From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from [87.239.111.99] (localhost [127.0.0.1]) by dev.tarantool.org (Postfix) with ESMTP id 87566704A71; Fri, 17 Nov 2023 14:27:30 +0300 (MSK) DKIM-Filter: OpenDKIM Filter v2.11.0 dev.tarantool.org 87566704A71 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tarantool.org; s=dev; t=1700220450; bh=RX6BqDSFAacWK078/O71G8v+1bLoTkmkruvf/xf79lM=; h=Date:To:References:In-Reply-To:Subject:List-Id:List-Unsubscribe: List-Archive:List-Post:List-Help:List-Subscribe:From:Reply-To:Cc: From; b=ARYEamX2fkK5aScs3YF+yTdBBjHtQ1aQTiJKe8d5NGIC+gW9IdhkVZLY6IYRuq7cA IoGiyIEGolt78s5h1wGXiTIAjrOk5neQ5SvW6B5em6f2DiOfaN/Mbtr/CqSFzttw6V QOKnIDGHz5Eu8g1+j2IQXHplKNommiUoYK1eGtC0= Received: from smtp60.i.mail.ru (smtp60.i.mail.ru [95.163.41.98]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by dev.tarantool.org (Postfix) with ESMTPS id DA57D704267 for ; Fri, 17 Nov 2023 14:27:29 +0300 (MSK) DKIM-Filter: OpenDKIM Filter v2.11.0 dev.tarantool.org DA57D704267 Received: by smtp60.i.mail.ru with esmtpa (envelope-from ) id 1r3x0S-00CC3f-25; Fri, 17 Nov 2023 14:27:29 +0300 Date: Fri, 17 Nov 2023 14:27:28 +0300 To: Sergey Kaplun Message-ID: References: <20231113150501.28143-1-skaplun@tarantool.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20231113150501.28143-1-skaplun@tarantool.org> X-Mailru-Src: smtp X-7564579A: 646B95376F6C166E X-77F55803: 4F1203BC0FB41BD93F1575C7510F5547C4BA55EE1C538B8CF93DF2DAE84300DC00894C459B0CD1B9450A5456F4606D100D53021D385063B8B7B691C99ECB87F229B867418450F35B X-C1DE0DAB: 0D63561A33F958A542B9F4DC5849C23F85988B684B8FF5D38F0AA2D9D6B58725F87CCE6106E1FC07E67D4AC08A07B9B01F9513A7CA91E555CB5012B2E24CD356 X-C8649E89: 1C3962B70DF3F0AD5177F0B940C8B66ECE892A7B2722663E91682638B966EB3F662256BEEFA9527F7182C02CCDAD33FF232473BB7CBCE76DE7200D7E2C759537E123399161E30484765E8D05F4C5965137FD76D11AF80A0D89F44D8421C6B771CC61A186120EFF8BEA455F16B58544A2557BDE0DD54B3590965026E5D17F6739C77C69D99B9914278E50E1F0597A6FD5CD72808BE417F3B9E0E7457915DAA85F X-D57D3AED: 3ZO7eAau8CL7WIMRKs4sN3D3tLDjz0dLbV79QFUyzQ2Ujvy7cMT6pYYqY16iZVKkSc3dCLJ7zSJH7+u4VD18S7Vl4ZUrpaVfd2+vE6kuoey4m4VkSEu530nj6fImhcD4MUrOEAnl0W826KZ9Q+tr5ycPtXkTV4k65bRjmOUUP8cvGozZ33TWg5HZplvhhXbhDGzqmQDTd6OAevLeAnq3Ra9uf7zvY2zzsIhlcp/Y7m53TZgf2aB4JOg4gkr2biojWWC/ZYCun+WG2JtbUl2TrA== X-Mailru-Sender: 11C2EC085EDE56FA38FD4C59F7EFE4078B0F5454A4491372AB46A6A8288B2F590DACDBF337005A97D51284F0FE6F529ABC7555A253F5B200DF104D74F62EE79D27EC13EC74F6107F4198E0F3ECE9B5443453F38A29522196 X-Mras: OK Subject: Re: [Tarantool-patches] [PATCH luajit] Fix ABC FOLD rule with constants. X-BeenThere: tarantool-patches@dev.tarantool.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Tarantool development patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , From: Maxim Kokryashkin via Tarantool-patches Reply-To: Maxim Kokryashkin Cc: tarantool-patches@dev.tarantool.org Errors-To: tarantool-patches-bounces@dev.tarantool.org Sender: "Tarantool-patches" Hi, Sergey! Thanks for the patch! Please consider my comments below. On Mon, Nov 13, 2023 at 06:05:01PM +0300, Sergey Kaplun wrote: > From: Mike Pall > > Reported by XmiliaH. > > (cherry-picked from commit c8bcf1e5fb8eb72c7e35604fdfd27bba512761bb) > > `fold_abc_k()` doesn't patch the