From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from [87.239.111.99] (localhost [127.0.0.1]) by dev.tarantool.org (Postfix) with ESMTP id 9B66417BB61; Wed, 14 Dec 2022 14:35:29 +0300 (MSK) DKIM-Filter: OpenDKIM Filter v2.11.0 dev.tarantool.org 9B66417BB61 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tarantool.org; s=dev; t=1671017729; bh=6eR3SqUNzpxBIl/FFPSuOl1IXdGeQBcnYEGsPxf6l1U=; h=In-Reply-To:Date:References:To:Subject:List-Id:List-Unsubscribe: List-Archive:List-Post:List-Help:List-Subscribe:From:Reply-To:Cc: From; b=bmb54LoQtag00RPWTzCG2Hs3t6Je+9rJzT66D6PYxtnRgEGie//9yBUmoQw4l7DNN 8zYOiHfLWRD6cZFOEAdzqlZhxWlOjGbqjpTxtjERgn5MAqeb8n3sEw3owCU9Yaq2UB 1T/dz0YbNrBB64fX3VVC89j2QCIdmq7yI8aLENXE= Received: from smtp61.i.mail.ru (smtp61.i.mail.ru [217.69.128.41]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dev.tarantool.org (Postfix) with ESMTPS id 090C013A941 for ; Wed, 14 Dec 2022 14:35:28 +0300 (MSK) DKIM-Filter: OpenDKIM Filter v2.11.0 dev.tarantool.org 090C013A941 Received: by smtp61.i.mail.ru with esmtpa (envelope-from ) id 1p5Q2p-0004mN-0R; Wed, 14 Dec 2022 14:35:27 +0300 Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3731.300.101.1.3\)) In-Reply-To: <20221208054618.9104-1-skaplun@tarantool.org> Date: Wed, 14 Dec 2022 14:33:51 +0300 Content-Transfer-Encoding: quoted-printable Message-Id: References: <20221208054618.9104-1-skaplun@tarantool.org> To: Sergey Kaplun X-Mailer: Apple Mail (2.3731.300.101.1.3) X-Mailru-Src: smtp X-4EC0790: 10 X-7564579A: B8F34718100C35BD X-77F55803: 4F1203BC0FB41BD90D1502B3BE350FE460E08CDB322628C398144F1A0CCA906500894C459B0CD1B9FC9EF83A8ACBEBE503FD4A45932A16ED15AB5F8EBD3E6B5A9ED8A54F4CD43B96 X-7FA49CB5: FF5795518A3D127A4AD6D5ED66289B5278DA827A17800CE76D34FAA3D8B31588C2099A533E45F2D0395957E7521B51C2CFCAF695D4D8E9FCEA1F7E6F0F101C6778DA827A17800CE7E30B1A6D2A18B481EA1F7E6F0F101C6723150C8DA25C47586E58E00D9D99D84E1BDDB23E98D2D38B6F1F7B995052D5CE8F9268A7C21E6B96A988D195F62749EDCC7F00164DA146DAFE8445B8C89999728AA50765F79006370B730A9793D99025389733CBF5DBD5E9C8A9BA7A39EFB766F5D81C698A659EA7CC7F00164DA146DA9985D098DBDEAEC8643FE6A0CAC512C7F6B57BC7E6449061A352F6E88A58FB86F5D81C698A659EA73AA81AA40904B5D9A18204E546F3947C64E7220B7C550592040F9FF01DFDA4A84AD6D5ED66289B52698AB9A7B718F8C46E0066C2D8992A16725E5C173C3A84C3D1CB9C1829AC0833BA3038C0950A5D36B5C8C57E37DE458B330BD67F2E7D9AF16D1867E19FE14079C09775C1D3CA48CF3D321E7403792E342EB15956EA79C166A417C69337E82CC275ECD9A6C639B01B78DA827A17800CE798228CBAD4AC77F6731C566533BA786AA5CC5B56E945C8DA X-C8649E89: 4E36BF7865823D7055A7F0CF078B5EC49A30900B95165D34103A2CD2CFC42C67B527144F96A911556ECD9E016E56EFA8F4F08FE80D1F9ED5D2877084657861591D7E09C32AA3244C2A365483A8708C0C2C652DD849186818A95CA90A1D8AC565FACE5A9C96DEB163 X-D57D3AED: 3ZO7eAau8CL7WIMRKs4sN3D3tLDjz0dLbV79QFUyzQ2Ujvy7cMT6pYYqY16iZVKkSc3dCLJ7zSJH7+u4VD18S7Vl4ZUrpaVfd2+vE6kuoey4m4VkSEu530nj6fImhcD4MUrOEAnl0W826KZ9Q+tr5ycPtXkTV4k65bRjmOUUP8cvGozZ33TWg5HZplvhhXbhDGzqmQDTd6OAevLeAnq3Ra9uf7zvY2zzsIhlcp/Y7m53TZgf2aB4JOg4gkr2bioja/mV86HvUK9f3AZnRL6D9A== X-Mailru-Sender: 5AA3D5B9D8C486464BD4402E82A444E3C70255CC4D4CDE802307F3EC073CF8C58564D608E3D9F2BB19381EE24192DF5555834048F03EF5D4C9A814A92B2E3B1BA4250FC3964EA4964198E0F3ECE9B5443453F38A29522196 X-Mras: Ok Subject: Re: [Tarantool-patches] [PATCH luajit] LJ_GC64: Fix ir_khash for non-string GCobj. X-BeenThere: tarantool-patches@dev.tarantool.