Logic bug

[Gavin Wraith <gavin@...>]

Some code plus disassembly (5.2(alpha)):

arrow = "=>"
--[[
     1 SETTABUP  0 -1 -2 ; _ENV "arrow" "=>"
--]]
print("(7 or true) and (8 or true)",arrow,(7 or true) and (8 or true))
--[[
     2 GETTABUP  0 0 -3 ; _ENV "print"
     3 LOADK     1 -4 ; "(7 or true) and (8 or true)"
     4 GETTABUP  2 0 -1 ; _ENV "arrow"
     5 LOADK     3 -5 ; 7
     6 TEST      3 0 1
     7 JMP       0 ; to 8
     8 LOADK     3 -6 ; 8
     9 TEST      3 0 1
    10 JMP       1 ; to 12
    11 LOADBOOL  3 1 0
    12 CALL      0 4 1      ; correct result: 8
--]]
print("(7 or true) and (true or 8)", arrow,(7 or true) and (true or 8))
--[[
    13 GETTABUP  0 0 -3 ; _ENV "print"
    14 LOADK     1 -7 ; "(7 or true) and (true or 8)"
    15 GETTABUP  2 0 -1 ; _ENV "arrow"
    16 LOADK     3 -5 ; 7
    17 TEST      3 0 1
    18 JMP       5 ; to 24
    19 JMP       3 ; to 23
    20 LOADK     3 -6 ; 8
    21 JMP       2 ; to 24
    22 LOADBOOL  3 0 1
    23 LOADBOOL  3 1 0
    24 CALL      0 4 1
    25 RETURN    0 1       ; bug! incorrect result: 7
--]]

It looks to me as if the JMPs in lines 18 and 19 each overshoot by 1.
I am also puzzled as to why line 20 is unreachable. Surely, without
optimizations, every alternative should appear as a possible path of
execution. I also do not understand how line 22 can get there,
seeing that "false" does not appear in the source text.

The bug appears to start at line 18. I would have expected

     18 JMP       6 ; to 25
     19 LOADBOOL  3 1 0
     20 TEST      3 0 1
     21 JMP       2 ; to 24
     22 LOADK     3 -6 ; 8
     23 JMP       1 ; to 25
     24 LOADBOOL  3 1 0
     25 CALL      0 4 1
     26 RETURN    0 1

but maybe I have not understood the code-planting functions properly.

Somehow lcode.c needs to use the reduction

     (anything or true) and expr  --> expr

and, dually,

     (anything and false|nil) or expr --> expr

so that lines like 5,6,7 could be omitted.

-- 
Gavin Wraith (gavin@wra1th.plus.com)
Home page: http://www.wra1th.plus.com/