[Tarantool-patches] [PATCH v3] lua: assert in lua_gettop() in case of negative stack size

[Nikita Pettik]

On 22 Jul 13:47, Igor Munkin wrote:
> I'll add more info for Nikita and Sergos since they are also involved
> to the investigation and the patch review.
> 
> On 22.07.20, Ilya Kosarev wrote:
> > 
> > Right, error fixed and now we found more details.
> 
> Here are the details:
> | (gdb) p ((struct port_lua *)&port)->L
> | $1 = (lua_State *) 0x41b8fa08
> | (gdb) p ((struct port_lua *)&port)
> | $2 = (port_lua *) 0x7ef54107fe30
> | (gdb) p ((struct port_lua *)&port)->vtab
> | $3 = (const port_vtab *) 0x708d60 <port_lua_vtab>
> | (gdb) p ((struct port_lua *)&port)->ref
> | $4 = 181
> 
> port->ref value is rotten since port->L is removed from Lua registry
> within <port_destroy> (i.e. <port_lua_destroy>) function. But the
> pointer to port->L is fine.
> 
> | (gdb) p ((struct port_lua *)&port)->size
> | $5 = -1
> 
> size value is initialized to -1 prior to encoding loop, so there is no
> <luamp_encode> call.
> 
> | (gdb) p ((struct port_lua *)&port)->out
> | $6 = (obuf *) 0x7f00098692e8
> | (gdb) p ((struct port_lua *)&port)->L->top
> | $7 = (TValue *) 0x4107fa08
> | (gdb) p ((struct port_lua *)&port)->L->base
> | $8 = (TValue *) 0x4107fa10
> 
> size value is initialized properly since L->base is greater than L->top
> (guest stack addresses grow downwards). Oops...
> 
> > Now the best assumption is that lua_State is somehow being broken by
> > user-called function (which name we now know).
> 
> The port (and ergo port->L coroutine) is created in scope of
> <box_process_lua> call. Considering the message type (IPROTO_CALL)
> <execute_lua_call> handler is called. Both Ilya and me found nothing
> suspicious there: the function to be called is found by its name and
> then execution enters Lua space.
> 
> Considering the results (<box_process_call> rc is 0) the call succeeds
> and execution proceeds with reply packing. There is also nothing
> corrupting port->L coroutine internal structure prior to the place
> port->size is initialized to -1.
> 
> > Now we will look into user code.
> 
> For now I see no reason to add even the assert, since Ilya's assumptions
> are confirmed.

Which one? Assuming that lua_gettop() returns negative value due
to spoiled lua state?