From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from [87.239.111.99] (localhost [127.0.0.1]) by dev.tarantool.org (Postfix) with ESMTP id 726B3E32040; Tue, 24 Sep 2024 13:28:41 +0300 (MSK) DKIM-Filter: OpenDKIM Filter v2.11.0 dev.tarantool.org 726B3E32040 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tarantool.org; s=dev; t=1727173721; bh=vH3g0TWy6c4/USOa0UqG1evDSHBkVtrHSA+xaa0OXog=; h=Date:To:Cc:References:In-Reply-To:Subject:List-Id: List-Unsubscribe:List-Archive:List-Post:List-Help:List-Subscribe: From:Reply-To:From; b=bpSHi/OJwqNGGSWJ/GiY7HYeKmVWwqN5CTLXq4qRNNrD2QTD1mcWQody5bNRZlLX8 VjFd5cEqQXs/oMQOdkolAxP9O0q/+aZppD8l33/jJdNVKJlcmfni7OXkgxlhfyptev R5/wmhwga+2LI6PuKOPDpSY4ukbrNe2R2DlTAY0M= Received: from smtp33.i.mail.ru (smtp33.i.mail.ru [95.163.41.74]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by dev.tarantool.org (Postfix) with ESMTPS id 04B60E32040 for ; Tue, 24 Sep 2024 13:28:40 +0300 (MSK) DKIM-Filter: OpenDKIM Filter v2.11.0 dev.tarantool.org 04B60E32040 Received: by smtp33.i.mail.ru with esmtpa (envelope-from ) id 1st2md-000000003rz-0gMT; Tue, 24 Sep 2024 13:28:39 +0300 Content-Type: multipart/alternative; boundary="------------F0s7H5CxJjT8AouJ0a7h44cP" Message-ID: Date: Tue, 24 Sep 2024 13:28:38 +0300 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird To: Sergey Kaplun , Maxim Kokryashkin Cc: tarantool-patches@dev.tarantool.org References: <20240923112852.26851-1-skaplun@tarantool.org> Content-Language: en-US In-Reply-To: <20240923112852.26851-1-skaplun@tarantool.org> X-Mailru-Src: smtp X-4EC0790: 10 X-7564579A: 646B95376F6C166E X-77F55803: 4F1203BC0FB41BD968D81A599CAF0ABB9993196EC931CF51CE270FFF4DC01640182A05F538085040B72E48D215602A833DE06ABAFEAF670552DCDF07017D50E4136038D1A3840DCD58574C2FEBD6103D X-7FA49CB5: FF5795518A3D127A4AD6D5ED66289B5278DA827A17800CE75DF2B1F23425CAE5EA1F7E6F0F101C67BD4B6F7A4D31EC0BCC500DACC3FED6E28638F802B75D45FF8AA50765F7900637823A65B148B2A9908638F802B75D45FF36EB9D2243A4F8B5A6FCA7DBDB1FC311F39EFFDF887939037866D6147AF826D8D7D524EE151EE0B68299DA9D7B8B5BE6153E0D0B165DB5AACC7F00164DA146DAFE8445B8C89999728AA50765F7900637F6B57BC7E64490618DEB871D839B7333395957E7521B51C2DFABB839C843B9C08941B15DA834481F8AA50765F7900637D0FEED2715E18529389733CBF5DBD5E9B5C8C57E37DE458BD9DD9810294C998ED8FC6C240DEA76428AA50765F7900637FD76D9A244CC730CD81D268191BDAD3DBD4B6F7A4D31EC0BE2F48590F00D11D6D81D268191BDAD3D78DA827A17800CE7E11C30826693BCDDEC76A7562686271ED91E3A1F190DE8FD2E808ACE2090B5E14AD6D5ED66289B5259CC434672EE63711DD303D21008E298D5E8D9A59859A8B6B372FE9A2E580EFC725E5C173C3A84C37AD11C3DD5B7757435872C767BF85DA2F004C90652538430E4A6367B16DE6309 X-C1DE0DAB: 0D63561A33F958A543A90CD16D40AFE65002B1117B3ED69681B2351A711D4BD7484B8D70797403F6823CB91A9FED034534781492E4B8EEADADEF88395FA75C5FBDAD6C7F3747799A X-C8649E89: 1C3962B70DF3F0ADE00A9FD3E00BEEDF3FED46C3ACD6F73ED3581295AF09D3DF87807E0823442EA2ED31085941D9CD0AF7F820E7B07EA4CF2116931C996371CED027DCE44B3C4A9883EF4B34A06F8710D27565D9D119D571696309706696DB62A4322FFB9F042FEFE5F798904D5E277FE4F0A8CF3C8DF21D28D41841FEF529755F4332CA8FE04980913E6812662D5F2AB9AF64DB4688768036DF5FE9C0001AF333F2C28C22F508233FCF178C6DD14203 X-D57D3AED: 3ZO7eAau8CL7WIMRKs4sN3D3tLDjz0dLbV79QFUyzQ2Ujvy7cMT6pYYqY16iZVKkSc3dCLJ7zSJH7+u4VD18S7Vl4ZUrpaVfd2+vE6kuoey4m4VkSEu530nj6fImhcD4MUrOEAnl0W826KZ9Q+tr5ycPtXkTV4k65bRjmOUUP8cvGozZ33TWg5HZplvhhXbhDGzqmQDTd6OAevLeAnq3Ra9uf7zvY2zzsIhlcp/Y7m53TZgf2aB4JOg4gkr2biojamSMdo1tbG+mF9O/bpXTsw== X-Mailru-Sender: 520A125C2F17F0B1E52FEF5D219D614041A4A0980BDEDF4AA6D5EE0DB6E1EC8D3085164365D8DF4B0152A3D17938EB451EB5A0BCEC6A560B3DDE9B364B0DF289BE2DA36745F2EEB5CEBA01FB949A1F1EEAB4BC95F72C04283CDA0F3B3F5B9367 X-Mras: Ok Subject: Re: [Tarantool-patches] [PATCH luajit] Add missing coercion when recording select(string, ...) X-BeenThere: tarantool-patches@dev.tarantool.