[Tarantool-patches] [PATCH luajit] Add missing coercion when recording select(string, ...)

[Tarantool-patches] [PATCH luajit] Add missing coercion when recording select(string, ...)

[Sergey Kaplun via Tarantool-patches]

From: Mike Pall <mike>

Thanks to Peter Cawley.

(cherry picked from commit 92b89d005ab721a61bce6d471b052bcb236b81d7)

Before the patch, the recording of `select()` with a string argument
leads to the following IR:
| rcx   >  int CONV   "1"   int.num index
Where the operand has string type instead of number type.
This leads to the corresponding mcode:
| cvttsd2si ecx, xmm1
Where xmm1 has an undefined value. Thus leads to the undefined behaviour
for the recording trace.

This patch adds the missing coercion.

Sergey Kaplun:
* added the description and the test for the problem

Part of tarantool/tarantool#10199
---

Branch: https://github.com/tarantool/luajit/tree/skaplun/lj-1083-missing-tostring-coercion-in-select
Related issues:
* https://github.com/tarantool/tarantool/issues/10199
* https://github.com/LuaJIT/LuaJIT/issues/1083

 src/lj_record.c                               |  5 ++-
 ...ssing-tostring-coercion-in-select.test.lua | 39 +++++++++++++++++++
 2 files changed, 43 insertions(+), 1 deletion(-)
 create mode 100644 test/tarantool-tests/lj-1083-missing-tostring-coercion-in-select.test.lua

diff --git a/src/lj_record.c b/src/lj_record.c
index 96fe26d8..311d9fe7 100644
--- a/src/lj_record.c
+++ b/src/lj_record.c
@@ -1871,8 +1871,11 @@ static void rec_varg(jit_State *J, BCReg dst, ptrdiff_t nresults)
       TRef tr = TREF_NIL;
       ptrdiff_t idx = lj_ffrecord_select_mode(J, tridx, &J->L->base[dst-1]);
       if (idx < 0) goto nyivarg;
-      if (idx != 0 && !tref_isinteger(tridx))
+      if (idx != 0 && !tref_isinteger(tridx)) {
+	if (tref_isstr(tridx))
+	  tridx = emitir(IRTG(IR_STRTO, IRT_NUM), tridx, 0);
 	tridx = emitir(IRTGI(IR_CONV), tridx, IRCONV_INT_NUM|IRCONV_INDEX);
+      }
       if (idx != 0 && tref_isk(tridx)) {
 	emitir(IRTGI(idx <= nvararg ? IR_GE : IR_LT),
 	       fr, lj_ir_kint(J, frofs+8*(int32_t)idx));
diff --git a/test/tarantool-tests/lj-1083-missing-tostring-coercion-in-select.test.lua b/test/tarantool-tests/lj-1083-missing-tostring-coercion-in-select.test.lua
new file mode 100644
index 00000000..8089247f
--- /dev/null
+++ b/test/tarantool-tests/lj-1083-missing-tostring-coercion-in-select.test.lua
@@ -0,0 +1,39 @@
+local tap = require('tap')
+
+-- Test file to demonstrate LuaJIT incorrect recording of
+-- `select()` fast function.
+-- See also: https://github.com/LuaJIT/LuaJIT/issues/1083.
+
+local test = tap.test('lj-1083-missing-tostring-coercion-in-select'):skipcond({
+  ['Test requires JIT enabled'] = not jit.status(),
+})
+
+test:plan(1)
+
+-- Simplify the `jit.dump()` output.
+local select = select
+
+local function test_select(...)
+  local result
+  for _ = 1, 4 do
+    -- Before the patch, with the missed coercion to string, the
+    -- recording of `select()` below leads to the following IR:
+    -- | rcx   >  int CONV   "1"   int.num index
+    -- Where the operand has string type instead of number type.
+    -- This leads to the corresponding mcode:
+    -- | cvttsd2si ecx, xmm1
+    -- Where xmm1 has an undefined value. Thus leads to the
+    -- incorrect result for the call below.
+    result = select('1', ...)
+  end
+  return result
+end
+
+jit.opt.start('hotloop=1')
+
+-- XXX: amount of arguments is empirical, see the comment above.
+local result = test_select(1, 2, 3, 4)
+
+test:is(result, 1, 'corect select result after recording')
+
+test:done(true)
-- 
2.46.0

Re: [Tarantool-patches] [PATCH luajit] Add missing coercion when recording select(string, ...)

[Sergey Bronnikov via Tarantool-patches]

[-- Attachment #1: Type: text/plain, Size: 3677 bytes --]

Hi, Sergey,

thanks for the patch!

See minor comment below.

