tarantool / luajit / 8534112221

71%

tarantool/master: 93%

Build Type

push

github

Committed by Buristan

Commit Message

Prevent down-recursion for side traces.

Thanks to Sergey Kaplun.

(cherry picked from commit cae361187)

Assume we have the root trace that uses some spill slots with the
corresponding stack adjustment. Then its side trace will restore the
stack only at its tail. It may look like the following:

| ---- TRACE 4 mcode 1247
| 55557f7df953  mov rax, [r14-0xe28]
| 55557f7df95a  mov rax, [rax+0x30]
| 55557f7df95e  sub rax, rdx
| 55557f7df961  cmp rax, +0x68
| 55557f7df965  jb 0x55557f7d004c       ->0
| 55557f7df96b  add rsp, -0x10
| ...
| 55557f6efa71  cmp dword [rdx+0x4], -0x05
| 55557f6efa75  jnz 0x55557f6e004c      ->0
| ...
| 55557f7dfe29  add rsp, +0x10
| 55557f7dfe2d  jmp 0x5555556fe573
| ---- TRACE 4 stop -> stitch
|
| ---- TRACE 5 start 4/0
| ---- TRACE 5 mcode 101
| 55557f6ef9d4  mov dword [0x40000518], 0x5
| ...
| 55557f6efa30  add rsp, +0x10
| 55557f6efa34  jmp 0x55557f6ef9d4
| ---- TRACE 5 stop -> down-recursion

Such side traces have no stack adjustment at their heads since their
stack adjustment is inherited from the parent trace. The issue occurs if
the side trace has a down-recursion, as mentioned above. Before any
exit, we can jump back to the start of the trace several times with
growing `rsp`. In that case, the `rsp` is restored incorrectly after
exiting from the trace.

This patch forbids down-recursion for non-root traces.

Sergey Kaplun:
* added the description and the test for the problem

Part of tarantool/tarantool#9595

Run Details

5660 of 6018 branches covered (94.05%)

Branch coverage included in aggregate %.

1 of 1 new or added line in 1 file covered. (100.0%)

12 existing lines in 4 files now uncovered.

21598 of 23416 relevant lines covered (92.24%)

2926632.1 hits per line