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Tarantool development patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , From: sergos via Tarantool-patches Reply-To: sergos Cc: tarantool-patches@dev.tarantool.org Errors-To: tarantool-patches-bounces@dev.tarantool.org Sender: "Tarantool-patches" Hi! Thanks for the patch! Some addition to Max=E2=80=99s comments. And a question on the test. Sergos > On 8 Dec 2022, at 08:46, Sergey Kaplun wrote: >=20 > From: Mike Pall >=20 > Contributed by Peter Cawley. >=20 > (cherry picked from commit b4ed3219a1a98dd9fe7d1e3eeea3b82f5a780948) >=20 > When emitting `IR_HREF` for constant value to lookup the `ir_khash()` an ^^^=20 perhaps just =E2=80=98for a constant value = lokup=E2=80=99? > function is used to calculate hash for the corresponding object. > This calculation must be the same as in the corresponding `hashkey()` > function from . >=20 > Hash calculating via passing two arguments `lo`, and `hi` to = `hashrot()` the > routine. For non-string GC objects the first `lo` argument is the same > for GC64 and not GC64 mode -- lower 32 bits of the object address. For > GC64 mode `hi` argument is upper 32 bits of the object address, > including specific type NaN-tag. This `hi` argument in `ir_khash()` a > function is miscalculated in GC64 using non-GC64 value (`lo` + mode a > `HASH_BIAS`). As a result, the hash for the GC object is miscalculated > on trace and we exit from trace due to assertion guard on the type or the an > value check. >=20 > This patch fixes calculation of hash value on trace for GC64 mode by > making it consistent with `hashkey()`. the >=20 > Sergey Kaplun: > * added the description and the test for the problem >=20 > Part of tarantool/tarantool#7230 > --- >=20 > Branch: = https://github.com/tarantool/luajit/tree/skaplun/lj-356-ir-khash-non-strin= g-obj-full-ci > Issue/PR: > * https://github.com/tarantool/tarantool/issues/7230 > * https://github.com/LuaJIT/LuaJIT/pull/356 > Tarantool PR: https://github.com/tarantool/tarantool/pull/8020 >=20 > Side note: Problems with red fuzzer jobs look irrelevant to the patch. >=20 > src/lj_asm.c | 4 + > .../lj-356-ir-khash-non-string-obj.test.lua | 90 +++++++++++++++++++ > 2 files changed, 94 insertions(+) > create mode 100644 = test/tarantool-tests/lj-356-ir-khash-non-string-obj.test.lua >=20 > diff --git a/src/lj_asm.c b/src/lj_asm.c > index 1a7fb0c8..a154547b 100644 > --- a/src/lj_asm.c > +++ b/src/lj_asm.c > @@ -1016,7 +1016,11 @@ static uint32_t ir_khash(IRIns *ir) > } else { > lua_assert(irt_isgcv(ir->t)); > lo =3D u32ptr(ir_kgc(ir)); > +#if LJ_GC64 > + hi =3D (uint32_t)(u64ptr(ir_kgc(ir)) >> 32) | (irt_toitype(ir->t) = << 15); > +#else > hi =3D lo + HASH_BIAS; > +#endif > } > return hashrot(lo, hi); > } > diff --git = a/test/tarantool-tests/lj-356-ir-khash-non-string-obj.test.lua = b/test/tarantool-tests/lj-356-ir-khash-non-string-obj.test.lua > new file mode 100644 > index 00000000..fff0b1a5 > --- /dev/null > +++ b/test/tarantool-tests/lj-356-ir-khash-non-string-obj.test.lua > @@ -0,0 +1,90 @@ > +local tap =3D require('tap') > +local traceinfo =3D require('jit.util').traceinfo > +local table_new =3D require('table.new') > + > +-- Test file to demonstrate the incorrect GC64 JIT behaviour > +-- for `IR_HREF` for on-trace-constant key lookup. of