LGTM


On 23.09.2024 14:28, Sergey Kaplun wrote:
> From: Mike Pall <mike>
>
> Thanks to Peter Cawley.
>
> (cherry picked from commit 92b89d005ab721a61bce6d471b052bcb236b81d7)
>
> Before the patch, the recording of `select()` with a string argument
> leads to the following IR:
> | rcx   >  int CONV   "1"   int.num index
> Where the operand has string type instead of number type.
> This leads to the corresponding mcode:
> | cvttsd2si ecx, xmm1
> Where xmm1 has an undefined value. Thus leads to the undefined behaviour
> for the recording trace.
>
> This patch adds the missing coercion.
>
> Sergey Kaplun:
> * added the description and the test for the problem
>
> Part of tarantool/tarantool#10199
> ---
>
> Branch:https://github.com/tarantool/luajit/tree/skaplun/lj-1083-missing-tostring-coercion-in-select
> Related issues:
> *https://github.com/tarantool/tarantool/issues/10199
> *https://github.com/LuaJIT/LuaJIT/issues/1083
>
>   src/lj_record.c                               |  5 ++-
>   ...ssing-tostring-coercion-in-select.test.lua | 39 +++++++++++++++++++
>   2 files changed, 43 insertions(+), 1 deletion(-)
>   create mode 100644 test/tarantool-tests/lj-1083-missing-tostring-coercion-in-select.test.lua
>
> diff --git a/src/lj_record.c b/src/lj_record.c
> index 96fe26d8..311d9fe7 100644
> --- a/src/lj_record.c
> +++ b/src/lj_record.c
> @@ -1871,8 +1871,11 @@ static void rec_varg(jit_State *J, BCReg dst, ptrdiff_t nresults)
>         TRef tr = TREF_NIL;
>         ptrdiff_t idx = lj_ffrecord_select_mode(J, tridx, &J->L->base[dst-1]);
>         if (idx < 0) goto nyivarg;
> -      if (idx != 0 && !tref_isinteger(tridx))
> +      if (idx != 0 && !tref_isinteger(tridx)) {
> +	if (tref_isstr(tridx))
> +	  tridx = emitir(IRTG(IR_STRTO, IRT_NUM), tridx, 0);
>   	tridx = emitir(IRTGI(IR_CONV), tridx, IRCONV_INT_NUM|IRCONV_INDEX);
> +      }
>         if (idx != 0 && tref_isk(tridx)) {
>   	emitir(IRTGI(idx <= nvararg ? IR_GE : IR_LT),
>   	       fr, lj_ir_kint(J, frofs+8*(int32_t)idx));
> diff --git a/test/tarantool-tests/lj-1083-missing-tostring-coercion-in-select.test.lua b/test/tarantool-tests/lj-1083-missing-tostring-coercion-in-select.test.lua
> new file mode 100644
> index 00000000..8089247f
> --- /dev/null
> +++ b/test/tarantool-tests/lj-1083-missing-tostring-coercion-in-select.test.lua
> @@ -0,0 +1,39 @@
> +local tap = require('tap')
> +
> +-- Test file to demonstrate LuaJIT incorrect recording of
> +-- `select()` fast function.
> +-- See also:https://github.com/LuaJIT/LuaJIT/issues/1083.
> +
> +local test = tap.test('lj-1083-missing-tostring-coercion-in-select'):skipcond({
> +  ['Test requires JIT enabled'] = not jit.status(),
> +})
> +
> +test:plan(1)
> +
> +-- Simplify the `jit.dump()` output.
> +local select = select
> +
> +local function test_select(...)
> +  local result
> +  for _ = 1, 4 do
> +    -- Before the patch, with the missed coercion to string, the
> +    -- recording of `select()` below leads to the following IR:
> +    -- | rcx   >  int CONV   "1"   int.num index
> +    -- Where the operand has string type instead of number type.
> +    -- This leads to the corresponding mcode:
> +    -- | cvttsd2si ecx, xmm1
> +    -- Where xmm1 has an undefined value. Thus leads to the
> +    -- incorrect result for the call below.
> +    result = select('1', ...)
> +  end
> +  return result
> +end
> +
> +jit.opt.start('hotloop=1')
> +
> +-- XXX: amount of arguments is empirical, see the comment above.
> +local result = test_select(1, 2, 3, 4)
> +
> +test:is(result, 1, 'corect select result after recording')

s/corect/correct/


> +
> +test:done(true)

[-- Attachment #2: Type: text/html, Size: 4803 bytes --]

Re: [Tarantool-patches] [PATCH luajit] Add missing coercion when recording select(string, ...)

[Sergey Kaplun via Tarantool-patches]

Hi, Sergey!
Thanks for the review!
Fixed your comment and force-pushed the branch.

On 24.09.24, Sergey Bronnikov wrote:
> Hi, Sergey,
> 
> thanks for the patch!
> 
> See minor comment below.
> 
> LGTM
> 
> 
> On 23.09.2024 14:28, Sergey Kaplun wrote:

<snipped>

> > +
> > +test:is(result, 1, 'corect select result after recording')
> 
> s/corect/correct/

Fixed, thanks!

===================================================================
diff --git a/test/tarantool-tests/lj-1083-missing-tostring-coercion-in-select.test.lua b/test/tarantool-tests/lj-1083-missing-tostring-coercion-in-select.test.
lua
index 8089247f..5145efd5 100644
--- a/test/tarantool-tests/lj-1083-missing-tostring-coercion-in-select.test.lua
+++ b/test/tarantool-tests/lj-1083-missing-tostring-coercion-in-select.test.lua
@@ -34,6 +34,6 @@ jit.opt.start('hotloop=1')
 -- XXX: amount of arguments is empirical, see the comment above.
 local result = test_select(1, 2, 3, 4)
 
-test:is(result, 1, 'corect select result after recording')
+test:is(result, 1, 'correct select result after recording')
 
 test:done(true)
===================================================================

> 
> 
> > +
> > +test:done(true)

-- 
Best regards,
Sergey Kaplun

Re: [Tarantool-patches] [PATCH luajit] Add missing coercion when recording select(string, ...)

[Maxim Kokryashkin via Tarantool-patches]

Hi, Sergey!
Thanks for the patch!
LGTM

Re: [Tarantool-patches] [PATCH luajit] Add missing coercion when recording select(string, ...)

[Sergey Kaplun via Tarantool-patches]

I've applied the patch into all long-term branches in tarantool/luajit
and bumped a new version in master [1], release/3.2 [2] and
release/2.11 [3].

[1]: https://github.com/tarantool/tarantool/pull/10712
[2]: https://github.com/tarantool/tarantool/pull/10713
[3]: https://github.com/tarantool/tarantool/pull/10714

-- 
Best regards,
Sergey Kaplun