From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from [87.239.111.99] (localhost [127.0.0.1]) by dev.tarantool.org (Postfix) with ESMTP id E1BA61628FC9; Mon, 2 Mar 2026 11:05:45 +0300 (MSK) DKIM-Filter: OpenDKIM Filter v2.11.0 dev.tarantool.org E1BA61628FC9 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tarantool.org; s=dev; t=1772438746; bh=NaJcUnE4h+Bxw0LGWkeg1kQAbJ2GYI/QDFRq1nDMtbI=; h=To:Date:In-Reply-To:References:Subject:List-Id:List-Unsubscribe: List-Archive:List-Post:List-Help:List-Subscribe:From:Reply-To:Cc: From; b=Z6bxqK8bppnEQA96djpudM7tS8w0Uxu+tGaRMWnAOeRyekw0Gv70hk4r7XdWOew7M 6lbtPM4c1yw6NGOhLhrPV3WHzGy4ms2kg3ExY65mmmiksiL6owKOEepiubH0VvIFE7 cCFpw9VAt1kLSaByp8wdnTLXx7mCuWbP7lyXI2To= Received: from send173.i.mail.ru (send173.i.mail.ru [95.163.59.12]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by dev.tarantool.org (Postfix) with ESMTPS id 86A8F1628FC2 for ; Mon, 2 Mar 2026 11:04:45 +0300 (MSK) DKIM-Filter: OpenDKIM Filter v2.11.0 dev.tarantool.org 86A8F1628FC2 Received: by exim-smtp-558f87dcd7-l5b52 with esmtpa (envelope-from ) id 1vwyGi-00000000FvH-0nYm; Mon, 02 Mar 2026 11:04:44 +0300 To: Sergey Bronnikov Date: Mon, 2 Mar 2026 11:05:32 +0300 Message-ID: <1d2c3bbc66be0d8d2049f0b7605b9ce111df37fa.1772438261.git.skaplun@tarantool.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Mailru-Src: smtp X-4EC0790: 10 X-7564579A: B8F34718100C35BD X-77F55803: 4F1203BC0FB41BD9FE49BA1A5307ACBF71CB1683FDA0CB46C7F9892E7973D73600894C459B0CD1B9A02D1AEB0C98E080411046492FDDF806091B847B1C5DE89177DCBF6A769AB320B57612C3CDEB6A40 X-7FA49CB5: FF5795518A3D127A4AD6D5ED66289B5278DA827A17800CE7F12ABE79F2AB44EAEA1F7E6F0F101C67BD4B6F7A4D31EC0BCC500DACC3FED6E28638F802B75D45FF8AA50765F7900637AC83A81C8FD4AD23D82A6BABE6F325AC2E85FA5F3EDFCBAA7353EFBB55337566487A753D4C0E5B9C8B17B8D0252474171F19C6931C24AE54A7D3B70003D4EC51389733CBF5DBD5E913377AFFFEAFD269176DF2183F8FC7C058C1844A7A85E7B68941B15DA834481FCF19DD082D7633A0EF3E4896CB9E6436389733CBF5DBD5E9D5E8D9A59859A8B6A70DDFFB3186CBC5CC7F00164DA146DA6F5DAA56C3B73B237318B6A418E8EAB8D32BA5DBAC0009BE9E8FC8737B5C224987E39C43569AF39976E601842F6C81A12EF20D2F80756B5FB606B96278B59C4276E601842F6C81A127C277FBC8AE2E8BB4A6D9B00E37F4B33AA81AA40904B5D99C9F4D5AE37F343AD1F44FA8B9022EA23BBE47FD9DD3FB595F5C1EE8F4F765FC72CEEB2601E22B093A03B725D353964B0B7D0EA88DDEDAC722CA9DD8327EE4930A3850AC1BE2E735CC4B623DB76FBBCBC4224003CC83647689D4C264860C145E X-C1DE0DAB: 0D63561A33F958A59DFEB06C5792E84C5002B1117B3ED696C73460D39D38107533EE06AFCD964888823CB91A9FED034534781492E4B8EEAD69BF13FED57427F1C79554A2A72441328621D336A7BC284946AD531847A6065A535571D14F44ED41 X-C8649E89: 1C3962B70DF3F0AD73CAD6646DEDE191716CD42B3DD1D34CAB70F9BE574AE9C625B6776AC983F447FC0B9F89525902EE6F57B2FD27647F25E66C117BDB76D6594CB910545E823CD9B03D25C046A068B21C2A3104240D080A2992434971EF4BF90B5C6CADFE3C688CB8341EE9D5BE9A0A4D3C4C159FB4ADBAAFC2223F3B497BC964FF2537A21A75D66536EB022892E5344C41F94D744909CECFA6C6B0C050A61A8CAF69B82BA93681CD72808BE417F3B9E0E7457915DAA85F X-D57D3AED: 3ZO7eAau8CL7WIMRKs4sN3D3tLDjz0dLbV79QFUyzQ2Ujvy7cMT6pYYqY16iZVKkSc3dCLJ7zSJH7+u4VD18S7Vl4ZUrpaVfd2+vE6kuoey4m4VkSEu53w8ahmwBjZKM/YPHZyZHvz5uv+WouB9+ObcCpyrx6l7KImUglyhkEat/+ysWwi0gdhEs0JGjl6ggRWTy1haxBpVdbIX1nthFXMZebaIdHP2ghjoIc/363UZI6Kf1ptIMVbwN8XFWZxQUdh88ZWKgM7c= X-Mailru-Sender: 583F1D7ACE8F49BDD951BA70C165859E0A374EC7E68AAE4E125AE33D5AC58CD4FC94E92873D0BA8958345C1A80EE790FF2400F607609286E924004A7DEC283833C7120B22964430C52B393F8C72A41A84198E0F3ECE9B5443453F38A29522196 X-Mras: Ok Subject: [Tarantool-patches] [PATCH luajit 2/2] x64/!LJ_GC64: The allocation limit is required for a no-JIT build, too. X-BeenThere: tarantool-patches@dev.tarantool.