From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from [87.239.111.99] (localhost [127.0.0.1]) by dev.tarantool.org (Postfix) with ESMTP id 39D9370353; Thu, 28 Oct 2021 14:37:57 +0300 (MSK) DKIM-Filter: OpenDKIM Filter v2.11.0 dev.tarantool.org 39D9370353 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tarantool.org; s=dev; t=1635421077; bh=RmL+YB/u8Nnx6i6WCOSm/NGAOgVxjetukLfJifQtSBQ=; h=Date:To:References:In-Reply-To:Subject:List-Id:List-Unsubscribe: List-Archive:List-Post:List-Help:List-Subscribe:From:Reply-To:Cc: From; b=S76RCiaHuzrCKnZPPTBWbXKPiYPllAq6x/ePc0b/8DAJ10e33VCU6EfEPMHR3Bpjx qB+pWEPfZMkgmMDyfLY7xNyr0RxiOvPcSnNpGra8Am3KXS40ednBT0rLEwwyaBHvsC ieeYFLiG6AC48CAR3rD/mUUDc4mD4w4FwJO6Xmns= Received: from smtp52.i.mail.ru (smtp52.i.mail.ru [94.100.177.112]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dev.tarantool.org (Postfix) with ESMTPS id 41D9E70353 for ; Thu, 28 Oct 2021 14:37:55 +0300 (MSK) DKIM-Filter: OpenDKIM Filter v2.11.0 dev.tarantool.org 41D9E70353 Received: by smtp52.i.mail.ru with esmtpa (envelope-from ) id 1mg3jG-0001j6-De; Thu, 28 Oct 2021 14:37:54 +0300 Date: Thu, 28 Oct 2021 14:36:09 +0300 To: sergos Message-ID: References: <20211018185341.32155-1-skaplun@tarantool.org> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: X-4EC0790: 10 X-7564579A: EEAE043A70213CC8 X-77F55803: 4F1203BC0FB41BD9E6B4260954843F6F99B11800D2E1FDBB8E9888218759CF9000894C459B0CD1B926B9CC76E690AF829B919242012604F28EF7491948755D200B9091E8913A9467 X-7FA49CB5: FF5795518A3D127A4AD6D5ED66289B5278DA827A17800CE779AAD18609327F83EA1F7E6F0F101C67BD4B6F7A4D31EC0BCC500DACC3FED6E28638F802B75D45FF8AA50765F7900637954B64E58FDAD6938638F802B75D45FF36EB9D2243A4F8B5A6FCA7DBDB1FC311F39EFFDF887939037866D6147AF826D89902D22A6A9973ED4265D348527E113B117882F4460429724CE54428C33FAD305F5C1EE8F4F765FCAA867293B0326636D2E47CDBA5A96583BD4B6F7A4D31EC0BC014FD901B82EE079FA2833FD35BB23D27C277FBC8AE2E8B2EE5AD8F952D28FBA471835C12D1D977C4224003CC8364762BB6847A3DEAEFB0F43C7A68FF6260569E8FC8737B5C2249EC8D19AE6D49635B68655334FD4449CB9ECD01F8117BC8BEAAAE862A0553A39223F8577A6DFFEA7C5C8BF3F796D5A11743847C11F186F3C59DAA53EE0834AAEE X-C1DE0DAB: 0D63561A33F958A59CE0DEBB61AA2D756C5D6735C8704DFC1045B97BCA4DA782D59269BC5F550898D99A6476B3ADF6B47008B74DF8BB9EF7333BD3B22AA88B938A852937E12ACA75C29D03FC76C37677410CA545F18667F91A7EA1CDA0B5A7A0 X-C8649E89: 4E36BF7865823D7055A7F0CF078B5EC49A30900B95165D34BD150993ED26DDF4B58E34F50F3AD0770D7283A08D6231DA924971CF90C13EFEC3C6FBC86D67151C1D7E09C32AA3244C7E62E8946DA24A5B4F0E561D6E82F734A995755A1445935EFACE5A9C96DEB163 X-D57D3AED: 3ZO7eAau8CL7WIMRKs4sN3D3tLDjz0dLbV79QFUyzQ2Ujvy7cMT6pYYqY16iZVKkSc3dCLJ7zSJH7+u4VD18S7Vl4ZUrpaVfd2+vE6kuoey4m4VkSEu530nj6fImhcD4MUrOEAnl0W826KZ9Q+tr5ycPtXkTV4k65bRjmOUUP8cvGozZ33TWg5HZplvhhXbhDGzqmQDTd6OAevLeAnq3Ra9uf7zvY2zzsIhlcp/Y7m53TZgf2aB4JOg4gkr2biojdMRfVmNkPDgFvHW3ExdDzA== X-Mailru-Sender: 3B9A0136629DC91206CBC582EFEF4CB4AF56FDFC417576047E260C7C4EA0AD4888539C011353E0BFF2400F607609286E924004A7DEC283833C7120B22964430C52B393F8C72A41A89437F6177E88F7363CDA0F3B3F5B9367 X-Mras: Ok Subject: Re: [Tarantool-patches] [PATCH luajit] Fix FOLD rule for strength reduction of widening. X-BeenThere: tarantool-patches@dev.tarantool.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Tarantool development patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , From: Sergey Kaplun via Tarantool-patches Reply-To: Sergey Kaplun Cc: tarantool-patches@dev.tarantool.org Errors-To: tarantool-patches-bounces@dev.tarantool.org Sender: "Tarantool-patches" Hi, Sergos! Thanks for the review! On 27.10.21, sergos wrote: > Hi! > > Thanks for the patch, see my comments below. > > Regards, > Sergos > > > On 18 Oct 2021, at 21:53, Sergey Kaplun wrote: > > > > From: Mike Pall > > > > Reported by Matthew Burk. > > > > (cherry picked from commit 9f0caad0e43f97a4613850b3874b851cb1bc301d) > > > > The simplify_conv_sext optimization is used for reduction of widening. > > Whether it is part of narrowing itself? Not exactly, it is fold optimization that can be used during narrowing. lj_opt_narrow_cindex -> lj_opt_fold (in emitir) -> fold_narrow_convert -> lj_opt_narrow_convert -> narrow_conv_emit -> lj_opt_fold -> fold_simplify_conv_sext > > > cdata indexing narrow optimization uses it for narrowing of a C array > > The sentence is started with lowercase, making one to track back the start > of the sentence. “A narrow optimization for cdata…” in conjunction of > first sentence above should help. > > > > index. The optimization