tarantool / luajit / 13563914180

93%

tarantool/master: 93%

Build Type

push

github

Committed by Buristan

Commit Message

Fix IR_ABC hoisting.

Reported by pwnhacker0x18. Fixed by Peter Cawley.

(cherry picked from commit 7369eff67)

The `IR_ABC` has 2 different types:
* `IRT_INT` for generic condition check.
* `IRT_P32` as a marker for the invariant checks for upper and lower
  boundaries of the loop index. These checks may be dropped during the
  folding optimization in recording the variant part of the loop.
The checks may be dropped if the instruction is not PHI, the first
operand is invariant, and the upper bound of the array part of the table
isn't changed, or the table itself isn't changed on the trace.

The checks in the `abc_invar` fold rule assume that the constant values
of the first operand of ABC may be dropped. But when this constant value
comes from the folding chain that does CSE, the check is still necessary
if the original instruction (not resulting after loop optimization
substitution and the folding chain) isn't a constant.

Hence, this patch additionally singularizes the `IRT_U32` type for the
`IR_ABC` in the case when the asize is a constant on the trace so it can
be simply dropped from the invariant part of the loop. For `IRT_P32`
type, this patch adds a check that the first operand isn't a constant to
be sure that it isn't a result of the fold chain.

Sergey Kaplun:
* added the description and the test for the problem

Part of tarantool/tarantool#11055

Coverage Stats

5699 of 6037 branches covered (94.4%)

Branch coverage included in aggregate %.

5 of 5 new or added lines in 2 files covered. (100.0%)

12 existing lines in 2 files now uncovered.

21711 of 23444 relevant lines covered (92.61%)

2962773.5 hits per line