tarantool / luajit / 6849066481

89%

tarantool/master: 93%

Build Type

push

github

Committed by Buristan

Commit Message

Fix ABC FOLD rule with constants.

Reported by XmiliaH.

(cherry-picked from commit c8bcf1e5f)

`fold_abc_k()` doesn't patch the first ABC check when the right constant
operand is negative. This leads to out-of-bounds access from the array
on a trace. This patch casts to uint32_t the operands to compare. If the
right IR contains a negative integer, the second IR will always be
patched. Also, because the ABC check on the trace is unordered, this
guard will always fail.

Also, this fold rule creates new instructions that reference operands
across PHIs. This opens the room for other optimizations (like DCE), so
some guards become eliminated, and we use out-of-bounds access from the
array part of the table on trace. This patch adds the missing
`PHIBARRIER()` check.

Sergey Kaplun:
* added the description and the test for the problem

Part of tarantool/tarantool#9145

Coverage Stats

5361 of 5976 branches covered (0.0%)

Branch coverage included in aggregate %.

3 of 3 new or added lines in 1 file covered. (100.0%)

11 existing lines in 3 files now uncovered.

20537 of 23305 relevant lines covered (88.12%)

2743885.31 hits per line