From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <korablev@tarantool.org>
Received: from smtp33.i.mail.ru (smtp33.i.mail.ru [94.100.177.93])
 (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
 (No client certificate requested)
 by dev.tarantool.org (Postfix) with ESMTPS id 2BF8F445320
 for <tarantool-patches@dev.tarantool.org>;
 Wed, 22 Jul 2020 14:08:43 +0300 (MSK)
Date: Wed, 22 Jul 2020 11:08:42 +0000
From: Nikita Pettik <korablev@tarantool.org>
Message-ID: <20200722110841.GB25532@tarantool.org>
References: <20200721223242.24467-1-i.kosarev@tarantool.org>
 <1595411169.838162410@f334.i.mail.ru>
 <20200722094653.GL18920@tarantool.org>
 <1595413507.397395465@f430.i.mail.ru>
 <20200722104725.GM18920@tarantool.org>
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <20200722104725.GM18920@tarantool.org>
Subject: Re: [Tarantool-patches] [PATCH v3] lua: assert in lua_gettop() in
 case of negative stack size
List-Id: Tarantool development patches <tarantool-patches.dev.tarantool.org>
List-Unsubscribe: <https://lists.tarantool.org/mailman/options/tarantool-patches>, 
 <mailto:tarantool-patches-request@dev.tarantool.org?subject=unsubscribe>
List-Archive: <https://lists.tarantool.org/pipermail/tarantool-patches/>
List-Post: <mailto:tarantool-patches@dev.tarantool.org>
List-Help: <mailto:tarantool-patches-request@dev.tarantool.org?subject=help>
List-Subscribe: <https://lists.tarantool.org/mailman/listinfo/tarantool-patches>, 
 <mailto:tarantool-patches-request@dev.tarantool.org?subject=subscribe>
To: Igor Munkin <imun@tarantool.org>
Cc: tarantool-patches@dev.tarantool.org

On 22 Jul 13:47, Igor Munkin wrote:
> I'll add more info for Nikita and Sergos since they are also involved
> to the investigation and the patch review.
> 
> On 22.07.20, Ilya Kosarev wrote:
> > 
> > Right, error fixed and now we found more details.
> 
> Here are the details:
> | (gdb) p ((struct port_lua *)&port)->L
> | $1 = (lua_State *) 0x41b8fa08
> | (gdb) p ((struct port_lua *)&port)
> | $2 = (port_lua *) 0x7ef54107fe30
> | (gdb) p ((struct port_lua *)&port)->vtab
> | $3 = (const port_vtab *) 0x708d60 <port_lua_vtab>
> | (gdb) p ((struct port_lua *)&port)->ref
> | $4 = 181
> 
> port->ref value is rotten since port->L is removed from Lua registry
> within <port_destroy> (i.e. <port_lua_destroy>) function. But the
> pointer to port->L is fine.
> 
> | (gdb) p ((struct port_lua *)&port)->size
> | $5 = -1
> 
> size value is initialized to -1 prior to encoding loop, so there is no
> <luamp_encode> call.
> 
> | (gdb) p ((struct port_lua *)&port)->out
> | $6 = (obuf *) 0x7f00098692e8
> | (gdb) p ((struct port_lua *)&port)->L->top
> | $7 = (TValue *) 0x4107fa08
> | (gdb) p ((struct port_lua *)&port)->L->base
> | $8 = (TValue *) 0x4107fa10
> 
> size value is initialized properly since L->base is greater than L->top
> (guest stack addresses grow downwards). Oops...
> 
> > Now the best assumption is that lua_State is somehow being broken by
> > user-called function (which name we now know).
> 
> The port (and ergo port->L coroutine) is created in scope of
> <box_process_lua> call. Considering the message type (IPROTO_CALL)
> <execute_lua_call> handler is called. Both Ilya and me found nothing
> suspicious there: the function to be called is found by its name and
> then execution enters Lua space.
> 
> Considering the results (<box_process_call> rc is 0) the call succeeds
> and execution proceeds with reply packing. There is also nothing
> corrupting port->L coroutine internal structure prior to the place
> port->size is initialized to -1.
> 
> > Now we will look into user code.
> 
> For now I see no reason to add even the assert, since Ilya's assumptions
> are confirmed.

Which one? Assuming that lua_gettop() returns negative value due
to spoiled lua state?