Improve alias analysis of upvalues using a disambiguation hash value.

All upvalue objects hold a disambiguation hash value now.
It's built from the parent prototype and the slot number.
Different hash values imply the upvalues cannot alias.
Same hash values don't imply anything (collision or different closures).
Upvalue disambiguation makes use of a reduced hash due to IR contraints.

6 files changed, 30 insertions, 13 deletions

diff --git a/src/lj_asm.c b/src/lj_asm.c
index 50f877e7..20d26278 100644
--- a/src/lj_asm.c
+++ b/src/lj_asm.c
@@ -1105,7 +1105,7 @@ static void asm_fuseahuref(ASMState *as, IRRef ref, RegSet allow)
     case IR_UREFC:
       if (irref_isk(ir->op1)) {
         GCfunc *fn = ir_kfunc(IR(ir->op1));
-        GCupval *uv = &gcref(fn->l.uvptr[ir->op2])->uv;
+        GCupval *uv = &gcref(fn->l.uvptr[(ir->op2 >> 8)])->uv;
         as->mrm.ofs = ptr2addr(&uv->tv);
         as->mrm.base = as->mrm.idx = RID_NONE;
         return;
@@ -1702,7 +1702,7 @@ static void asm_uref(ASMState *as, IRIns *ir)
     Reg dest = ra_dest(as, ir, RSET_GPR);
     if (irref_isk(ir->op1)) {
       GCfunc *fn = ir_kfunc(IR(ir->op1));
-      MRef *v = &gcref(fn->l.uvptr[ir->op2])->uv.v;
+      MRef *v = &gcref(fn->l.uvptr[(ir->op2 >> 8)])->uv.v;
       emit_rma(as, XO_MOV, dest, v);
     } else {
       Reg uv = ra_scratch(as, RSET_GPR);
@@ -1716,7 +1716,7 @@ static void asm_uref(ASMState *as, IRIns *ir)
         emit_rmro(as, XO_MOV, dest, uv, offsetof(GCupval, v));
       }
       emit_rmro(as, XO_MOV, uv, func,
-                (int32_t)offsetof(GCfuncL, uvptr) + 4*(int32_t)ir->op2);
+                (int32_t)offsetof(GCfuncL, uvptr) + 4*(int32_t)(ir->op2 >> 8));
     }
   }
 }
diff --git a/src/lj_func.c b/src/lj_func.c
index 231701db..078ced92 100644
--- a/src/lj_func.c
+++ b/src/lj_func.c
@@ -169,10 +169,11 @@ GCfunc *lj_func_newL_gc(lua_State *L, GCproto *pt, GCfuncL *parent)
   nuv = fn->l.nupvalues;
   base = L->base;
   for (i = 0; i < nuv; i++) {
-    ptrdiff_t v = pt->uv[i];
+    uint32_t v = pt->uv[i];
     GCupval *uv;
     if ((v & 0x8000)) {
       uv = func_finduv(L, base + (v & 0xff));
+      uv->dhash = (uint32_t)(uintptr_t)gcref(parent->pt) ^ (v << 24);
     } else {
       uv = &gcref(puv[v])->uv;
     }
diff --git a/src/lj_obj.h b/src/lj_obj.h
index 85d904f3..ecce03ed 100644
--- a/src/lj_obj.h
+++ b/src/lj_obj.h
@@ -397,7 +397,7 @@ typedef struct GCupval {
     };
   };
   MRef v;               /* Points to stack slot (open) or above (closed). */
-  int32_t unusedv;      /* For consistent alignment. */
+  uint32_t dhash;       /* Disambiguation hash: dh1 != dh2 => cannot alias. */
 } GCupval;
 
