[Tarantool-patches] [PATCH luajit] LJ_GC64: Fix lua_concat().
Sergey Bronnikov
estetus at gmail.com
Tue Sep 26 09:56:31 MSK 2023
From: Sergey Bronnikov <sergeyb at tarantool.org>
Reported by Mathias Westerdahl.
(cherry picked from commit 633f265f67f322cbe2c5fd11d3e46d968ac220f7)
Lua 5.1 Reference Manual [1] defines a function `lua_concat`, that:
> void lua_concat (lua_State *L, int n);
>
> Concatenates the n values at the top of the stack, pops them, and leaves
> the result at the top.
Without the patch `lua_concat()` behaved incorrectly with userdata with
defined `__concat` metamethod. The problem is GC64-specific.
Assuming we have three literals and a userdata with defined "__concat"
metamethod on top of the Lua stack:
1 [string]
2 [string]
3 [string]
4 [string]
5 [userdata] <--- top
On attempt to concatenate *two* items on top Lua stack, `lua_concat()`
concatenates *four* items and leaves result at the top:
1 [string]
2 [string][string][string][userdata] <--- top
The problem is in incorrect calculation of `n` counter in a loop in
implementation of function `lua_concat`. Without a fix `n` is equal to 3
at the end of the first iteration and therefore it goes to the next
iteration of concatenation. In a fixed implementation of `lua_concat()`
`n` is equal to 1 at the end of the first loop iteration, decremented in
a loop postcondition and breaks a loop.
The patch fixes incorrect behaviour.
1. https://www.lua.org/manual/5.1/manual.html
Sergey Bronnikov:
* added the description and the test for the problem
Part of tarantool/tarantool#8825
---
PR: https://github.com/tarantool/tarantool/pull/9176
Branch: https://github.com/tarantool/luajit/commits/ligurio/lj-881-fix-concat
Issues:
- https://github.com/LuaJIT/LuaJIT/issues/881
- https://github.com/tarantool/tarantool/issues/8825
src/lj_api.c | 2 +-
.../lj-881-fix-lua-concat.test.c | 116 ++++++++++++++++++
2 files changed, 117 insertions(+), 1 deletion(-)
create mode 100644 test/tarantool-c-tests/lj-881-fix-lua-concat.test.c
diff --git a/src/lj_api.c b/src/lj_api.c
index 05e02029..3bacad33 100644
--- a/src/lj_api.c
+++ b/src/lj_api.c
@@ -801,7 +801,7 @@ LUA_API void lua_concat(lua_State *L, int n)
L->top -= n;
break;
}
- n -= (int)(L->top - top);
+ n -= (int)(L->top - (top - 2*LJ_FR2));
L->top = top+2;
jit_secure_call(L, top, 1+1);
L->top -= 1+LJ_FR2;
diff --git a/test/tarantool-c-tests/lj-881-fix-lua-concat.test.c b/test/tarantool-c-tests/lj-881-fix-lua-concat.test.c
new file mode 100644
index 00000000..464ed27e
--- /dev/null
+++ b/test/tarantool-c-tests/lj-881-fix-lua-concat.test.c
@@ -0,0 +1,116 @@
+#include <string.h>
+
+#include "lua.h"
+#include "lauxlib.h"
+
+#include "test.h"
+#include "utils.h"
+
+/*
+ * This test demonstrates LuaJIT's incorrect behaviour, when
+ * calling `lua_concat()` with userdata with __concat metamethod.
+ * See https://github.com/LuaJIT/LuaJIT/issues/881 for details.
+ */
+
+#define TYPE_NAME_INFO "Info"
+
+typedef struct Info
+{
+ int value;
+} Info;
+
+static void lua_pushinfo(lua_State *L, Info *info)
+{
+ Info *infop = (Info *)lua_newuserdata(L, sizeof(Info));
+ *infop = *info;
+
+ luaL_getmetatable(L, TYPE_NAME_INFO);
+ lua_setmetatable(L, -2);
+}
+
+static int INFO_concat(lua_State *L)
+{
+ const char *s = luaL_checkstring(L, 1);
+ Info *info = (Info*)luaL_checkudata(L, 2, TYPE_NAME_INFO);
+ lua_pushfstring(L, "%s[%s.value=%d]", s, TYPE_NAME_INFO, info->value);
+ return 1;
+}
+
+static const luaL_Reg INFO_methods[] =
+{
+ {0, 0}
+};
+
+static const luaL_Reg INFO_meta[] =
+{
+ {"__concat", INFO_concat},
+ {0, 0}
+};
+
+static int lua_concat_testcase(void *test_state)
+{
+ lua_State *L = test_state;
+
+ /* Create methods table, add it to the globals. */
+ luaL_register(L, TYPE_NAME_INFO, INFO_methods);
+ int methods_idx = lua_gettop(L);
+ /* Create metatable and add it to the Lua registry. */
+ luaL_newmetatable(L, TYPE_NAME_INFO);
+
+ int metatable_idx = lua_gettop(L);
+ /* Fill metatable. */
+ luaL_register(L, 0, INFO_meta);
+
+ lua_pushliteral(L, "__metatable");
+ /* Duplicate methods table. */
+ lua_pushvalue(L, methods_idx);
+ lua_settable(L, metatable_idx);
+ lua_pop(L, 2);
+
+ assert_true(lua_gettop(L) == 0);
+
+ Info info;
+ info.value = 7;
+
+ lua_pushliteral(L, "C");
+ lua_pushliteral(L, "B");
+ lua_pushliteral(L, "A");
+ lua_pushinfo(L, &info);
+
+ int top = 4;
+ assert_true(lua_gettop(L) == top);
+
+ /**
+ * void lua_concat (lua_State *L, int n);
+ *
+ * Concatenates the n values at the top of the stack,
+ * pops them, and leaves the result at the top. If n is 1,
+ * the result is the single value on the stack; if n is 0,
+ * the result is the empty string [1].
+ *
+ * 1. https://www.lua.org/manual/5.1/manual.html
+ */
+ int n = 2;
+ lua_concat(L, n);
+
+ const char *str = lua_tostring(L, -1);
+ assert_true(top - n + 1 == lua_gettop(L));
+ assert_true(strcmp(str, "A[Info.value=7]") == 0);
+
+ /* Cleanup. */
+ lua_settop(L, 0);
+
+ return TEST_EXIT_SUCCESS;
+}
+
+int main(void)
+{
+ lua_State *L = utils_lua_init();
+ const struct test_unit tgroup[] = {
+ test_unit_def(lua_concat_testcase),
+ };
+ const int test_result = test_run_group(tgroup, L);
+ utils_lua_close(L);
+
+ return test_result;
+}
--
2.34.1
More information about the Tarantool-patches
mailing list