Skip to content

Commit 09a71b2

Browse files
Mike PallBuristan
authored andcommitted
Avoid out-of-range PC for stack overflow error from snapshot restore.
Reported by Sergey Kaplun. (cherry picked from commit e3fa3c4) In case when the saved PC in the snapshot is the first (0th index) PC in the prototype like JFUNC*, the subtraction to determine the previous PC in the `debug_framepc()` overflows and contains `NO_BCPOS` value. After that, the pos is greater than sizebc. Hence, the code below may interpret the bits in `pt->varinfo` like `bc_isret()` and assign an invalid value to `pos` to be returned. Further, it may lead to the assertion failure in the lj_debug_frameline(). This patch fixes it by pretending that this means the first non-header bytecode in the prototype. Also, this patch removes the skipcond introduced in the commit a74e5be ("test: conditionally disable flaky lj-1196"). The new test isn't added since the assertion failure depends on the specific memory address of the `varinfo`, so it is too hard to create a stable reproducer. Sergey Kaplun: * added the description for the problem Part of tarantool/tarantool#11691
1 parent a74e5be commit 09a71b2

File tree

2 files changed

+2
-9
lines changed

2 files changed

+2
-9
lines changed

src/lj_debug.c

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -101,6 +101,7 @@ static BCPos debug_framepc(lua_State *L, GCfunc *fn, cTValue *nextframe)
101101
pt = funcproto(fn);
102102
pos = proto_bcpos(pt, ins) - 1;
103103
#if LJ_HASJIT
104+
if (pos == NO_BCPOS) return 1; /* Pretend it's the first bytecode. */
104105
if (pos > pt->sizebc) { /* Undo the effects of lj_trace_exit for JLOOP. */
105106
if (bc_isret(bc_op(ins[-1]))) {
106107
GCtrace *T = (GCtrace *)((char *)(ins-1) - offsetof(GCtrace, startins));

test/tarantool-tests/lj-1196-partial-snap-restore.test.lua

Lines changed: 1 addition & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -4,15 +4,7 @@ local tap = require('tap')
44
-- in case of the stack overflow.
55
-- See also: https://github.com/LuaJIT/LuaJIT/issues/1196.
66

7-
local test = tap.test('lj-1196-partial-snap-restore'):skipcond({
8-
-- Disable test for Tarantool to avoid failures, see also:
9-
-- https://github.com/LuaJIT/LuaJIT/issues/1369.
10-
['Disabled for Tarantool due to lj-1369'] = _TARANTOOL,
11-
-- Also, it may fail on some non-arm64 runners stable after
12-
-- adding the skip condition above.
13-
['Disabled for x86/x64 due to lj-1369'] = jit.arch ~= 'arm64',
14-
})
15-
7+
local test = tap.test('lj-1196-partial-snap-restore')
168
test:plan(1)
179

1810
-- XXX: The reproducer below uses several stack slot offsets to

0 commit comments

Comments
 (0)