From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from [87.239.111.99] (localhost [127.0.0.1]) by dev.tarantool.org (Postfix) with ESMTP id 1CAE3192AC54; Mon, 2 Mar 2026 10:53:09 +0300 (MSK) DKIM-Filter: OpenDKIM Filter v2.11.0 dev.tarantool.org 1CAE3192AC54 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tarantool.org; s=dev; t=1772437989; bh=6p/aO3WDCKoJ0ydAJI1lue2mzbXjtSyDWK7muYVF9HE=; h=To:Date:In-Reply-To:References:Subject:List-Id:List-Unsubscribe: List-Archive:List-Post:List-Help:List-Subscribe:From:Reply-To:Cc: From; b=ZZlGtz0MES1FfdbJX0bqWJLZYl56vwfB1dAr44xfpucvPi0mAnlQH7qAJxY4U6f+E H4zIhC5KuENvlbdt6Sw0dLXXzX4mxF+/K/9FWMReew8P0HG8AKn3GAoNk3LsPteQ2A 5W0Y52h5OokTUaWBqcz4WP5ORdlwyo1pX2lUgDeg= Received: from send83.i.mail.ru (send83.i.mail.ru [89.221.237.178]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by dev.tarantool.org (Postfix) with ESMTPS id 0531619CDE82 for ; Mon, 2 Mar 2026 10:52:08 +0300 (MSK) DKIM-Filter: OpenDKIM Filter v2.11.0 dev.tarantool.org 0531619CDE82 Received: by exim-smtp-558f87dcd7-fq4lx with esmtpa (envelope-from ) id 1vwy4U-00000000798-433y; Mon, 02 Mar 2026 10:52:07 +0300 To: Sergey Bronnikov Date: Mon, 2 Mar 2026 10:52:53 +0300 Message-ID: <6efe3fc943083c79b3f82b6246f0bd3cfa276d14.1772437706.git.skaplun@tarantool.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Mailru-Src: smtp X-4EC0790: 10 X-7564579A: 646B95376F6C166E X-77F55803: 4F1203BC0FB41BD9FE49BA1A5307ACBFCC0695675F3828E36510F95DCD758A2D00894C459B0CD1B93F76102994D39CFE91417EB218679B82DD9362231A9686AA955C1C3E78DE33ACDAEE934B56E2D9F8 X-7FA49CB5: FF5795518A3D127A4AD6D5ED66289B5278DA827A17800CE7BA0D57D3459E5640EA1F7E6F0F101C67BD4B6F7A4D31EC0BCC500DACC3FED6E28638F802B75D45FF8AA50765F7900637AC83A81C8FD4AD23D82A6BABE6F325AC2E85FA5F3EDFCBAA7353EFBB55337566487A753D4C0E5B9C9F0D1D98C7CFC277BC5C5C503F68D68198DC52BDCC243D0E389733CBF5DBD5E913377AFFFEAFD269176DF2183F8FC7C058C1844A7A85E7B68941B15DA834481FCF19DD082D7633A0EF3E4896CB9E6436389733CBF5DBD5E9D5E8D9A59859A8B6B737A621A50BC793CC7F00164DA146DA6F5DAA56C3B73B237318B6A418E8EAB8D32BA5DBAC0009BE9E8FC8737B5C22490702810101FBF55176E601842F6C81A12EF20D2F80756B5FB606B96278B59C4276E601842F6C81A127C277FBC8AE2E8B3D00E8C71C4718F53AA81AA40904B5D99C9F4D5AE37F343AD1F44FA8B9022EA23BBE47FD9DD3FB595F5C1EE8F4F765FC72CEEB2601E22B093A03B725D353964B0B7D0EA88DDEDAC722CA9DD8327EE4930A3850AC1BE2E7358734EF69C36C4A4DC4224003CC83647689D4C264860C145E X-C1DE0DAB: 0D63561A33F958A5ADD90033CC94EB155002B1117B3ED696788FF5403D266CB1715D9AB585B0EB04823CB91A9FED034534781492E4B8EEAD003C2D46C52F18F2C79554A2A72441328621D336A7BC284946AD531847A6065A535571D14F44ED41 X-C8649E89: 1C3962B70DF3F0AD73CAD6646DEDE191716CD42B3DD1D34CAB70F9BE574AE9C625B6776AC983F447FC0B9F89525902EE6F57B2FD27647F25E66C117BDB76D659195BFBB6092AC49B75397EFD44A71FAF15D34EDC329D4DAE97E1744728C5884423DDA3FA3AFEF96EB8341EE9D5BE9A0AB7F13D18EA96A7C904A95AB9D17039A363429AEE770880426536EB022892E5344C41F94D744909CECFA6C6B0C050A61A8CAF69B82BA93681CD72808BE417F3B9E0E7457915DAA85F X-D57D3AED: 3ZO7eAau8CL7WIMRKs4sN3D3tLDjz0dLbV79QFUyzQ2Ujvy7cMT6pYYqY16iZVKkSc3dCLJ7zSJH7+u4VD18S7Vl4ZUrpaVfd2+vE6kuoey4m4VkSEu53w8ahmwBjZKM/YPHZyZHvz5uv+WouB9+ObcCpyrx6l7KImUglyhkEat/+ysWwi0gdhEs0JGjl6ggRWTy1haxBpVdbIX1nthFXMZebaIdHP2ghjoIc/363UZI6Kf1ptIMVbwN8XFWZxQUzXq2u47BPac= X-Mailru-Sender: 583F1D7ACE8F49BDD951BA70C165859E4317413AC34EB10C0D8E165B5AC4796CB057EEB03915C5FC0615CD6DD314C17DF2400F607609286E924004A7DEC283833C7120B22964430C52B393F8C72A41A84198E0F3ECE9B5443453F38A29522196 X-Mras: Ok Subject: [Tarantool-patches] [PATCH luajit 2/3] DUALNUM: Fix narrowing of unary minus. X-BeenThere: tarantool-patches@dev.tarantool.