Re: [Tarantool-patches] [PATCH luajit] Fix bytecode dump unpatching.

[sergos via Tarantool-patches <tarantool-patches@dev.tarantool.org>]

Hi!

Thanks for the patch!
Just some nits in changelog, LGTM

Sergos

> On 27 Jan 2022, at 14:53, Sergey Kaplun <skaplun@tarantool.org> wrote:
> 
> From: Mike Pall <mike>
> 
> Reported by Christopher Oliver.
> 
> (cherry picked from commit 20ac817a747cf8cab044ae81b09c08d23e34342b)
> 
> When a compiled function with up-recursion RET bytecodes are patched to
> JLOOP bytecode.

If I got it right? 
“RET bytecodes are patched to JLOOP bytecode in a function with up-recursion."

> During dump of those bytecodes they should be unpatched
             ^^^                ^^^^^ remove 2 words

> to the original one.
> It is done by restoring the opcode by subtraction

> the diff between JLOOP and ILOOP bytecodes. That gives the LOOP
> bytecodes instead RET as expected.

The restore was done by the erroneous opcode subtraction, that led to a LOOP
bytecode in place of the RET one.

> This patch fixes the bytecode unpatching via copy the original start
                                                  of             ????
> instruction, that was patched.
> 
> Sergey Kaplun:
> * added the description and the test for the problem
> 
> Part of tarantool/tarantool#6548
> ---
> 
> Branch: https://github.com/tarantool/luajit/tree/skaplun/gh-noticket-wrong-bc-ret
> Tarantool branch: https://github.com/tarantool/tarantool/tree/skaplun/gh-noticket-wrong-bc-ret-full-ci
> Related issue: https://github.com/tarantool/tarantool/issues/6548
> 
> src/lj_bcwrite.c                              |  5 +----
> .../bc-jit-unpatching.test.lua                | 22 +++++++++++++++++++
> 2 files changed, 23 insertions(+), 4 deletions(-)
> create mode 100644 test/tarantool-tests/bc-jit-unpatching.test.lua
> 
> diff --git a/src/lj_bcwrite.c b/src/lj_bcwrite.c
> index 5e05caea..a86d6d00 100644
> --- a/src/lj_bcwrite.c
> +++ b/src/lj_bcwrite.c
> @@ -219,10 +219,7 @@ static char *bcwrite_bytecode(BCWriteCtx *ctx, char *p, GCproto *pt)
> 	q[LJ_ENDIAN_SELECT(0, 3)] = (uint8_t)(op-BC_IFORL+BC_FORL);
>       } else if (op == BC_JFORL || op == BC_JITERL || op == BC_JLOOP) {
> 	BCReg rd = q[LJ_ENDIAN_SELECT(2, 1)] + (q[LJ_ENDIAN_SELECT(3, 0)] << 8);
> -	BCIns ins = traceref(J, rd)->startins;
> -	q[LJ_ENDIAN_SELECT(0, 3)] = (uint8_t)(op-BC_JFORL+BC_FORL);
> -	q[LJ_ENDIAN_SELECT(2, 1)] = bc_c(ins);
> -	q[LJ_ENDIAN_SELECT(3, 0)] = bc_b(ins);
> +	memcpy(q, &traceref(J, rd)->startins, 4);
>       }
>     }
>   }
> diff --git a/test/tarantool-tests/bc-jit-unpatching.test.lua b/test/tarantool-tests/bc-jit-unpatching.test.lua
> new file mode 100644
> index 00000000..9f9cb390
> --- /dev/null
> +++ b/test/tarantool-tests/bc-jit-unpatching.test.lua
> @@ -0,0 +1,22 @@
> +local tap = require('tap')
> +local utils = require('utils')
> +
> +local test = tap.test('bc-jit-unpatching')
> +test:plan(1)
> +
> +-- Function with up-recursion.
> +local function f(n)
> +  return n < 2 and n or f(n - 1) + f(n - 2)
> +end
> +
> +local ret1bc = 'RET1%s*1%s*2'
> +-- Check that this bytecode still persists.
> +assert(utils.hasbc(loadstring(string.dump(f)), ret1bc))
> +
> +-- Compile function to get JLOOP bytecode in recursion.

Do you need any jit.opt.start(‘hotloop=1’) here?

> +f(10)
> +
> +test:ok(utils.hasbc(loadstring(string.dump(f)), ret1bc),
> +        'bytecode unpached correctly')
> +
> +os.exit(test:check() and 0 or 1)
> -- 
> 2.34.1
>