 #define uvprev(uv_)     (&gcref((uv_)->prev)->uv)
diff --git a/src/lj_opt_fold.c b/src/lj_opt_fold.c
index 41c87e2f..a8550e1f 100644
--- a/src/lj_opt_fold.c
+++ b/src/lj_opt_fold.c
@@ -1146,12 +1146,12 @@ LJFOLDF(cse_uref)
   if (LJ_LIKELY(J->flags & JIT_F_OPT_CSE)) {
     IRRef ref = J->chain[fins->o];
     GCfunc *fn = ir_kfunc(fleft);
-    GCupval *uv = gco2uv(gcref(fn->l.uvptr[fins->op2]));
+    GCupval *uv = gco2uv(gcref(fn->l.uvptr[(fins->op2 >> 8)]));
     while (ref > 0) {
       IRIns *ir = IR(ref);
       if (irref_isk(ir->op1)) {
         GCfunc *fn2 = ir_kfunc(IR(ir->op1));
-        if (gco2uv(gcref(fn2->l.uvptr[ir->op2])) == uv) {
+        if (gco2uv(gcref(fn2->l.uvptr[(ir->op2 >> 8)])) == uv) {
           if (fins->o == IR_UREFO && gcstep_barrier(J, ref))
             break;
           return ref;
diff --git a/src/lj_opt_mem.c b/src/lj_opt_mem.c
index 521c8590..57948311 100644
--- a/src/lj_opt_mem.c
+++ b/src/lj_opt_mem.c
@@ -277,12 +277,17 @@ static AliasRet aa_uref(IRIns *refa, IRIns *refb)
 {
   if (refa->o != refb->o)
     return ALIAS_NO;  /* Different UREFx type. */
-  if (refa->op1 != refb->op1)
-    return ALIAS_MAY;  /* Different function. */
-  else if (refa->op2 == refb->op2)
-    return ALIAS_MUST;  /* Same function, same upvalue idx. */
-  else
-    return ALIAS_NO;  /* Same function, different upvalue idx. */
+  if (refa->op1 == refb->op1) {  /* Same function. */
+    if (refa->op2 == refb->op2)
+      return ALIAS_MUST;  /* Same function, same upvalue idx. */
+    else
+      return ALIAS_NO;  /* Same function, different upvalue idx. */
+  } else {  /* Different functions, check disambiguation hash values. */
+    if (((refa->op2 ^ refb->op2) & 0xff))
+      return ALIAS_NO;  /* Upvalues with different hash values cannot alias. */
+    else
+      return ALIAS_MAY;  /* No conclusion can be drawn for same hash value. */
+  }
 }
 
 /* ULOAD forwarding. */
diff --git a/src/lj_record.c b/src/lj_record.c
index 0dfd1f73..b998c020 100644
--- a/src/lj_record.c
+++ b/src/lj_record.c
@@ -781,6 +781,15 @@ static TRef rec_idx(jit_State *J, RecordIndex *ix)
 
 /* -- Upvalue access ------------------------------------------------------ */
 
+/* Shrink disambiguation hash into an 8 bit value. */
+static uint32_t shrink_dhash(uint32_t lo, uint32_t hi)
+{
+  lo ^= hi; hi = lj_rol(hi, 14);
+  lo -= hi; hi = lj_rol(hi, 5);
+  hi ^= lo; hi -= lj_rol(lo, 27);
+  return (hi & 0xff);
+}
+
 /* Record upvalue load/store. */
 static TRef rec_upvalue(jit_State *J, uint32_t uv, TRef val)
 {
@@ -788,6 +797,8 @@ static TRef rec_upvalue(jit_State *J, uint32_t uv, TRef val)
   TRef fn = getcurrf(J);
   IRRef uref;
   int needbarrier = 0;
+  /* Note: this effectively limits LJ_MAX_UPVAL to 127. */
+  uv = (uv << 8) | shrink_dhash(uvp->dhash, uvp->dhash-0x04c11db7);
   if (!uvp->closed) {
     /* In current stack? */
     if (uvval(uvp) >= J->L->stack && uvval(uvp) < J->L->maxstack) {