EE4B272BD6E4642A116CA93524AA66B5ACBE6721EF430B9A63E2A504198E0F3ECE9B5443453F38A29522196 X-Mras: Ok Subject: Re: [Tarantool-patches] [PATCH luajit 2/3] DUALNUM: Fix narrowing of unary minus. X-BeenThere: tarantool-patches@dev.tarantool.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Tarantool development patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , From: Sergey Bronnikov via Tarantool-patches Reply-To: Sergey Bronnikov Errors-To: tarantool-patches-bounces@dev.tarantool.org Sender: "Tarantool-patches" This is a multi-part message in MIME format. --------------03LgShelIvpdKHnuMika0JG5 Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Hi, Sergey! thanks for the fix! Bug is reproduced without fix (I've used incorrect C flag). LGTM Sergey On 3/4/26 13:34, Sergey Kaplun wrote: > Hi, Sergey! > > Thanks for the review! > See my answers below. > > On 04.03.26, Sergey Bronnikov wrote: >> Hi, Sergey, >> >> thanks for the patch! See my comments. >> >> Sergey >> >> On 3/2/26 10:52, Sergey Kaplun wrote: >>> From: Mike Pall >>> >>> Reported by Sergey Kaplun. >>> >>> (cherry picked from commit b1cd2f83b5d085bb71368b87c91a461be77d4364) >>> >>> `lj_opt_narrow_unm()` in the DUALNUM mode narrows doubles too >>> optimistic, missing 0 check. In that case, the narrowing of 0 is >>> incorrect. This leads to the assertion failure in `rec_check_slots()` >>> for the string obtained from the corresponding number. >>> >>> This patch fixes it by restricting the check of the given TValue. >>> >>> Sergey Kaplun: >>> * added the description and the test for the problem >>> >>> Part of tarantool/tarantool#12134 >>> --- >>> src/lj_opt_narrow.c | 4 +- >>> ...lj-1418-dualnum-narrowing-minus-0.test.lua | 49 +++++++++++++++++++ >>> 2 files changed, 51 insertions(+), 2 deletions(-) >>> create mode 100644 test/tarantool-tests/lj-1418-dualnum-narrowing-minus-0.test.lua >>> >>> diff --git a/src/lj_opt_narrow.c b/src/lj_opt_narrow.c >>> index 6b6f20d3..6e3e9533 100644 >>> --- a/src/lj_opt_narrow.c >>> +++ b/src/lj_opt_narrow.c >>> @@ -553,9 +553,9 @@ TRef lj_opt_narrow_unm(jit_State *J, TRef rc, TValue *vc) >>> rc = conv_str_tonum(J, rc, vc); >>> if (tref_isinteger(rc)) { >>> uint32_t k = (uint32_t)numberVint(vc); >>> - if ((LJ_DUALNUM || k != 0) && k != 0x80000000u) { >>> + if ((tvisint(vc) || k != 0) && k != 0x80000000u) { >>> TRef zero = lj_ir_kint(J, 0); >>> - if (!LJ_DUALNUM) >>> + if (!tvisint(vc)) >>> emitir(IRTGI(IR_NE), rc, zero); >>> return emitir(IRTGI(IR_SUBOV), zero, rc); >>> } >>> diff --git a/test/tarantool-tests/lj-1418-dualnum-narrowing-minus-0.test.lua b/test/tarantool-tests/lj-1418-dualnum-narrowing-minus-0.test.lua >>> new file mode 100644 >>> index 00000000..84f17953 >>> --- /dev/null >>> +++ b/test/tarantool-tests/lj-1418-dualnum-narrowing-minus-0.test.lua >>> @@ -0,0 +1,49 @@ >>> +local tap = require('tap') >>> + >>> +-- This test demonstrates LuaJIT's incorrect narrowing >>> +-- optimization in the DUALNUM mode for 0. >>> +-- Seealsohttps://github.com/LuaJIT/LuaJIT/issues/1418. >>> + >>> +local test = tap.test('lj-1418-dualnum-narrowing-minus-0'):skipcond({ >>> + ['Test requires JIT enabled'] = not jit.status(), >>> +}) >>> + >> cannot reproduce an original bug with reverted fix. >> >> CMake configuration: CFLAGS=-DDUALNUM cmake -S . -B build >> -DCMAKE_BUILD_TYPE=Debug > LuaJIT should be configured like: > | cmake -DLUAJIT_NUMMODE=2 # ... > > > >>> +-- Reset hotcounts. >>> +jit.opt.start('hotloop=1') >>> + >>> +-- Hot trace. >>> +test_non_const_on_trace(2, 3) >>> +-- Record trace, use non zero result value to record. >> s/non zero/non-zero/ > Fixed, branch is force-pushed: > =================================================================== > diff --git a/test/tarantool-tests/lj-1418-dualnum-narrowing-minus-0.test.lua b/test/tarantool-tests/lj-1418-dualnum-narrowing-minus-0.test.lua > index 84f17953..8f4185ef 100644 > --- a/test/tarantool-tests/lj-1418-dualnum-narrowing-minus-0.test.lua > +++ b/test/tarantool-tests/lj-1418-dualnum-narrowing-minus-0.test.lua > @@ -41,7 +41,7 @@ jit.opt.start('hotloop=1') > > -- Hot trace. > test_non_const_on_trace(2, 3) > --- Record trace, use non zero result value to record. > +-- Record trace, use non-zero result value to record. > test_non_const_on_trace(2, 3) > -- Misbehaviour on trace with result zero value. > test:is(test_non_const_on_trace(2, 1), '-0', 'correct non-const value on trace') > =================================================================== > >>> +test_non_const_on_trace(2, 3) >>> +-- Misbehaviour on trace with result zero value. >>> +test:is(test_non_const_on_trace(2, 1), '-0', 'correct non-const value on trace') >>> + >>> +test:done(true) --------------03LgShelIvpdKHnuMika0JG5 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

Hi, Sergey!

thanks for the fix! Bug is reproduced without fix (I've used incorrect C flag).

