From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from [87.239.111.99] (localhost [127.0.0.1]) by dev.tarantool.org (Postfix) with ESMTP id F045623FCC2; Thu, 12 Jan 2023 18:11:16 +0300 (MSK) DKIM-Filter: OpenDKIM Filter v2.11.0 dev.tarantool.org F045623FCC2 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tarantool.org; s=dev; t=1673536277; bh=Ha+dzEI2z+gs5Gq1F+wUljv1ZoK3IDSiTncglsY1VKM=; h=Date:To:References:In-Reply-To:Subject:List-Id:List-Unsubscribe: List-Archive:List-Post:List-Help:List-Subscribe:From:Reply-To:Cc: From; b=eZrvvMZiK2u6Jp9vYEwG52BxyLEdelphHSqsHzc6kQVFNBYKynxqo6CzzwGPn+EuJ SV6/IeKnJ594mE8UdDWpYG/a2zdccAMCNIsy/SI0zLuhPPCA9SRTZt6cZSBqdqP2X/ TB4BiD1f5kaWcZRkwX4wHuhPevxbumE7eJSNN0c8= Received: from smtpng2.i.mail.ru (smtpng2.i.mail.ru [94.100.179.3]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dev.tarantool.org (Postfix) with ESMTPS id D2EF423FCC2 for ; Thu, 12 Jan 2023 18:10:28 +0300 (MSK) DKIM-Filter: OpenDKIM Filter v2.11.0 dev.tarantool.org D2EF423FCC2 Received: by smtpng2.m.smailru.net with esmtpa (envelope-from ) id 1pFzDn-0004mv-Sg; Thu, 12 Jan 2023 18:10:28 +0300 Date: Thu, 12 Jan 2023 17:55:38 +0300 To: Sergey Kaplun Message-ID: References: <20221202084220.23122-1-skaplun@tarantool.org> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: <20221202084220.23122-1-skaplun@tarantool.org> X-Clacks-Overhead: GNU Terry Pratchett X-Mailru-Src: smtp X-4EC0790: 10 X-7564579A: 646B95376F6C166E X-77F55803: 4F1203BC0FB41BD90D1502B3BE350FE4864B117B15410743AC98D6963D3C670000894C459B0CD1B98E053D016E42D269D346A76756D211EDFB327B4D0904B7FA6BFCBEEFC207F92E X-7FA49CB5: FF5795518A3D127A4AD6D5ED66289B5278DA827A17800CE709CF9AF650BAB6C1EA1F7E6F0F101C67BD4B6F7A4D31EC0BCC500DACC3FED6E28638F802B75D45FF8AA50765F7900637F0D8FAB78312C5B48638F802B75D45FF36EB9D2243A4F8B5A6FCA7DBDB1FC311F39EFFDF887939037866D6147AF826D81AB1ACCEA15BC8418193E9ED0955FBCE117882F4460429724CE54428C33FAD305F5C1EE8F4F765FC60CDF180582EB8FBA471835C12D1D9774AD6D5ED66289B52BA9C0B312567BB23117882F44604297287769387670735204B6963042765DA4BF6B57BC7E6449061A352F6E88A58FB86F5D81C698A659EA7E827F84554CEF5019E625A9149C048EE9ECD01F8117BC8BEE2021AF6380DFAD18AA50765F790063735872C767BF85DA227C277FBC8AE2E8B2303E78B907142AC75ECD9A6C639B01B4E70A05D1297E1BBCB5012B2E24CD356 X-C8649E89: 4E36BF7865823D7055A7F0CF078B5EC49A30900B95165D34AEC7C2AC3C44791D078DF47EA69A1DCF1A19F44D1997B8964B596B64DDA90259C618344217A452E21D7E09C32AA3244CFF62F7E2174BCA830652AF595860BD9E7C0C08F7987826B983B48618A63566E0 X-D57D3AED: 3ZO7eAau8CL7WIMRKs4sN3D3tLDjz0dLbV79QFUyzQ2Ujvy7cMT6pYYqY16iZVKkSc3dCLJ7zSJH7+u4VD18S7Vl4ZUrpaVfd2+vE6kuoey4m4VkSEu530nj6fImhcD4MUrOEAnl0W826KZ9Q+tr5ycPtXkTV4k65bRjmOUUP8cvGozZ33TWg5HZplvhhXbhDGzqmQDTd6OAevLeAnq3Ra9uf7zvY2zzsIhlcp/Y7m53TZgf2aB4JOg4gkr2biojI459hkOkW/YbqzAcUNQUVA== X-DA7885C5: 2563E44240ADFD6F0AEFC791E2791F67DE0706D7AC76E6859A489217DB87DF2E262E2D401490A4A0DB037EFA58388B346E8BC1A9835FDE71 X-Mailru-Sender: 689FA8AB762F73933AF1F914F131DBF5EB8DA52ACAFDF6EF66A080E9B1673DF8A7C8D0F45F857DBFE9F1EFEE2F478337FB559BB5D741EB964C8C2C849690F8E70A04DAD6CC59E3365FEEDEB644C299C0ED14614B50AE0675 X-Mras: Ok Subject: Re: [Tarantool-patches] [PATCH luajit] x64/LJ_GC64: Fix type-check-only variant of SLOAD. X-BeenThere: tarantool-patches@dev.tarantool.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Tarantool development patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , From: Igor Munkin via Tarantool-patches Reply-To: Igor Munkin Cc: tarantool-patches@dev.tarantool.org Errors-To: tarantool-patches-bounces@dev.tarantool.org Sender: "Tarantool-patches" Sergey, I've checked the patches into all long-term branches in tarantool/luajit and bumped a new version in master, 2.10 and 1.10. On 02.12.22, Sergey Kaplun via Tarantool-patches wrote: > From: Mike Pall > > Thanks to Peter Cawley. > > (cherry picked from commit 05fbdf565c700365d22e38f11478101a0d92a23e) > > To reproduce the issue we need to assemble `IR_SLOAD` with > `IRSLOAD_TYPECHECK` flag set. Also, this IR shouldn't be used later and > be not pri, not any number, not any integer type. For GC64 mode, we get > the following mcode for this typecheck only variant of the IR: > > | 55557f6bffc9 mov rdi, [rdx+0x4] > | 55557f6bffcd sar rdi, 