[Tarantool-patches] [PATCH luajit] Fix frame traversal for __gc handler frames.

[sergos]

Hi!

You were absolutely right on my MacOS testing.
With your fixes applied - LGTM.

Sergos


> On 8 Oct 2021, at 11:39, Sergey Kaplun <skaplun at tarantool.org> wrote:
> 
> Hi, Sergos!
> 
> Thanks for the review!
> 
> On 07.10.21, sergos wrote:
>> Hi!
>> Thanks for the patch! See my 2 comments below.
>> 
>> Sergos
>> 
>>> On 5 Oct 2021, at 13:28, Sergey Kaplun <skaplun at tarantool.org> wrote:
>>> 
>>> From: Mike Pall <mike>
>>> 
>>> Reported by Changochen.
>>> 
>>> (cherry picked from 53f82e6e2e858a0a62fd1a2ff47e9866693382e6)
>>> 
>>> Additional stack traversal is needed to find an error function set for
>>   ^^^                          ^^^
>> Additional to what?            
>> 				
> 
> I mean additional to stack traversal during error raising to find
> protected frame, but it is confusing, so I rephrase it as you suggested.
> 
>>> handling runtime errors. cframe unwinding is missed for a C protected
>>> frame during this stack traversal.
>> 
>> I would rephrase - 
>> A cframe unwinding is miseed for a C protected frame during a serach for 
>> an error function to handle a runtime error. 
>> 
>>> It leads to undefined behaviour or
>>> crash, when raising a runtime error on stack with the CP frame before an
>>> error function handler (for example, an error in __gc handler).
>>> 
>>> This patch adds missing unwinding for CP frame.
>>> 
>>> Sergey Kaplun:
>>> * added the description and the test for the problem
>>> ---
> 
> The new commit message is the following:
> 
> | Fix frame traversal for __gc handler frames.
> |
> | Reported by Changochen.
> |
> | (cherry picked from 53f82e6e2e858a0a62fd1a2ff47e9866693382e6)
> |
> | A cframe unwinding is missed for a C protected frame during a search for
> | an error function to handle a runtime error. It leads to undefined
> | behaviour or crash, when raising a runtime error on stack with the CP
> | frame before an error function handler (for example, an error in __gc
> | handler).
> |
> | This patch adds missing unwinding for CP frame.
> |
> | Sergey Kaplun:
> | * added the description and the test for the problem
> 
> Branch is force-pushed.
> 
>>> 
>>> Branch: https://github.com/tarantool/luajit/tree/skaplun/lj-601-fix-gc-finderrfunc
>>> Tarantool branch: https://github.com/tarantool/tarantool/tree/skaplun/gh-noticket-fix-gc-finderrfunc
>>> LuaJIT issue: https://github.com/LuaJIT/LuaJIT/issues/601
>>> 
>>> src/lj_err.c                                  |  1 +
>>> .../lj-601-fix-gc-finderrfunc.test.lua        | 25 +++++++++++++++++++
>>> 2 files changed, 26 insertions(+)
>>> create mode 100644 test/tarantool-tests/lj-601-fix-gc-finderrfunc.test.lua
>>> 
>>> diff --git a/src/lj_err.c b/src/lj_err.c
>>> index b6be357e..b520b3d3 100644
>>> --- a/src/lj_err.c
>>> +++ b/src/lj_err.c
>>> @@ -585,6 +585,7 @@ static ptrdiff_t finderrfunc(lua_State *L)
>>>      if (cframe_canyield(cf)) return 0;
>>>      if (cframe_errfunc(cf) >= 0)
>>> 	return cframe_errfunc(cf);
>>> +      cf = cframe_prev(cf);
>>>      frame = frame_prevd(frame);
>>>      break;
>>>    case FRAME_PCALL:
>>> diff --git a/test/tarantool-tests/lj-601-fix-gc-finderrfunc.test.lua b/test/tarantool-tests/lj-601-fix-gc-finderrfunc.test.lua
>>> new file mode 100644
>>> index 00000000..d8d79100
>>> --- /dev/null
>>> +++ b/test/tarantool-tests/lj-601-fix-gc-finderrfunc.test.lua
>> 
>> Unfortunately the test passes on the ’tarantool’ branch 
>> 
>> s-ostanevich:luajit s.ostanevich$ git checkout tarantool
>> Switched to branch 'tarantool'
>> s-ostanevich:luajit s.ostanevich$ git clean -xdff
>> […]
>> s-ostanevich:luajit s.ostanevich$ cmake .
>> […]
>> s-ostanevich:luajit s.ostanevich$ make
>> […]
>> [100%] Built target libluajit_shared
>> [100%] Built target libluajit
>> [100%] Built target luajit
>> s-ostanevich:luajit s.ostanevich$ git checkout   skaplun/lj-601-fix-gc-finderrfunc
>> s-ostanevich:luajit s.ostanevich$ cd test/tarantool-tests
>> s-ostanevich:tarantool-tests s.ostanevich$ ../../src/luajit lj-601-fix-gc-finderrfunc.test.lua 
>> TAP version 13
>> 1..1
>> ok - successfully collectgarbage with error
> 
> Wild guess: it doesn't fail on Mac due to GC64 ;).
> See CI [1] to check my hypothesis.
> 
>> 
>>> @@ -0,0 +1,25 @@
>>> +local tap = require('tap')
>>> +
>>> +local test = tap.test('lj-601-fix-gc-finderrfunc')
>>> +test:plan(1)
>>> +
>>> +-- Test file to demonstrate LuaJIT incorrect behaviour, when
>>> +-- throwing error in __gc finalizer.
>>> +-- See also, https://github.com/LuaJIT/LuaJIT/issues/601.
>>> +
>>> +collectgarbage()
>>> +
>>> +local a = newproxy(true)
>>> +getmetatable(a).__gc = function()
>>> +  -- Function to raise error via `lj_err_run()` inside __gc.
>>> +  local _ = load(function() collectgarbage()() end)
>>> +end
>>> +
>>> +-- XXX: Generate a small bunch of proxies. Need several to call
>>> +-- `collectgarbage()` on another proxy inside __gc. N cycles is
>>> +-- empirical number.
>>> +for _ = 1, 4 do newproxy(a) end
>>> +collectgarbage('collect')
>>> +
>>> +test:ok(true, 'successfully collectgarbage with error')
>>> +os.exit(test:check() and 0 or 1)
>>> -- 
>>> 2.31.0
>>> 
>> 
> 
> [1]: https://github.com/tarantool/tarantool/tree/skaplun/gh-noticket-fix-gc-finderrfunc-no-fix <https://github.com/tarantool/tarantool/tree/skaplun/gh-noticket-fix-gc-finderrfunc-no-fix>
> 
> -- 
> Best regards,
> Sergey Kaplun

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.tarantool.org/pipermail/tarantool-patches/attachments/20211014/44a4f7f2/attachment.htm>