LGTM

Sergey

On 3/4/26 13:34, Sergey Kaplun wrote:
Hi, Sergey!

Thanks for the review!
See my answers below.

On 04.03.26, Sergey Bronnikov wrote:

Hi, Sergey,

thanks for the patch! See my comments.

Sergey

On 3/2/26 10:52, Sergey Kaplun wrote:

From: Mike Pall <mike>

Reported by Sergey Kaplun.

(cherry picked from commit b1cd2f83b5d085bb71368b87c91a461be77d4364)

`lj_opt_narrow_unm()` in the DUALNUM mode narrows doubles too
optimistic, missing 0 check. In that case, the narrowing of 0 is
incorrect. This leads to the assertion failure in `rec_check_slots()`
for the string obtained from the corresponding number.

This patch fixes it by restricting the check of the given TValue.

Sergey Kaplun:
* added the description and the test for the problem

Part of tarantool/tarantool#12134
---
  src/lj_opt_narrow.c                           |  4 +-
  ...lj-1418-dualnum-narrowing-minus-0.test.lua | 49 +++++++++++++++++++
  2 files changed, 51 insertions(+), 2 deletions(-)
  create mode 100644 test/tarantool-tests/lj-1418-dualnum-narrowing-minus-0.test.lua

diff --git a/src/lj_opt_narrow.c b/src/lj_opt_narrow.c
index 6b6f20d3..6e3e9533 100644
--- a/src/lj_opt_narrow.c
+++ b/src/lj_opt_narrow.c
@@ -553,9 +553,9 @@ TRef lj_opt_narrow_unm(jit_State *J, TRef rc, TValue *vc)
    rc = conv_str_tonum(J, rc, vc);
    if (tref_isinteger(rc)) {
      uint32_t k = (uint32_t)numberVint(vc);
-    if ((LJ_DUALNUM || k != 0) && k != 0x80000000u) {
+    if ((tvisint(vc) || k != 0) && k != 0x80000000u) {
        TRef zero = lj_ir_kint(J, 0);
-      if (!LJ_DUALNUM)
+      if (!tvisint(vc))
  	emitir(IRTGI(IR_NE), rc, zero);
        return emitir(IRTGI(IR_SUBOV), zero, rc);
      }
diff --git a/test/tarantool-tests/lj-1418-dualnum-narrowing-minus-0.test.lua b/test/tarantool-tests/lj-1418-dualnum-narrowing-minus-0.test.lua
new file mode 100644
index 00000000..84f17953
--- /dev/null
+++ b/test/tarantool-tests/lj-1418-dualnum-narrowing-minus-0.test.lua
@@ -0,0 +1,49 @@
+local tap = require('tap')
+
+-- This test demonstrates LuaJIT's incorrect narrowing
+-- optimization in the DUALNUM mode for 0.
+-- See alsohttps://github.com/LuaJIT/LuaJIT/issues/1418.
+
+local test = tap.test('lj-1418-dualnum-narrowing-minus-0'):skipcond({
+  ['Test requires JIT enabled'] = not jit.status(),
+})
+

cannot reproduce an original bug with reverted fix.

CMake configuration: CFLAGS=-DDUALNUM cmake -S . -B build 
-DCMAKE_BUILD_TYPE=Debug

LuaJIT should be configured like:
| cmake -DLUAJIT_NUMMODE=2 # ...

<snipped>


+-- Reset hotcounts.
+jit.opt.start('hotloop=1')
+
+-- Hot trace.
+test_non_const_on_trace(2, 3)
+-- Record trace, use non zero result value to record.

s/non zero/non-zero/

Fixed, branch is force-pushed:
===================================================================
diff --git a/test/tarantool-tests/lj-1418-dualnum-narrowing-minus-0.test.lua b/test/tarantool-tests/lj-1418-dualnum-narrowing-minus-0.test.lua
index 84f17953..8f4185ef 100644
--- a/test/tarantool-tests/lj-1418-dualnum-narrowing-minus-0.test.lua
+++ b/test/tarantool-tests/lj-1418-dualnum-narrowing-minus-0.test.lua
@@ -41,7 +41,7 @@ jit.opt.start('hotloop=1')
 
 -- Hot trace.
 test_non_const_on_trace(2, 3)
--- Record trace, use non zero result value to record.
+-- Record trace, use non-zero result value to record.
 test_non_const_on_trace(2, 3)
 -- Misbehaviour on trace with result zero value.
 test:is(test_non_const_on_trace(2, 1), '-0', 'correct non-const value on trace')
===================================================================


+test_non_const_on_trace(2, 3)
+-- Misbehaviour on trace with result zero value.
+test:is(test_non_const_on_trace(2, 1), '-0', 'correct non-const value on trace')
+
+test:done(true)


    

  
  


--------------03LgShelIvpdKHnuMika0JG5--