0x2f > | 55557f6bffd1 cmp edi, -0x0b > | 55557f6bffd4 jnz 0x55557f6b0010 ->0 > > This 0x4 addition is excess and crucial: > We got the invalid irtype value to compare (due wrong addressing) -- so > the assertion guard is always failed and we always exit from the trace. > > This patch removes this addition. > > Sergey Kaplun: > * added the description and the test for the problem > > Part of tarantool/tarantool#7230 > --- > > Branch: https://github.com/tarantool/luajit/tree/skaplun/lj-350-fix-sload-typecheck-full-ci > Issues: > * https://github.com/tarantool/tarantool/issues/7230 > * https://github.com/LuaJIT/LuaJIT/pull/350 > Tarantool PR: https://github.com/tarantool/tarantool/pull/7995 > > src/lj_asm_x86.h | 2 +- > .../lj-350-sload-typecheck.test.lua | 42 +++++++++++++++++++ > .../lj-408-tonumber-cdata-record.test.lua | 10 ----- > 3 files changed, 43 insertions(+), 11 deletions(-) > create mode 100644 test/tarantool-tests/lj-350-sload-typecheck.test.lua > > diff --git a/src/lj_asm_x86.h b/src/lj_asm_x86.h > index 8a4d4025..8efda8e5 100644 > --- a/src/lj_asm_x86.h > +++ b/src/lj_asm_x86.h > @@ -1759,7 +1759,7 @@ static void asm_sload(ASMState *as, IRIns *ir) > emit_i8(as, irt_toitype(t)); > emit_rr(as, XO_ARITHi8, XOg_CMP, tmp); > emit_shifti(as, XOg_SAR|REX_64, tmp, 47); > - emit_rmro(as, XO_MOV, tmp|REX_64, base, ofs+4); > + emit_rmro(as, XO_MOV, tmp|REX_64, base, ofs); > #else > } else { > emit_i8(as, irt_toitype(t)); > diff --git a/test/tarantool-tests/lj-350-sload-typecheck.test.lua b/test/tarantool-tests/lj-350-sload-typecheck.test.lua > new file mode 100644 > index 00000000..6ffc61fb > --- /dev/null > +++ b/test/tarantool-tests/lj-350-sload-typecheck.test.lua > @@ -0,0 +1,42 @@ > +local tap = require('tap') > +local traceinfo = require('jit.util').traceinfo > + > +-- Test file to demonstrate the incorrect GC64 JIT asembling > +-- `IR_SLOAD`. > +-- See also https://github.com/LuaJIT/LuaJIT/pull/350. > +local test = tap.test('lj-350-sload-typecheck') > + > +test:plan(1) > + > +-- Contains only IR_SLOAD after recording. > +local function sload(arg) > + return arg > +end > + > +local tab_arg = {} > + > +-- Reset JIT, remove any other traces. > +jit.off() > +jit.flush() > + > +assert(not traceinfo(1), 'no traces compiled after flush') > + > +-- Try to executed compiled trace wiht IR_SLOAD, if emitted mcode > +-- is incorrect, assertion guard type check will failed even for > +-- correct type of argument and a new trace is recorded. > +jit.opt.start('hotloop=1', 'hotexit=1') > + > +jit.on() > + > +-- Make the function hot. > +sload(tab_arg) > +-- Compile the trace. > +sload(tab_arg) > +-- Execute trace and try to compile a trace from the side exit. > +sload(tab_arg) > + > +jit.off() > + > +test:ok(not traceinfo(2), 'the second trace should not be compiled') > + > +os.exit(test:check() and 0 or 1) > diff --git a/test/tarantool-tests/lj-408-tonumber-cdata-record.test.lua b/test/tarantool-tests/lj-408-tonumber-cdata-record.test.lua > index bf9e8e46..a8235e93 100644 > --- a/test/tarantool-tests/lj-408-tonumber-cdata-record.test.lua > +++ b/test/tarantool-tests/lj-408-tonumber-cdata-record.test.lua > @@ -6,7 +6,6 @@ local tap = require('tap') > -- conversions. > -- See also https://github.com/LuaJIT/LuaJIT/issues/408, > -- https://github.com/LuaJIT/LuaJIT/pull/412, > --- https://github.com/LuaJIT/LuaJIT/pull/412, > -- https://github.com/tarantool/tarantool/issues/7655. > local test = tap.test('lj-408-tonumber-cdata-record') > > @@ -14,15 +13,6 @@ local NULL = ffi.cast('void *', 0) > > test:plan(4) > > --- This test won't fail for GC64 on x86_64. This happens due to > --- wrong instruction emitting for SLOAD IR -- we always exit by > --- the assertion guard on the argument type check. See also > --- https://github.com/LuaJIT/LuaJIT/pull/350. > --- The test fails without fix in the current commit, if the > --- following commit is backported: > --- https://github.com/LuaJIT/LuaJIT/commit/05fbdf56 > --- Feel free to remove this comment after backporting of the > --- aforementioned commit. > local function check(x) > -- Don't use a tail call to avoid "leaving loop in root trace" > -- error, so the trace will be compiled. > -- > 2.34.1 > -- Best regards, IM