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Tarantool development patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , From: Sergey Kaplun via Tarantool-patches Reply-To: Sergey Kaplun Cc: tarantool-patches@dev.tarantool.org Errors-To: tarantool-patches-bounces@dev.tarantool.org Sender: "Tarantool-patches" From: Mike Pall Thanks to Sergey Kaplun. (cherry picked from commit eff4006837792b6105e0a1743283ddde3548fc09) For the non-GC64 build with disabled JIT, LuaJIT's internal allocator may return 32-bit addresses. This may lead to the assertion failure during the reallocation of the array part of the table or to the crash (if assertions are disabled) due to an incorrect arithmetic in the x86 VM. For example, the addition with a 32-bit wide address may overflow in TSETV or TGETV and cause the crash. This patch sets the allocation limit for the build without JIT. Sergey Kaplun: * added the description and the test for the problem Part of tarantool/tarantool#12134 --- src/lj_alloc.c | 4 +- .../lj-1430-internal-alloc-limit.test.lua | 39 +++++++++++++++++++ 2 files changed, 41 insertions(+), 2 deletions(-) create mode 100644 test/tarantool-tests/lj-1430-internal-alloc-limit.test.lua diff --git a/src/lj_alloc.c b/src/lj_alloc.c index f82c9854..97eb94d2 100644 --- a/src/lj_alloc.c +++ b/src/lj_alloc.c @@ -99,8 +99,8 @@ #if LJ_GC64 #define LJ_ALLOC_MBITS 47 /* 128 TB in LJ_GC64 mode. */ -#elif LJ_TARGET_X64 && LJ_HASJIT -/* Due to limitations in the x64 compiler backend. */ +#elif LJ_TARGET_X64 +/* Due to limitations in the x64 non-GC64 VM. */ #define LJ_ALLOC_MBITS 31 /* 2 GB on x64 with !LJ_GC64. */ #else #define LJ_ALLOC_MBITS 32 /* 4 GB on other archs with !LJ_GC64. */ diff --git a/test/tarantool-tests/lj-1430-internal-alloc-limit.test.lua b/test/tarantool-tests/lj-1430-internal-alloc-limit.test.lua new file mode 100644 index 00000000..969d26d6 --- /dev/null +++ b/test/tarantool-tests/lj-1430-internal-alloc-limit.test.lua @@ -0,0 +1,39 @@ +local tap = require('tap') + +-- Test file to demonstrate incorrect allocation limit for the +-- non-GC64 build with disabled JIT. +-- See also: https://github.com/LuaJIT/LuaJIT/issues/1430. + +local test = tap.test('lj-1430-internal-alloc-limit') + +test:plan(1) + +-- This function creates a bunch of long array-like tables. +-- Eventually for one of the tables the address of the array +-- element will not fit in the 31-bit range, causing the incorrect +-- arithmetic inside the VM and a crash or assertion failure +-- during the reallocation. +local function test_payload() + local POOL_SZ = 8 + -- luacheck: no unused + local pools = {} + for i = 1, POOL_SZ do + pools[i] = {} + end + + local v = 1 + for j = 1, POOL_SZ do + for i = 1, 0x2000000 do + pools[j][i] = v + end + end +end + +-- Protect the call to avoid the OOM. +pcall(test_payload) + +-- Free memory for the TAP tests. +collectgarbage() + +test:ok(true, 'no crash or assertion failure') +test:done(true) -- 2.53.0