From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from [87.239.111.99] (localhost [127.0.0.1]) by dev.tarantool.org (Postfix) with ESMTP id B657E6E6CBA; Mon, 20 Nov 2023 14:03:32 +0300 (MSK) DKIM-Filter: OpenDKIM Filter v2.11.0 dev.tarantool.org B657E6E6CBA DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tarantool.org; s=dev; t=1700478212; bh=VJEGcWV5D7RFQB8UhKD2AeZxQgMRINGeUKOuyr8Z93A=; h=Date:To:References:In-Reply-To:Subject:List-Id:List-Unsubscribe: List-Archive:List-Post:List-Help:List-Subscribe:From:Reply-To:Cc: From; b=veCVDF613xnKgjzhMnI1T8caHOWoHXHjAvPSZgXWt5Dx+vTzfQNtWv634BMRhCRbm WTS4mWKtBSC2HVr/JsGV8tJxHv4O1krcf9Vfonnv1YyCnV7gvb0mqRFcaLA6I0QMIu 8bluErAC3+vMWaO0QPrNCCDzTj92qc7LKqa6WpTg= Received: from smtp44.i.mail.ru (smtp44.i.mail.ru [95.163.41.82]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by dev.tarantool.org (Postfix) with ESMTPS id F079D6D69C2 for ; Mon, 20 Nov 2023 14:03:31 +0300 (MSK) DKIM-Filter: OpenDKIM Filter v2.11.0 dev.tarantool.org F079D6D69C2 Received: by smtp44.i.mail.ru with esmtpa (envelope-from ) id 1r523u-005Vux-1w; Mon, 20 Nov 2023 14:03:31 +0300 Date: Mon, 20 Nov 2023 13:58:58 +0300 To: Maxim Kokryashkin Message-ID: References: <20231113150501.28143-1-skaplun@tarantool.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: X-Mailru-Src: smtp X-4EC0790: 10 X-7564579A: 78E4E2B564C1792B X-77F55803: 4F1203BC0FB41BD93F1575C7510F5547926B4B9114735657696DFC1CFA9ECB9A00894C459B0CD1B9C8CDF3CF1E3712D11AAC0F5B54D18A947C929D1D1AFA02236EC242FFF24CD075 X-7FA49CB5: FF5795518A3D127A4AD6D5ED66289B5278DA827A17800CE7BF6702EC5472AA0FEA1F7E6F0F101C67BD4B6F7A4D31EC0BCC500DACC3FED6E28638F802B75D45FF8AA50765F79006376AEB812070489DF38638F802B75D45FF36EB9D2243A4F8B5A6FCA7DBDB1FC311F39EFFDF887939037866D6147AF826D8D025031B996138143680D49E57D3AB24117882F4460429724CE54428C33FAD305F5C1EE8F4F765FCAE9A1BBD95851C5BA471835C12D1D9774AD6D5ED66289B52BA9C0B312567BB23117882F44604297287769387670735201E561CDFBCA1751FCB629EEF1311BF91D2E47CDBA5A96583BA9C0B312567BB2376E601842F6C81A19E625A9149C048EE0AC5B80A05675ACDC3123C4324A5CF10D8FC6C240DEA76429C9F4D5AE37F343AA9539A8B242431040A6AB1C7CE11FEE3D56D36E97F3F038C6E0066C2D8992A16C4224003CC836476E2F48590F00D11D6E2021AF6380DFAD1A18204E546F3947C062BEEFFB5F8EA3E2E808ACE2090B5E1725E5C173C3A84C3C5EA940A35A165FF2DBA43225CD8A89F0A35B161A8BF67C16D8C47C27EEC5E9FB5C8C57E37DE458BEDA766A37F9254B7 X-C1DE0DAB: 0D63561A33F958A5FA31C39D83B5211D17EAC7AC42EABA657478B1A17D57F5CCF87CCE6106E1FC07E67D4AC08A07B9B064E7220B7C550592CB5012B2E24CD356 X-C8649E89: 1C3962B70DF3F0ADE00A9FD3E00BEEDF3FED46C3ACD6F73ED3581295AF09D3DF87807E0823442EA2ED31085941D9CD0AF7F820E7B07EA4CF9416AE20B01247F6E387EB42F10C3DC75EFFEE8E42DBCBC8EF0A7CD0601418F360849098BFF6585A88AD3775A6B0C834FEF208C3796C1ABCD8502991637C9A55E48CAC7CA610320002C26D483E81D6BE5EF9655DD6DEA7D65774BB76CC95456EEC5B5AD62611EEC62B5AFB4261A09AF0 X-D57D3AED: 3ZO7eAau8CL7WIMRKs4sN3D3tLDjz0dLbV79QFUyzQ2Ujvy7cMT6pYYqY16iZVKkSc3dCLJ7zSJH7+u4VD18S7Vl4ZUrpaVfd2+vE6kuoey4m4VkSEu530nj6fImhcD4MUrOEAnl0W826KZ9Q+tr5ycPtXkTV4k65bRjmOUUP8cvGozZ33TWg5HZplvhhXbhDGzqmQDTd6OAevLeAnq3Ra9uf7zvY2zzsIhlcp/Y7m53TZgf2aB4JOg4gkr2biojmRIjd71J0y3/em4Bf0BRcg== X-Mailru-Sender: 11C2EC085EDE56FAC07928AF2646A769D827303E00ACE1ED223EFDE8651D90578A2AC75D222269F8DEDBA653FF35249392D99EB8CC7091A70E183A470755BFD208F19895AA18418972D6B4FCE48DF648AE208404248635DF X-Mras: Ok Subject: Re: [Tarantool-patches] [PATCH luajit] Fix ABC FOLD rule with constants. X-BeenThere: tarantool-patches@dev.tarantool.