From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from [87.239.111.99] (localhost [127.0.0.1]) by dev.tarantool.org (Postfix) with ESMTP id 56EE8C65F09; Wed, 21 Aug 2024 11:23:26 +0300 (MSK) DKIM-Filter: OpenDKIM Filter v2.11.0 dev.tarantool.org 56EE8C65F09 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tarantool.org; s=dev; t=1724228606; bh=pF+1RZCPOveNn9+/aCcZxIcROlL3fVWhTUf8/7bSttY=; h=To:Date:Subject:List-Id:List-Unsubscribe:List-Archive:List-Post: List-Help:List-Subscribe:From:Reply-To:Cc:From; b=Q/rzsqIs2SAtDizXcjzg9D1XZ4nFPmLNHh8avG7PtpnCpV+GuW1jDqK4gT4qnvvRX 5hY0njccfWcF7UE++8pCKtWmrGP57N8y7SJ+bHDDTvXgoJuzzeAllMGa2vAjYpLpL1 FQOINZiF60XdoJvrbR61Ju5jK2aeJtcoMhkdESEw= Received: from smtp46.i.mail.ru (smtp46.i.mail.ru [95.163.41.84]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by dev.tarantool.org (Postfix) with ESMTPS id 38411C65F05 for ; Wed, 21 Aug 2024 11:23:24 +0300 (MSK) DKIM-Filter: OpenDKIM Filter v2.11.0 dev.tarantool.org 38411C65F05 Received: by smtp46.i.mail.ru with esmtpa (envelope-from ) id 1sggcl-00000005m45-1rUN; Wed, 21 Aug 2024 11:23:23 +0300 To: Maxim Kokryashkin , Sergey Bronnikov Date: Wed, 21 Aug 2024 11:23:16 +0300 Message-ID: <20240821082316.4880-1-skaplun@tarantool.org> X-Mailer: git-send-email 2.45.2 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Mailru-Src: smtp X-7564579A: B8F34718100C35BD X-77F55803: 4F1203BC0FB41BD93D5A650E6D4F687E9596EC4B4205973FD9A1239ACDDA93A3182A05F53808504086D95771E6BE2AB2D27678DDAA80631494B8C12267621B4A400C8C0E62B84C2B3ED6A51A13655F6D X-7FA49CB5: FF5795518A3D127A4AD6D5ED66289B5278DA827A17800CE759251087BE69EEF7EA1F7E6F0F101C67BD4B6F7A4D31EC0BCC500DACC3FED6E28638F802B75D45FF8AA50765F79006370B00D9E95F138F938638F802B75D45FF36EB9D2243A4F8B5A6FCA7DBDB1FC311F39EFFDF887939037866D6147AF826D845124F89D4E60F0DE32C6E350994A09D3792D3B618E4C907CC7F00164DA146DAFE8445B8C89999728AA50765F7900637F924B32C592EA89F389733CBF5DBD5E9C8A9BA7A39EFB766F5D81C698A659EA7CC7F00164DA146DA9985D098DBDEAEC8A7DFDF579AB090EFF6B57BC7E6449061A352F6E88A58FB86F5D81C698A659EA7E827F84554CEF5019E625A9149C048EE33AC447995A7AD181150BA43C84913FC3A03B725D353964B1D471462564A2E1935872C767BF85DA227C277FBC8AE2E8B779389CF6F126FEC75ECD9A6C639B01B4E70A05D1297E1BBCB5012B2E24CD356 X-C1DE0DAB: 0D63561A33F958A59C694082598771AC5002B1117B3ED696B56A43EDBD71EE6769995D676B7B4CBE823CB91A9FED034534781492E4B8EEADD3CF082B023A3D3CC79554A2A72441328621D336A7BC284946AD531847A6065AE478A468B35FE767BDAD6C7F3747799A X-C8649E89: 1C3962B70DF3F0ADE00A9FD3E00BEEDF77DD89D51EBB7742D3581295AF09D3DF87807E0823442EA2ED31085941D9CD0AF7F820E7B07EA4CF634465319887601A11D16E3549F2BDA33743636195799AF44F032E046E31A556BF7F25536427AFA1D14E51FF79EEE60330502DC948435F9AB8F7664EFEBF0F0DEEF43AA06EF0D85FC226CC413062362A913E6812662D5F2A5EAB5682573093F7837F15F2B5E4A70B33F2C28C22F508233FCF178C6DD14203 X-D57D3AED: 3ZO7eAau8CL7WIMRKs4sN3D3tLDjz0dLbV79QFUyzQ2Ujvy7cMT6pYYqY16iZVKkSc3dCLJ7zSJH7+u4VD18S7Vl4ZUrpaVfd2+vE6kuoey4m4VkSEu530nj6fImhcD4MUrOEAnl0W826KZ9Q+tr5ycPtXkTV4k65bRjmOUUP8cvGozZ33TWg5HZplvhhXbhDGzqmQDTd6OAevLeAnq3Ra9uf7zvY2zzsIhlcp/Y7m53TZgf2aB4JOg4gkr2biojbL9S8ysBdXh6Y3tsBgYXXBa18TitEMNK