Add guard for obscure aliasing between open upvalues and SSA slots.

Thanks to Peter Cawley.

6 files changed, 8 insertions, 12 deletions

diff --git a/doc/status.html b/doc/status.html
index c305f47a..b3524397 100644
--- a/doc/status.html
+++ b/doc/status.html
@@ -89,12 +89,6 @@ hooks for non-Lua functions) and shows slightly different behavior
 in LuaJIT (no per-coroutine hooks, no tail call counting).
 </li>
 <li>
-Some checks are missing in the JIT-compiled code for obscure situations
-with <b>open upvalues aliasing</b> one of the SSA slots later on (or
-vice versa). Bonus points, if you can find a real world test case for
-this.
-</li>
-<li>
 Currently some <b>out-of-memory</b> errors from <b>on-trace code</b> are not
 handled correctly. The error may fall through an on-trace
 <tt>pcall</tt> or it may be passed on to the function set with
diff --git a/src/lj_asm_arm.h b/src/lj_asm_arm.h
index ff688746..a722a11f 100644
--- a/src/lj_asm_arm.h
+++ b/src/lj_asm_arm.h
@@ -976,7 +976,6 @@ static void asm_newref(ASMState *as, IRIns *ir)
 
 static void asm_uref(ASMState *as, IRIns *ir)
 {
-  /* NYI: Check that UREFO is still open and not aliasing a slot. */
   Reg dest = ra_dest(as, ir, RSET_GPR);
   if (irref_isk(ir->op1)) {
     GCfunc *fn = ir_kfunc(IR(ir->op1));
diff --git a/src/lj_asm_mips.h b/src/lj_asm_mips.h
index 4045fe80..66953aac 100644
--- a/src/lj_asm_mips.h
+++ b/src/lj_asm_mips.h
@@ -793,7 +793,6 @@ static void asm_newref(ASMState *as, IRIns *ir)
 
 static void asm_uref(ASMState *as, IRIns *ir)
 {
-  /* NYI: Check that UREFO is still open and not aliasing a slot. */
   Reg dest = ra_dest(as, ir, RSET_GPR);
   if (irref_isk(ir->op1)) {
     GCfunc *fn = ir_kfunc(IR(ir->op1));
diff --git a/src/lj_asm_ppc.h b/src/lj_asm_ppc.h
index e8f3d08b..e1b0c980 100644
--- a/src/lj_asm_ppc.h
+++ b/src/lj_asm_ppc.h
@@ -789,7 +789,6 @@ static void asm_newref(ASMState *as, IRIns *ir)
 
 static void asm_uref(ASMState *as, IRIns *ir)
 {
-  /* NYI: Check that UREFO is still open and not aliasing a slot. */
   Reg dest = ra_dest(as, ir, RSET_GPR);
   if (irref_isk(ir->op1)) {
     GCfunc *fn = ir_kfunc(IR(ir->op1));
diff --git a/src/lj_asm_x86.h b/src/lj_asm_x86.h
index 02918e23..db3e49f8 100644
--- a/src/lj_asm_x86.h
+++ b/src/lj_asm_x86.h
@@ -1215,7 +1215,6 @@ static void asm_newref(ASMState *as, IRIns *ir)
 
 static void asm_uref(ASMState *as, IRIns *ir)
 {
-  /* NYI: Check that UREFO is still open and not aliasing a slot. */
   Reg dest = ra_dest(as, ir, RSET_GPR);
   if (irref_isk(ir->op1)) {
     GCfunc *fn = ir_kfunc(IR(ir->op1));
diff --git a/src/lj_record.c b/src/lj_record.c
index ff7825ee..44b3667f 100644
--- a/src/lj_record.c
+++ b/src/lj_record.c
@@ -1343,13 +1343,17 @@ noconstify:
   /* Note: this effectively limits LJ_MAX_UPVAL to 127. */
   uv = (uv << 8) | (hashrot(uvp->dhash, uvp->dhash + HASH_BIAS) & 0xff);
   if (!uvp->closed) {
+    uref = tref_ref(emitir(IRTG(IR_UREFO, IRT_P32), fn, uv));
     /* In current stack? */
     if (uvval(uvp) >= tvref(J->L->stack) &&
         uvval(uvp) < tvref(J->L->maxstack)) {
       int32_t slot = (int32_t)(uvval(uvp) - (J->L->base - J->baseslot));
       if (slot >= 0) {  /* Aliases an SSA slot? */
+        emitir(IRTG(IR_EQ, IRT_P32),
+               REF_BASE,
+               emitir(IRT(IR_ADD, IRT_P32), uref,
+                      lj_ir_kint(J, (slot - 1) * -8)));
         slot -= (int32_t)J->baseslot;  /* Note: slot number may be negative! */
-        /* NYI: add IR to guard that it's still aliasing the same slot. */
         if (val == 0) {
           return getslot(J, slot);
         } else {
@@ -1359,7 +1363,9 @@ noconstify:
         }
       }
     }
-    uref = tref_ref(emitir(IRTG(IR_UREFO, IRT_P32), fn, uv));
+    emitir(IRTG(IR_UGT, IRT_P32),
+           emitir(IRT(IR_SUB, IRT_P32), uref, REF_BASE),
+           lj_ir_kint(J, (J->baseslot + J->maxslot) * 8));
   } else {
     needbarrier = 1;
     uref = tref_ref(emitir(IRTG(IR_UREFC, IRT_P32), fn, uv));