fold: keep type of emitted CONV in sync with its mode

When emitting CONV make sure that its type matches its destination IRType. This keeps IR fully internally consistent with respect to types - i.e. if we push narrowing CONV Dt.St upwards through an arithmetic operation of type St we end up with arithmetic operation of type Dt and two convertions CONV Dt.St which narrow the operands. Igor Munkin: * added a test for the problem * backported the original patch to tarantool/luajit repo * stripped some words not related to the patch itself Fixes LuaJIT#524 Signed-off-by: Vyacheslav Egorov <[email protected]> Signed-off-by: Igor Munkin <[email protected]>
tarantool · Dec 5, 2019 · c9588f5 · c9588f5
1 parent a171d01
commit c9588f5
Show file tree

Hide file tree

Showing 2 changed files with 26 additions and 2 deletions.
diff --git a/src/lj_opt_fold.c b/src/lj_opt_fold.c
@@ -1261,8 +1261,8 @@ LJFOLDF(simplify_conv_narrow)
   IRType t = irt_type(fins->t);
   IRRef op1 = fleft->op1, op2 = fleft->op2, mode = fins->op2;
   PHIBARRIER(fleft);
-  op1 = emitir(IRTI(IR_CONV), op1, mode);
-  op2 = emitir(IRTI(IR_CONV), op2, mode);
+  op1 = emitir(IRT(IR_CONV, t), op1, mode);
+  op2 = emitir(IRT(IR_CONV, t), op2, mode);
   fins->ot = IRT(op, t);
   fins->op1 = op1;
   fins->op2 = op2;

diff --git a/test/fold_bug_LuaJIT_524.test.lua b/test/fold_bug_LuaJIT_524.test.lua
@@ -0,0 +1,24 @@
+#!/usr/bin/env tarantool
+
+local tap = require('tap')
+local ffi = require('ffi')
+
+local test = tap.test("LuaJIT 524")
+test:plan(1)
+
+-- Test file to demonstrate LuaJIT folding machinery incorrect behaviour,
+-- details:
+--     https://github.com/LuaJIT/LuaJIT/issues/524
+--     https://github.com/moonjit/moonjit/issues/37
+
+jit.opt.start(0, "fold", "cse", "fwd", "hotloop=1")
+
+local sq = ffi.cast("uint32_t", 42)
+
+for _ = 1, 3 do
+    sq = ffi.cast("uint32_t", sq * sq)
+end
+
+test:is(tonumber(sq), math.fmod(math.pow(42, 8), math.pow(2, 32)))
+
+test:check()