an an > +-- See also https://github.com/LuaJIT/LuaJIT/pull/356. > +local test =3D tap.test('lj-356-ir-khash-non-string-obj') > +local N_ITERATIONS =3D 4 > + > +-- Amount of iteration for trace compilation and execution and > +-- additional check, that there is no new trace compiled. > +test:plan(N_ITERATIONS + 1) > + > +-- To reproduce the issue we need to compile a trace with > +-- `IR_HREF`, with a lookup of constant hash key GC value. To > +-- prevent `IR_HREFK` to be emitted instead, we need a table with an `IR_HREFK` emission > +-- a huge hash part. Delta of address between the start of the > +-- hash part of the table and the current node to lookup must be > +-- more than `(1024 * 64 - 1) * sizeof(Node)`. > +-- See , for details. > +-- XXX: This constant is well suited to prevent test to be flaky, > +-- because the aforementioned delta is always large enough. > +local N_HASH_FIELDS =3D 1024 * 1024 * 8 > +local MAGIC =3D 42 > + > +local filled_tab =3D table_new(0, N_HASH_FIELDS + 1) > + > +-- The function returns constant cdata pinned to `GCproto` to be > +-- used as a key for table lookup. > +local function get_const_cdata() > + return 0LL > +end > + > +-- XXX: don't set `hotexit` to prevent compilation of trace after > +-- exiting the main test cycle. > +jit.opt.start('hotloop=3D1') > + > +-- Prevent `get_const_cdata()` become hot and be compiled before > +-- the main test cycle. > +jit.off() > + > +filled_tab[get_const_cdata()] =3D MAGIC > + > +-- Speed up table filling-up. > +jit.on() > + > +-- Filling-up the table with GC values to minimize the amount of > +-- hash collisions and increases delta between the start of the > +-- hash part of the table and currently stored node. > +for i =3D 1, N_HASH_FIELDS do > + filled_tab[1LL] =3D i > +end > + > +-- Prevent JIT misbehaviour before the main test chunk. > +jit.off() > + > +-- Allocate a table with exact array part to be sure that there > +-- is no side exit from the trace, due to table reallocation. > +local result_tab =3D table_new(N_ITERATIONS, 0) > + > +jit.flush() > + > +assert(not traceinfo(1), 'no traces compiled after flush') > + > +jit.on() > + > +for _ =3D 1, N_ITERATIONS do > + -- If the hash for table lookup is miscalculated, then we get > + -- `nil` (most possibly) value from the table and the side exit > + -- will be taken and we continue execution from the call to > + -- `get_const_cdata()`, this function is already hot after the > + -- first cycle iteration, and the new trace is recorded. > + table.insert(result_tab, filled_tab[get_const_cdata()]) > +end > + > +jit.off() > + > +test:ok(not traceinfo(2), 'the second trace should not be compiled') That=E2=80=99s not quite clear to me: a second trace generation is a = side-effect of the incorrect hash calculation. Is it always leads to the trace generation?=20 > + > +-- No more need to prevent trace compilation. > +jit.on() > + > +for i =3D 1, N_ITERATIONS do > + -- Check that that all lookups are correct and there is no > + -- value from other cdata stored in the table. > + test:ok(result_tab[i] =3D=3D MAGIC, 'correct hash lookup from the = table') And this one checks what then? The hash is calculated correctly, but the = value read from the `filled_tab` is incorrect - what can lead to this? > +end > + > +os.exit(test:check() and 0 or 1) > --=20 > 2.34.1 >=20