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Tarantool development patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , From: Sergey Kaplun via Tarantool-patches Reply-To: Sergey Kaplun Cc: tarantool-patches@dev.tarantool.org Errors-To: tarantool-patches-bounces@dev.tarantool.org Sender: "Tarantool-patches" Hi, Maxim! Thanks for the review! Please consider my answers below. On 17.11.23, Maxim Kokryashkin wrote: > Hi, Sergey! > Thanks for the patch! > Please consider my comments below. > > On Mon, Nov 13, 2023 at 06:05:01PM +0300, Sergey Kaplun wrote: > > From: Mike Pall > > > > Reported by XmiliaH. > > > > (cherry-picked from commit c8bcf1e5fb8eb72c7e35604fdfd27bba512761bb) > > > > `fold_abc_k()` doesn't patch the first ABC check when the right constant > > operand is negative. This leads to out-of-bounds access from the array > > on a trace. This patch casts to uint32_t the operands to compare. If the > It would be right to paraphrase this sentence like this: > "This patch casts the operands to uint32_t for comparison." Replaced, thanks. > > right IR contains a negative integer, the second IR will always be > > patched. Also, because the ABC check on the trace is unordered, this > > guard will always fail. > > > > Also, this fold rule creates new instructions that reference operands > > across PHIs. This opens the room for other optimizations (like DCE), so > > some guards become eliminated, and we use out-of-bounds access from the > > array part of the table on trace. This patch adds the missing > > `PHIBARRIER()` check. > > > > Sergey Kaplun: > > * added the description and the test for the problem > > > > Part of tarantool/tarantool#9145 > > --- > > Branch: https://github.com/tarantool/luajit/tree/skaplun/lj-794-abc-fold-constants > > Tarantool PR: https://github.com/tarantool/tarantool/pull/9364 > > Related issues: > > * https://github.com/LuaJIT/LuaJIT/issues/794 > > * https://github.com/tarantool/tarantool/issues/9145 > > > > src/lj_opt_fold.c | 5 +- > > .../lj-794-abc-fold-constants.test.lua | 85 +++++++++++++++++++ > > 2 files changed, 88 insertions(+), 2 deletions(-) > > create mode 100644 test/tarantool-tests/lj-794-abc-fold-constants.test.lua > > > > diff --git a/src/lj_opt_fold.c b/src/lj_opt_fold.c > > index 944a9ecc..6175f7c1 100644 > > --- a/src/lj_opt_fold.c > > +++ b/src/lj_opt_fold.c > > > > diff --git a/test/tarantool-tests/lj-794-abc-fold-constants.test.lua b/test/tarantool-tests/lj-794-abc-fold-constants.test.lua > > new file mode 100644 > > index 00000000..f8609933 > > --- /dev/null > > +++ b/test/tarantool-tests/lj-794-abc-fold-constants.test.lua > > @@ -0,0 +1,85 @@ > > > > +-- Now test the second issue, when