first ABC check when the right constant > operand is negative. This leads to out-of-bounds access from the array > on a trace. This patch casts to uint32_t the operands to compare. If the It would be right to paraphrase this sentence like this: "This patch casts the operands to uint32_t for comparison." > right IR contains a negative integer, the second IR will always be > patched. Also, because the ABC check on the trace is unordered, this > guard will always fail. > > Also, this fold rule creates new instructions that reference operands > across PHIs. This opens the room for other optimizations (like DCE), so > some guards become eliminated, and we use out-of-bounds access from the > array part of the table on trace. This patch adds the missing > `PHIBARRIER()` check. > > Sergey Kaplun: > * added the description and the test for the problem > > Part of tarantool/tarantool#9145 > --- > Branch: https://github.com/tarantool/luajit/tree/skaplun/lj-794-abc-fold-constants > Tarantool PR: https://github.com/tarantool/tarantool/pull/9364 > Related issues: > * https://github.com/LuaJIT/LuaJIT/issues/794 > * https://github.com/tarantool/tarantool/issues/9145 > > src/lj_opt_fold.c | 5 +- > .../lj-794-abc-fold-constants.test.lua | 85 +++++++++++++++++++ > 2 files changed, 88 insertions(+), 2 deletions(-) > create mode 100644 test/tarantool-tests/lj-794-abc-fold-constants.test.lua > > diff --git a/src/lj_opt_fold.c b/src/lj_opt_fold.c > index 944a9ecc..6175f7c1 100644 > --- a/src/lj_opt_fold.c > +++ b/src/lj_opt_fold.c > diff --git a/test/tarantool-tests/lj-794-abc-fold-constants.test.lua b/test/tarantool-tests/lj-794-abc-fold-constants.test.lua > new file mode 100644 > index 00000000..f8609933 > --- /dev/null > +++ b/test/tarantool-tests/lj-794-abc-fold-constants.test.lua > @@ -0,0 +1,85 @@ > +-- Now test the second issue, when ABC optimization applies for > +-- operands across PHIs. > + > +-- XXX: Reset hotcounters to avoid collisions. > +jit.opt.start('hotloop=1') > + > +local tab_array = {} > +local small_tab = {MAGIC_UNUSED} > +local full_tab = {} > + > +-- First, create tables with different asizes, to be used in PHI. > +-- Create a large enough array part for the noticeable > +-- out-of-bounds access. > +for i = 1, 8 do > + full_tab[i] = MAGIC_UNUSED > +end > + > +-- We need 5 iterations to execute both the variant and the > +-- invariant parts of the trace below. > +for i = 1, 5 do > + -- On the 3rd iteration, the recording is started. > + if i > 3 then > + tab_array[i] = small_tab > + else > + tab_array[i] = full_tab > + end > +end > + > +local result > +local alias_tab = tab_array[1] > +-- Compile a trace. > +-- Run 5 iterations to execute both the variant and the invariant > +-- parts. > +for i = 1, 5 do > + local local_tab = alias_tab > + alias_tab = tab_array[i] > + -- Additional ABC check to fold. > + -- luacheck: ignore > + result = alias_tab[1] > + result = local_tab[8] > +end The black magic that happens here with tables is hard to understand. Please drop a comment with a detailed explanations for why do we need this complex `tab_array` construction and what effects does this have on IRs. > + > +test:is(result, nil, 'correct ABC constant rule across PHI') > + > +test:done(true) > -- > 2.42.0 >