Handle HOTCNT in for loop

ivbondarev · ivbondarev · commit 2265a15ed68e · 2024-10-01T17:47:36.000+04:00
diff --git a/src/jit/lj_record.c b/src/jit/lj_record.c
@@ -1812,6 +1812,9 @@ void lj_record_ins(jit_State *J)
         if (!tvistruecond(&J2G(J)->tmptv2))
           lj_trace_err(J, LJ_TRERR_GFAIL);
 
+        if (bc_op(ins) == BC_HOTCNT)
+          ins = *(J->pc - 2);
+
         /*
          * In case of tail call, ins will point to CALL from caller function,
          * not to the original CALLT/CALLMT made in callee.
diff --git a/tests/impl/uJIT-tests-Lua/suite/chunks/table/rindex/tailcall.lua b/tests/impl/uJIT-tests-Lua/suite/chunks/table/rindex/tailcall.lua
@@ -53,3 +53,17 @@ do --- rindex return value check must not be broken
 	bar(tab)
 	bar(tab) -- should exit normally
 end
+
+do --- ensure correct HOTCNT handling (i.e. applying LJ_POST_FFSPECRET while J->pc-1 points to HOTCNT)
+	local function foo(tab)
+		return ujit.table.rindex(tab, "k1", "k2")
+	end
+
+	local function bar(tab)
+		for _ = 1, 5 do
+			foo(tab)
+		end
+	end
+
+	bar({k1 = {k2 = false}})
+end
diff --git a/tests/impl/uJIT-tests-Lua/suite/table.t b/tests/impl/uJIT-tests-Lua/suite/table.t
@@ -301,6 +301,15 @@ $tester->run('rindex/tailcall.lua', args => '-Ohotloop=3 -Ohotexit=2 -p-')
                       0027.+>.+p32.RETF\s
                       .+SNAP.+\#1\s
                       .+TRACE.6.mcode.+/xs)
+  ->stdout_matches(qr/.+TRACE.7.IR.+\s
+                      0025.rax.+p64.CALLL.+lj_tab_rawrindex_jit.+\(0024\)\s
+                      0026.+>.+p64.NE.+0025.+\[NULL\]\s
+                      0027.+>.+fal.TVLOAD.0025\s
+                      .+LOOP.+\s
+                      0034.rax.+p64.CALLL.+lj_tab_rawrindex_jit.+\(0033\)\s
+                      0035.+>.+p64.NE.+0034.+\[NULL\]\s
+                      0036.+>.+fal.TVLOAD.0034\s
+                      .+TRACE.7.mcode.+/xs)
 ;
 
 exit;
