fold: keep type of emitted CONV in sync with its mode

When emitting CONV make sure that its type matches its destination IRType.

This keeps IR fully internally consistent with respect to types - i.e. if
we push narrowing CONV Dt.St upwards through an arithmetic operation of type
St we end up with arithmetic operation of type Dt and two convertions
CONV Dt.St which narrow the operands.

Igor Munkin:
* added a test for the problem
* backported the original patch to tarantool/luajit repo
* stripped some words not related to the patch itself

Fixes LuaJIT#524

Signed-off-by: Vyacheslav Egorov <[email protected]>
Signed-off-by: Igor Munkin <[email protected]>

Author: mraleph

src/lj_opt_fold.c

@@ -1261,8 +1261,8 @@ LJFOLDF(simplify_conv_narrow)
   IRType t = irt_type(fins->t);
   IRRef op1 = fleft->op1, op2 = fleft->op2, mode = fins->op2;
   PHIBARRIER(fleft);
-  op1 = emitir(IRTI(IR_CONV), op1, mode);
-  op2 = emitir(IRTI(IR_CONV), op2, mode);
+  op1 = emitir(IRT(IR_CONV, t), op1, mode);
+  op2 = emitir(IRT(IR_CONV, t), op2, mode);
   fins->ot = IRT(op, t);
   fins->op1 = op1;
   fins->op2 = op2;

test/fold_bug_LuaJIT_524.test.lua

@@ -0,0 +1,24 @@
+#!/usr/bin/env tarantool
+
+local tap = require('tap')
+local ffi = require('ffi')
+
+local test = tap.test("LuaJIT 524")
+test:plan(1)
+
+-- Test file to demonstrate LuaJIT folding machinery incorrect behaviour,
+-- details:
+--     https://github.com/LuaJIT/LuaJIT/issues/524
+--     https://github.com/moonjit/moonjit/issues/37
+
+jit.opt.start(0, "fold", "cse", "fwd", "hotloop=1")
+
+local sq = ffi.cast("uint32_t", 42)
+
+for _ = 1, 3 do
+    sq = ffi.cast("uint32_t", sq * sq)
+end
+
+test:is(tonumber(sq), math.fmod(math.pow(42, 8), math.pow(2, 32)))
+
+test:check()