Hi!
Thanks for the patch, it is LGTM.
Sergos
The new commit message is the following:| x86/x64: Fix loop realignment.|| (cherry picked from commit 522d2073da4be2af79db4728cbb375db0fbdfc48)|| `asm_intarith()` function may try to drop `test r, r` (where `r` is an| allocated register) instruction before the Jcc instruction. However, in| cases when Jcc instruction is "Jump short if ..." instruction (i.e. has| no 0F opcode prefix like "Jump near if ..."), the `test` instruction is| dropped when it shouldn't be, due to usage for the comparison the next| byte after instruction itself. As the result, the loop can't be| realigned later in `asm_loop_fixup` due to target to jump being| misaligned and the assertion fails.|| This patch adds the additional check for the 0F opcode in| `asm_intarith()`.|| Sergey Kaplun:| * added the description and the test for the problem|| Part of tarantool/tarantool#8069Branch is force pushed.---
src/lj_asm_x86.h | 5 +++--
.../lj-556-fix-loop-realignment.test.lua | 18 ++++++++++++++++++
2 files changed, 21 insertions(+), 2 deletions(-)
create mode 100644 test/tarantool-tests/lj-556-fix-loop-realignment.test.lua
diff --git a/src/lj_asm_x86.h b/src/lj_asm_x86.h
index 8efda8e5..e6c42c6d 100644
--- a/src/lj_asm_x86.h
+++ b/src/lj_asm_x86.h
@@ -2068,8 +2068,9 @@ static void asm_intarith(ASMState *as, IRIns *ir, x86Arith xa)
int32_t k = 0;
if (as->flagmcp == as->mcp) { /* Drop test r,r instruction. */
MCode *p = as->mcp + ((LJ_64 && *as->mcp < XI_TESTb) ? 3 : 2);
- if ((p[1] & 15) < 14) {
- if ((p[1] & 15) >= 12) p[1] -= 4; /* L <->S, NL <-> NS */
+ MCode *q = p[0] == 0x0f ? p+1 : p;
+ if ((*q & 15) < 14) {
+ if ((*q & 15) >= 12) *q -= 4; /* L <->S, NL <-> NS */
as->flagmcp = NULL;
as->mcp = p;
} /* else: cannot transform LE/NLE to cc without use of OF. */
diff --git a/test/tarantool-tests/lj-556-fix-loop-realignment.test.lua b/test/tarantool-tests/lj-556-fix-loop-realignment.test.lua
new file mode 100644
index 00000000..9a8e6098
--- /dev/null
+++ b/test/tarantool-tests/lj-556-fix-loop-realignment.test.lua
@@ -0,0 +1,18 @@
+local tap = require('tap')
+
+local test = tap.test('lj-505-fold-icorrect-behavior')
+test:plan(1)
+
+-- Test file to demonstrate JIT misbehaviour for loop realignment
+-- in LUAJIT_NUMMODE=2. See also
+-- https://github.com/LuaJIT/LuaJIT/issues/556 .
+
+jit.opt.start('hotloop=1')
+
+local s = 4
+while s > 0 do
+ s = s - 1
+end
+
+test:ok(true, 'loop is compiled and ran successfully')
+os.exit(test:check() and 0 or 1)
--
The test works just fine with HEAD on
f7d61d96 ci: introduce workflow for exotic builds.
Tested configurations:
LJ_64: True, LJ_GC64: True, LJ_DUALNUM: True
LJ_64: True, LJ_GC64: False, LJ_DUALNUM: True
It's strange...I use the following build command:| $ cmake . -DCMAKE_BUILD_TYPE=Debug -DLUA_USE_APICHECK=ON -DLUA_USE_ASSERT=ON -DLUAJIT_ENABLE_GC64=OFF -DLUAJIT_NUMMODE=2 && make -jand get the following assertion:| asm_loop_fixup: Assertion `((intptr_t)target & 15) == 0' failed.What command do you use to build LuaJIT?--
Best regards,
Maxim Kokryashkin
-- Best regards,Sergey Kaplun