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Tarantool development patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , From: Sergey Kaplun via Tarantool-patches Reply-To: Sergey Kaplun Cc: tarantool-patches@dev.tarantool.org Errors-To: tarantool-patches-bounces@dev.tarantool.org Sender: "Tarantool-patches" From: Mike Pall Reported by Sergey Kaplun. (cherry picked from commit b1cd2f83b5d085bb71368b87c91a461be77d4364) `lj_opt_narrow_unm()` in the DUALNUM mode narrows doubles too optimistic, missing 0 check. In that case, the narrowing of 0 is incorrect. This leads to the assertion failure in `rec_check_slots()` for the string obtained from the corresponding number. This patch fixes it by restricting the check of the given TValue. Sergey Kaplun: * added the description and the test for the problem Part of tarantool/tarantool#12134 --- src/lj_opt_narrow.c | 4 +- ...lj-1418-dualnum-narrowing-minus-0.test.lua | 49 +++++++++++++++++++ 2 files changed, 51 insertions(+), 2 deletions(-) create mode 100644 test/tarantool-tests/lj-1418-dualnum-narrowing-minus-0.test.lua diff --git a/src/lj_opt_narrow.c b/src/lj_opt_narrow.c index 6b6f20d3..6e3e9533 100644 --- a/src/lj_opt_narrow.c +++ b/src/lj_opt_narrow.c @@ -553,9 +553,9 @@ TRef lj_opt_narrow_unm(jit_State *J, TRef rc, TValue *vc) rc = conv_str_tonum(J, rc, vc); if (tref_isinteger(rc)) { uint32_t k = (uint32_t)numberVint(vc); - if ((LJ_DUALNUM || k != 0) && k != 0x80000000u) { + if ((tvisint(vc) || k != 0) && k != 0x80000000u) { TRef zero = lj_ir_kint(J, 0); - if (!LJ_DUALNUM) + if (!tvisint(vc)) emitir(IRTGI(IR_NE), rc, zero); return emitir(IRTGI(IR_SUBOV), zero, rc); } diff --git a/test/tarantool-tests/lj-1418-dualnum-narrowing-minus-0.test.lua b/test/tarantool-tests/lj-1418-dualnum-narrowing-minus-0.test.lua new file mode 100644 index 00000000..84f17953 --- /dev/null +++ b/test/tarantool-tests/lj-1418-dualnum-narrowing-minus-0.test.lua @@ -0,0 +1,49 @@ +local tap = require('tap') + +-- This test demonstrates LuaJIT's incorrect narrowing +-- optimization in the DUALNUM mode for 0. +-- See also https://github.com/LuaJIT/LuaJIT/issues/1418. + +local test = tap.test('lj-1418-dualnum-narrowing-minus-0'):skipcond({ + ['Test requires JIT enabled'] = not jit.status(), +}) + +test:plan(2) + +local tostring = tostring + +local function test_const_on_trace(x) + local zero = x % 1 + local mzero = -zero + -- Bad IR slot with enabled optimizations. + local res = tostring(mzero) + return res +end + +local function test_non_const_on_trace(a, b) + local mb_zero = a % b + -- Too optimistic optimization without check for the 0 corner + -- case. + local mb_mzero = -mb_zero + local res = tostring(mb_mzero) + return res +end + +jit.opt.start('hotloop=1') + +-- Hot trace. +test_const_on_trace(1) +-- Compile trace. +test:is(test_const_on_trace(1), '-0', 'correct const value on trace') + +-- Reset hotcounts. +jit.opt.start('hotloop=1') + +-- Hot trace. +test_non_const_on_trace(2, 3) +-- Record trace, use non zero result value to record. +test_non_const_on_trace(2, 3) +-- Misbehaviour on trace with result zero value. +test:is(test_non_const_on_trace(2, 1), '-0', 'correct non-const value on trace') + +test:done(true) -- 2.53.0