From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <imun@tarantool.org>
Received: from smtpng3.m.smailru.net (smtpng3.m.smailru.net [94.100.177.149])
 (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256
 bits)) (No client certificate requested)
 by dev.tarantool.org (Postfix) with ESMTPS id 5AACD445320
 for <tarantool-patches@dev.tarantool.org>;
 Wed, 22 Jul 2020 13:57:45 +0300 (MSK)
Date: Wed, 22 Jul 2020 13:47:25 +0300
From: Igor Munkin <imun@tarantool.org>
Message-ID: <20200722104725.GM18920@tarantool.org>
References: <20200721223242.24467-1-i.kosarev@tarantool.org>
 <1595411169.838162410@f334.i.mail.ru>
 <20200722094653.GL18920@tarantool.org>
 <1595413507.397395465@f430.i.mail.ru>
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <1595413507.397395465@f430.i.mail.ru>
Subject: Re: [Tarantool-patches] [PATCH v3] lua: assert in lua_gettop() in
 case of negative stack size
List-Id: Tarantool development patches <tarantool-patches.dev.tarantool.org>
List-Unsubscribe: <https://lists.tarantool.org/mailman/options/tarantool-patches>, 
 <mailto:tarantool-patches-request@dev.tarantool.org?subject=unsubscribe>
List-Archive: <https://lists.tarantool.org/pipermail/tarantool-patches/>
List-Post: <mailto:tarantool-patches@dev.tarantool.org>
List-Help: <mailto:tarantool-patches-request@dev.tarantool.org?subject=help>
List-Subscribe: <https://lists.tarantool.org/mailman/listinfo/tarantool-patches>, 
 <mailto:tarantool-patches-request@dev.tarantool.org?subject=subscribe>
To: Ilya Kosarev <i.kosarev@tarantool.org>
Cc: tarantool-patches@dev.tarantool.org

I'll add more info for Nikita and Sergos since they are also involved
to the investigation and the patch review.

On 22.07.20, Ilya Kosarev wrote:
> 
> Right, error fixed and now we found more details.

Here are the details:
| (gdb) p ((struct port_lua *)&port)->L
| $1 = (lua_State *) 0x41b8fa08
| (gdb) p ((struct port_lua *)&port)
| $2 = (port_lua *) 0x7ef54107fe30
| (gdb) p ((struct port_lua *)&port)->vtab
| $3 = (const port_vtab *) 0x708d60 <port_lua_vtab>
| (gdb) p ((struct port_lua *)&port)->ref
| $4 = 181

port->ref value is rotten since port->L is removed from Lua registry
within <port_destroy> (i.e. <port_lua_destroy>) function. But the
pointer to port->L is fine.

| (gdb) p ((struct port_lua *)&port)->size
| $5 = -1

size value is initialized to -1 prior to encoding loop, so there is no
<luamp_encode> call.

| (gdb) p ((struct port_lua *)&port)->out
| $6 = (obuf *) 0x7f00098692e8
| (gdb) p ((struct port_lua *)&port)->L->top
| $7 = (TValue *) 0x4107fa08
| (gdb) p ((struct port_lua *)&port)->L->base
| $8 = (TValue *) 0x4107fa10

size value is initialized properly since L->base is greater than L->top
(guest stack addresses grow downwards). Oops...

> Now the best assumption is that lua_State is somehow being broken by
> user-called function (which name we now know).

The port (and ergo port->L coroutine) is created in scope of
<box_process_lua> call. Considering the message type (IPROTO_CALL)
<execute_lua_call> handler is called. Both Ilya and me found nothing
suspicious there: the function to be called is found by its name and
then execution enters Lua space.

Considering the results (<box_process_call> rc is 0) the call succeeds
and execution proceeds with reply packing. There is also nothing
corrupting port->L coroutine internal structure prior to the place
port->size is initialized to -1.

> Now we will look into user code.

For now I see no reason to add even the assert, since Ilya's assumptions
are confirmed.


<snipped>

>  
> --
> Ilya Kosarev
>  

-- 
Best regards,
IM