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Tarantool development patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , From: Sergey Bronnikov via Tarantool-patches Reply-To: Sergey Bronnikov Errors-To: tarantool-patches-bounces@dev.tarantool.org Sender: "Tarantool-patches" This is a multi-part message in MIME format. --------------F0s7H5CxJjT8AouJ0a7h44cP Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Hi, Sergey, thanks for the patch! See minor comment below. LGTM On 23.09.2024 14:28, Sergey Kaplun wrote: > From: Mike Pall > > Thanks to Peter Cawley. > > (cherry picked from commit 92b89d005ab721a61bce6d471b052bcb236b81d7) > > Before the patch, the recording of `select()` with a string argument > leads to the following IR: > | rcx > int CONV "1" int.num index > Where the operand has string type instead of number type. > This leads to the corresponding mcode: > | cvttsd2si ecx, xmm1 > Where xmm1 has an undefined value. Thus leads to the undefined behaviour > for the recording trace. > > This patch adds the missing coercion. > > Sergey Kaplun: > * added the description and the test for the problem > > Part of tarantool/tarantool#10199 > --- > > Branch:https://github.com/tarantool/luajit/tree/skaplun/lj-1083-missing-tostring-coercion-in-select > Related issues: > *https://github.com/tarantool/tarantool/issues/10199 > *https://github.com/LuaJIT/LuaJIT/issues/1083 > > src/lj_record.c | 5 ++- > ...ssing-tostring-coercion-in-select.test.lua | 39 +++++++++++++++++++ > 2 files changed, 43 insertions(+), 1 deletion(-) > create mode 100644 test/tarantool-tests/lj-1083-missing-tostring-coercion-in-select.test.lua > > diff --git a/src/lj_record.c b/src/lj_record.c > index 96fe26d8..311d9fe7 100644 > --- a/src/lj_record.c > +++ b/src/lj_record.c > @@ -1871,8 +1871,11 @@ static void rec_varg(jit_State *J, BCReg dst, ptrdiff_t nresults) > TRef tr = TREF_NIL; > ptrdiff_t idx = lj_ffrecord_select_mode(J, tridx, &J->L->base[dst-1]); > if (idx < 0) goto nyivarg; > - if (idx != 0 && !tref_isinteger(tridx)) > + if (idx != 0 && !tref_isinteger(tridx)) { > + if (tref_isstr(tridx)) > + tridx = emitir(IRTG(IR_STRTO, IRT_NUM), tridx, 0); > tridx = emitir(IRTGI(IR_CONV), tridx, IRCONV_INT_NUM|IRCONV_INDEX); > + } > if (idx != 0 && tref_isk(tridx)) { > emitir(IRTGI(idx <= nvararg ? IR_GE : IR_LT), > fr, lj_ir_kint(J, frofs+8*(int32_t)idx)); > diff --git a/test/tarantool-tests/lj-1083-missing-tostring-coercion-in-select.test.lua b/test/tarantool-tests/lj-1083-missing-tostring-coercion-in-select.test.lua > new file mode 100644 > index 00000000..8089247f > --- /dev/null > +++ b/test/tarantool-tests/lj-1083-missing-tostring-coercion-in-select.test.lua > @@ -0,0 +1,39 @@ > +local tap = require('tap') > + > +-- Test file to demonstrate LuaJIT incorrect recording of > +-- `select()` fast function. > +-- See also:https://github.com/LuaJIT/LuaJIT/issues/1083. > + > +local test = tap.test('lj-1083-missing-tostring-coercion-in-select'):skipcond({ > + ['Test requires JIT enabled'] = not jit.status(), > +}) > + > +test:plan(1) > + > +-- Simplify the `jit.dump()` output. > +local select = select > + > +local function test_select(...) > + local result > + for _ = 1, 4 do > + -- Before the patch, with the missed coercion to string, the > + -- recording of `select()` below leads to the following IR: > + -- | rcx > int CONV "1" int.num index > + -- Where the operand has string type instead of number type. > + -- This leads to the corresponding mcode: > + -- | cvttsd2si ecx, xmm1 > + -- Where xmm1 has an undefined value. Thus leads to the > + -- incorrect result for the call below. > + result = select('1', ...) > + end > + return result > +end > + > +jit.opt.start('hotloop=1') > + > +-- XXX: amount of arguments is empirical, see the comment above. > +local result = test_select(1, 2, 3, 4) > + > +test:is(result, 1, 'corect select result after recording') s/corect/correct/ > + > +test:done(true) --------------F0s7H5CxJjT8AouJ0a7h44cP Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

