luajit and ffi went wrong in while block

[qleein]

I develop a red-black tree base on luajit, but sometime could not found the minium node in the tree, The code behind would assert failed.
If add a line to the while block or use jit.off() to disable jit, it would work well.

        while node.left ~= sentinel do
            --If add a line here, it would work well even jit.on
            --print('node:', node)
            node = node.left
        end
        assert(node.left == sentinel)

OS: Ubuntu 16.04 or ArchLinux .
Code is Here, extra code is removed.

local ffi = require "ffi"


ffi.cdef[[
    typedef struct rbtree_node_s rbtree_node;
    struct rbtree_node_s {
        int                     key;
        struct rbtree_node_s    *left;
    };
]]


--for debug
local function traverse(array, size)
    for i = 0, size + 1 do
        print('i:', i, ' node:', array[i], ' nodekey:', array[i].key, ' node.left:', array[i].left)
    end
end


local function test()
    local size = 24

    local q = ffi.new("rbtree_node[?]", size + 2)
    ffi.fill(q, ffi.sizeof("rbtree_node", size + 2), 0)

    local sentinel = q[0]
    local root = q[1]
    root.key = 1
    root.left = sentinel

    for i = 2, size do
        q[i].key = i
        q[i-1].left = q[i]
        q[i].left = sentinel

        local node = root
        while node.left ~= sentinel do
            --If add a line here, it would work well even jit.on
            --print('node:', node)
            node = node.left
        end

        --print('index:', i)
        --print('node:', node)
        --print('node.key:', node.key)
        --print('node.left:', node.left)
        --traverse(q, size)
        assert(node == q[i])
        assert(node.left == sentinel)
    end
end


print('jit.off')
jit.off(test)
test()

print('jit.on')
jit.on(test)
test()

[agentzh]

@qlee001 Could you report to the official LuaJIT repository instead? See

https://github.com/LuaJIT/LuaJIT

I can confirm that the official v2.1 branch also has this issue. Thanks!

[qleein]

@agentzh Ok, thanks!

[qleein]

Bug has been fixed. Incorrect allocation sinking due to incomplete PHI remark