ABC optimization applies for > > +-- operands across PHIs. > > + > > +-- XXX: Reset hotcounters to avoid collisions. > > +jit.opt.start('hotloop=1') > > + > > +local tab_array = {} > > +local small_tab = {MAGIC_UNUSED} > > +local full_tab = {} > > + > > +-- First, create tables with different asizes, to be used in PHI. > > +-- Create a large enough array part for the noticeable > > +-- out-of-bounds access. > > +for i = 1, 8 do > > + full_tab[i] = MAGIC_UNUSED > > +end > > + > > +-- We need 5 iterations to execute both the variant and the > > +-- invariant parts of the trace below. > > +for i = 1, 5 do > > + -- On the 3rd iteration, the recording is started. > > + if i > 3 then > > + tab_array[i] = small_tab > > + else > > + tab_array[i] = full_tab > > + end > > +end > > + > > +local result > > +local alias_tab = tab_array[1] > > +-- Compile a trace. > > +-- Run 5 iterations to execute both the variant and the invariant > > +-- parts. > > +for i = 1, 5 do > > + local local_tab = alias_tab > > + alias_tab = tab_array[i] > > + -- Additional ABC check to fold. > > + -- luacheck: ignore > > + result = alias_tab[1] > > + result = local_tab[8] > > +end > > The black magic that happens here with tables is hard to understand. > Please drop a comment with a detailed explanations for why do we need > this complex `tab_array` construction and what effects does this have on > IRs. Added the following comment for clarification: Also, renaming `local_tab` -> `previous_tab` to avoid confusion and emphasize that the table from the previous iteration, which ABC check IR is used. =================================================================== diff --git a/test/tarantool-tests/lj-794-abc-fold-constants.test.lua b/test/tarantool-tests/lj-794-abc-fold-constants.test.lua index f8609933..c69d395b 100644 --- a/test/tarantool-tests/lj-794-abc-fold-constants.test.lua +++ b/test/tarantool-tests/lj-794-abc-fold-constants.test.lua @@ -55,6 +55,12 @@ for i = 1, 8 do full_tab[i] = MAGIC_UNUSED end +-- Now, store these tables in the array. The PHI should be used in +-- the trace to distinguish asizes from the variant and the +-- invariant parts of the loop for the future ABC check. +-- Nevertheless, before the patch, the ABC IR and the +-- corresponding PHI are folded via optimization. This leads to +-- incorrect behaviour. -- We need 5 iterations to execute both the variant and the -- invariant parts of the trace below. for i = 1, 5 do @@ -72,12 +78,12 @@ local alias_tab = tab_array[1] -- Run 5 iterations to execute both the variant and the invariant -- parts. for i = 1, 5 do - local local_tab = alias_tab + local previous_tab = alias_tab alias_tab = tab_array[i] -- Additional ABC check to fold. -- luacheck: ignore result = alias_tab[1] - result = local_tab[8] + result = previous_tab[8] end test:is(result, nil, 'correct ABC constant rule across PHI') =================================================================== > > + > > +test:is(result, nil, 'correct ABC constant rule across PHI') > > + > > +test:done(true) > > -- > > 2.42.0 > > -- Best regards, Sergey Kaplun