Hi, Sergey,

thanks for the patch!

See minor comment below.

LGTM


On 23.09.2024 14:28, Sergey Kaplun wrote:
From: Mike Pall <mike>

Thanks to Peter Cawley.

(cherry picked from commit 92b89d005ab721a61bce6d471b052bcb236b81d7)

Before the patch, the recording of `select()` with a string argument
leads to the following IR:
| rcx   >  int CONV   "1"   int.num index
Where the operand has string type instead of number type.
This leads to the corresponding mcode:
| cvttsd2si ecx, xmm1
Where xmm1 has an undefined value. Thus leads to the undefined behaviour
for the recording trace.

This patch adds the missing coercion.

Sergey Kaplun:
* added the description and the test for the problem

Part of tarantool/tarantool#10199
---

Branch: https://github.com/tarantool/luajit/tree/skaplun/lj-1083-missing-tostring-coercion-in-select
Related issues:
* https://github.com/tarantool/tarantool/issues/10199
* https://github.com/LuaJIT/LuaJIT/issues/1083

 src/lj_record.c                               |  5 ++-
 ...ssing-tostring-coercion-in-select.test.lua | 39 +++++++++++++++++++
 2 files changed, 43 insertions(+), 1 deletion(-)
 create mode 100644 test/tarantool-tests/lj-1083-missing-tostring-coercion-in-select.test.lua

diff --git a/src/lj_record.c b/src/lj_record.c
index 96fe26d8..311d9fe7 100644
--- a/src/lj_record.c
+++ b/src/lj_record.c
@@ -1871,8 +1871,11 @@ static void rec_varg(jit_State *J, BCReg dst, ptrdiff_t nresults)
       TRef tr = TREF_NIL;
       ptrdiff_t idx = lj_ffrecord_select_mode(J, tridx, &J->L->base[dst-1]);
       if (idx < 0) goto nyivarg;
-      if (idx != 0 && !tref_isinteger(tridx))
+      if (idx != 0 && !tref_isinteger(tridx)) {
+	if (tref_isstr(tridx))
+	  tridx = emitir(IRTG(IR_STRTO, IRT_NUM), tridx, 0);
 	tridx = emitir(IRTGI(IR_CONV), tridx, IRCONV_INT_NUM|IRCONV_INDEX);
+      }
       if (idx != 0 && tref_isk(tridx)) {
 	emitir(IRTGI(idx <= nvararg ? IR_GE : IR_LT),
 	       fr, lj_ir_kint(J, frofs+8*(int32_t)idx));
diff --git a/test/tarantool-tests/lj-1083-missing-tostring-coercion-in-select.test.lua b/test/tarantool-tests/lj-1083-missing-tostring-coercion-in-select.test.lua
new file mode 100644
index 00000000..8089247f
--- /dev/null
+++ b/test/tarantool-tests/lj-1083-missing-tostring-coercion-in-select.test.lua
@@ -0,0 +1,39 @@
+local tap = require('tap')
+
+-- Test file to demonstrate LuaJIT incorrect recording of
+-- `select()` fast function.
+-- See also: https://github.com/LuaJIT/LuaJIT/issues/1083.
+
+local test = tap.test('lj-1083-missing-tostring-coercion-in-select'):skipcond({
+  ['Test requires JIT enabled'] = not jit.status(),
+})
+
+test:plan(1)
+
+-- Simplify the `jit.dump()` output.
+local select = select
+
+local function test_select(...)
+  local result
+  for _ = 1, 4 do
+    -- Before the patch, with the missed coercion to string, the
+    -- recording of `select()` below leads to the following IR:
+    -- | rcx   >  int CONV   "1"   int.num index
+    -- Where the operand has string type instead of number type.
+    -- This leads to the corresponding mcode:
+    -- | cvttsd2si ecx, xmm1
+    -- Where xmm1 has an undefined value. Thus leads to the
+    -- incorrect result for the call below.
+    result = select('1', ...)
+  end
+  return result
+end
+
+jit.opt.start('hotloop=1')
+
+-- XXX: amount of arguments is empirical, see the comment above.
+local result = test_select(1, 2, 3, 4)
+
+test:is(result, 1, 'corect select result after recording')

s/corect/correct/


+
+test:done(true)
--------------F0s7H5CxJjT8AouJ0a7h44cP--