eliminates sign extension for corresponding > the > > > integer value. However, this conversion cannot be omitted for non > > constant values (for example loading stack slots) as far as their sign > > extension may change. The emitted machine code may be incorrect without > > I believe you meant ‘with’ the conversion. > > > aforementioned conversion (for example mov instruction instead movsxd is > > used on x86 architecture). As a result the value in a destination > > The example is too much. Just “negative offset from the stack pointer > may appear positive and result in undefined memory access” Fixed all your comments, see the updated commit message below. Branch is force pushed. =================================================================== Fix FOLD rule for strength reduction of widening. Reported by Matthew Burk. (cherry picked from commit 9f0caad0e43f97a4613850b3874b851cb1bc301d) The simplify_conv_sext optimization is used for reduction of widening. An indexing narrow optimization for cdata uses it for narrowing of a C array index. The optimization eliminates sign extension for the corresponding integer value. However, this conversion cannot be omitted for non constant values (for example loading stack slots) as far as their sign extension may change. The emitted machine code may be incorrect with aforementioned conversion (negative offset from the stack pointer may appear positive and result is undefined memory access). As a result the value in a destination register during trace execution is invalid. This patch allows this optimization only for constant integer values. Sergey Kaplun: * added the description and the test for the problem =================================================================== > > > register during trace execution is invalid. > > > > This patch allows this optimization only for constant integer values. > > Should it check if integer - even a constant one - is positive? No, why? In fold rule are declared both types: INT64 and UINT64. > > > > > Sergey Kaplun: > > * added the description and the test for the problem > > --- > > > > Tarantool branch: https://github.com/tarantool/tarantool/tree/skaplun/gh-noticket-fix-fold-simplify-conv-sext > > Branch: https://github.com/tarantool/luajit/tree/skaplun/gh-noticket-fix-fold-simplify-conv-sext > > > > src/lj_opt_fold.c | 2 +- > > .../lj-fix-fold-simplify-conv-sext.test.lua | 35 +++++++++++++++++++ > > 2 files changed, 36 insertions(+), 1 deletion(-) > > create mode 100644 test/tarantool-tests/lj-fix-fold-simplify-conv-sext.test.lua > > > > diff --git a/src/lj_opt_fold.c b/src/lj_opt_fold.c > > index 3c508062..276dc040 100644 > > --- a/src/lj_opt_fold.c > > +++ b/src/lj_opt_fold.c > > @@ -1227,7 +1227,7 @@ LJFOLDF(simplify_conv_sext) > > if (ref == J->scev.idx) { > > IRRef lo = J->scev.dir ? J->scev.start : J->scev.stop; > > lua_assert(irt_isint(J->scev.t)); > > - if (lo && IR(lo)->i + ofs >= 0) { > > + if (lo && IR(lo)->o == IR_KINT && IR(lo)->i + ofs >= 0) { > > ok_reduce: > > #if LJ_TARGET_X64 > > /* Eliminate widening. All 32 bit ops do an implicit zero-extension. */ > > diff --git a/test/tarantool-tests/lj-fix-fold-simplify-conv-sext.test.lua b/test/tarantool-tests/lj-fix-fold-simplify-conv-sext.test.lua > > new file mode 100644 > > index 00000000..bd3738c5 > > --- /dev/null > > +++ b/test/tarantool-tests/lj-fix-fold-simplify-conv-sext.test.lua > > @@ -0,0 +1,35 @@ > > +local tap = require('tap') > > +local ffi = require('ffi') > > + > > +local test = tap.test('lj-fix-fold-simplify-conv-sext') > > + > > +local NSAMPLES = 4 > > +local NTEST = NSAMPLES * 2 + 1 Also fixed typo here: s/+/-/ > > +test:plan(NTEST) > > + > > +local samples = ffi.new('int [?]', NSAMPLES) > > + > > +-- Prepare data. > > +for i = 0, NSAMPLES - 1 do samples[i] = i end > > + > > +local expected = {3, 2, 1, 0, 3, 2, 1} > > + > > +local START = 3 > > +local STOP = -START > > + > > +local results = {} > > +jit.opt.start('hotloop=1') > > +for i = START, STOP, -1 do > > + -- While recording cdata indexing the fold CONV SEXT > > + -- optimization eliminate sign extension for the corresponding > > + -- non constant value (i.e. stack slot). As a result the read > > + -- out of bounds was occurring. > > + results[#results + 1] = samples[i % NSAMPLES] > > +end > > + > > +for i = 1, NTEST do > > + test:ok(results[i] == expected[i], 'correct cdata indexing') > > +end > > + > > +os.exit(test:check() and 0 or 1) > > + > > -- > > 2.31.0 > > > -- Best regards, Sergey Kaplun