Merge pull request ruby#122 from jhawthorn/not_not_bug

maximecb · web-flow · commit fb2234818f7b · 2021-07-12T17:25:58.000-04:00
Demonstration of bug: ctx_set_opnd_type in jit_rb_obj_not corrupts types
diff --git a/yjit_codegen.c b/yjit_codegen.c
@@ -2257,7 +2257,10 @@ jit_guard_known_klass(jitstate_t *jit, ctx_t *ctx, VALUE known_klass, insn_opnd_
     val_type_t val_type = ctx_get_opnd_type(ctx, insn_opnd);
 
     if (known_klass == rb_cNilClass) {
+        RUBY_ASSERT(!val_type.is_heap);
         if (val_type.type != ETYPE_NIL) {
+            RUBY_ASSERT(val_type.type == ETYPE_UNKNOWN);
+
             ADD_COMMENT(cb, "guard object is nil");
             cmp(cb, REG0, imm_opnd(Qnil));
             jit_chain_guard(JCC_JNE, jit, ctx, max_chain_depth, side_exit);
@@ -2266,7 +2269,10 @@ jit_guard_known_klass(jitstate_t *jit, ctx_t *ctx, VALUE known_klass, insn_opnd_
         }
     }
     else if (known_klass == rb_cTrueClass) {
+        RUBY_ASSERT(!val_type.is_heap);
         if (val_type.type != ETYPE_TRUE) {
+            RUBY_ASSERT(val_type.type == ETYPE_UNKNOWN);
+
             ADD_COMMENT(cb, "guard object is true");
             cmp(cb, REG0, imm_opnd(Qtrue));
             jit_chain_guard(JCC_JNE, jit, ctx, max_chain_depth, side_exit);
@@ -2275,7 +2281,10 @@ jit_guard_known_klass(jitstate_t *jit, ctx_t *ctx, VALUE known_klass, insn_opnd_
         }
     }
     else if (known_klass == rb_cFalseClass) {
+        RUBY_ASSERT(!val_type.is_heap);
         if (val_type.type != ETYPE_FALSE) {
+            RUBY_ASSERT(val_type.type == ETYPE_UNKNOWN);
+
             ADD_COMMENT(cb, "guard object is false");
             STATIC_ASSERT(qfalse_is_zero, Qfalse == 0);
             test(cb, REG0, REG0);
@@ -2285,19 +2294,25 @@ jit_guard_known_klass(jitstate_t *jit, ctx_t *ctx, VALUE known_klass, insn_opnd_
         }
     }
     else if (known_klass == rb_cInteger && FIXNUM_P(sample_instance)) {
+        RUBY_ASSERT(!val_type.is_heap);
         // We will guard fixnum and bignum as though they were separate classes
         // BIGNUM can be handled by the general else case below
         if (val_type.type != ETYPE_FIXNUM || !val_type.is_imm) {
+            RUBY_ASSERT(val_type.type == ETYPE_UNKNOWN);
+
             ADD_COMMENT(cb, "guard object is fixnum");
             test(cb, REG0, imm_opnd(RUBY_FIXNUM_FLAG));
             jit_chain_guard(JCC_JZ, jit, ctx, max_chain_depth, side_exit);
             ctx_set_opnd_type(ctx, insn_opnd, TYPE_FIXNUM);
         }
     }
     else if (known_klass == rb_cSymbol && STATIC_SYM_P(sample_instance)) {
+        RUBY_ASSERT(!val_type.is_heap);
         // We will guard STATIC vs DYNAMIC as though they were separate classes
         // DYNAMIC symbols can be handled by the general else case below
         if (val_type.type != ETYPE_SYMBOL || !val_type.is_imm) {
+            RUBY_ASSERT(val_type.type == ETYPE_UNKNOWN);
+
             ADD_COMMENT(cb, "guard object is static symbol");
             STATIC_ASSERT(special_shift_is_8, RUBY_SPECIAL_SHIFT == 8);
             cmp(cb, REG0_8, imm_opnd(RUBY_SYMBOL_FLAG));
@@ -2306,7 +2321,10 @@ jit_guard_known_klass(jitstate_t *jit, ctx_t *ctx, VALUE known_klass, insn_opnd_
         }
     }
     else if (known_klass == rb_cFloat && FLONUM_P(sample_instance)) {
+        RUBY_ASSERT(!val_type.is_heap);
         if (val_type.type != ETYPE_FLONUM || !val_type.is_imm) {
+            RUBY_ASSERT(val_type.type == ETYPE_UNKNOWN);
+
             // We will guard flonum vs heap float as though they were separate classes
             ADD_COMMENT(cb, "guard object is flonum");
             mov(cb, REG1, REG0);
@@ -2334,6 +2352,8 @@ jit_guard_known_klass(jitstate_t *jit, ctx_t *ctx, VALUE known_klass, insn_opnd_
         jit_chain_guard(JCC_JNE, jit, ctx, max_chain_depth, side_exit);
     }
     else {
+        RUBY_ASSERT(!val_type.is_imm);
+
         // Check that the receiver is a heap object
         // Note: if we get here, the class doesn't have immediate instances.
         if (!val_type.is_heap) {
@@ -2387,18 +2407,19 @@ static bool
 jit_rb_obj_not(jitstate_t *jit, ctx_t *ctx, const struct rb_callinfo *ci, const rb_callable_method_entry_t *cme, rb_iseq_t *block, const int32_t argc)
 {
     const val_type_t recv_opnd = ctx_get_opnd_type(ctx, OPND_STACK(0));
-    x86opnd_t out_opnd = ctx_stack_opnd(ctx, 0);
 
     if (recv_opnd.type == ETYPE_NIL || recv_opnd.type == ETYPE_FALSE) {
         ADD_COMMENT(cb, "rb_obj_not(nil_or_false)");
+        ctx_stack_pop(ctx, 1);
+        x86opnd_t out_opnd = ctx_stack_push(ctx, TYPE_TRUE);
         mov(cb, out_opnd, imm_opnd(Qtrue));
-        ctx_set_opnd_type(ctx, OPND_STACK(0), TYPE_TRUE);
     }
     else if (recv_opnd.is_heap || recv_opnd.type != ETYPE_UNKNOWN) {
         // Note: recv_opnd.type != ETYPE_NIL && recv_opnd.type != ETYPE_FALSE.
         ADD_COMMENT(cb, "rb_obj_not(truthy)");
+        ctx_stack_pop(ctx, 1);
+        x86opnd_t out_opnd = ctx_stack_push(ctx, TYPE_FALSE);
         mov(cb, out_opnd, imm_opnd(Qfalse));
-        ctx_set_opnd_type(ctx, OPND_STACK(0), TYPE_FALSE);
     }
     else {
         // jit_guard_known_klass() already ran on the receiver which should