X-DA7885C5: AB5ED78350C6CD53F255D290C0D534F967A17EF2E4BD0E21505DDAE9120D4854213C80F368A31FD35B1A4C17EAA7BC4BEF2421ABFA55128DAF83EF9164C44C7E X-Mailru-Sender: 689FA8AB762F7393C6D0B12EA33CAA9BACA93F4B17625DB162B85B516B00FA1633B1B23EA1E21592E49D44BB4BD9522A059A1ED8796F048DB274557F927329BE89D5A3BC2B10C37545BD1C3CC395C826B4A721A3011E896F X-Mras: Ok Subject: [Tarantool-patches] [PATCH luajit] Restore state when recording __concat metamethod throws an error. X-BeenThere: tarantool-patches@dev.tarantool.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Tarantool development patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , From: Sergey Kaplun via Tarantool-patches Reply-To: Sergey Kaplun Cc: tarantool-patches@dev.tarantool.org Errors-To: tarantool-patches-bounces@dev.tarantool.org Sender: "Tarantool-patches" From: Mike Pall Thanks to Sergey Kaplun. (cherry picked from commit 7421a1b33c7ea46f12bba9700c15b5c90253fee0) Since neither `rec_cat()` nor `lj_record_ret()` restore the Lua stack, if the error is raised, it leads either to a crash in `BC_RET` or to the "unbalanced stack" assertion failure. This patch protects the `rec_mm_arith()`, which can raise an error. Its caller returns the negated error code to be rethrown in case of the caught error. Sergey Kaplun: * added the description and the test for the problem Part of tarantool/tarantool#10199 --- Branch: https://github.com/tarantool/luajit/tree/skaplun/lj-1234-err-in-record-concat Related issues: * https://github.com/tarantool/tarantool/issues/10199 * https://github.com/LuaJIT/LuaJIT/issues/1234 src/lj_record.c | 26 ++++++++++- .../lj-1234-err-in-record-concat.test.lua | 43 +++++++++++++++++++ 2 files changed, 67 insertions(+), 2 deletions(-) create mode 100644 test/tarantool-tests/lj-1234-err-in-record-concat.test.lua diff --git a/src/lj_record.c b/src/lj_record.c index 96fe26d8..64da3256 100644 --- a/src/lj_record.c +++ b/src/lj_record.c @@ -940,7 +940,9 @@ void lj_record_ret(jit_State *J, BCReg rbase, ptrdiff_t gotresults) J->L->base = b + baseadj; copyTV(J->L, b-(2<= 0xffffff00) { + lj_err_throw(J->L, -(int32_t)tr); /* Propagate errors. */ + } else if (tr) { /* Store final result. */ BCReg dst = bc_a(*(frame_contpc(frame)-1)); J->base[dst] = tr; if (dst >= J->maxslot) { @@ -1936,12 +1938,27 @@ static TRef rec_tnew(jit_State *J, uint32_t ah) /* -- Concatenation ------------------------------------------------------- */ +typedef struct RecCatDataCP { + jit_State *J; + RecordIndex *ix; +} RecCatDataCP; + +static TValue *rec_mm_concat_cp(lua_State *L, lua_CFunction dummy, void *ud) +{ + RecCatDataCP *rcd = (RecCatDataCP *)ud; + UNUSED(L); UNUSED(dummy); + rec_mm_arith(rcd->J, rcd->ix, MM_concat); /* Call __concat metamethod. */ + return NULL; +} + static TRef rec_cat(jit_State *J, BCReg baseslot, BCReg topslot) { TRef *top = &J->base[topslot]; TValue savetv[5+LJ_FR2]; BCReg s; RecordIndex ix; + RecCatDataCP rcd; + int errcode; lj_assertJ(baseslot < topslot, "bad CAT arg"); for (s = baseslot; s <= topslot; s++) (void)getslot(J, s); /* Ensure all arguments have a reference. */ @@ -1977,8 +1994,11 @@ static TRef rec_cat(jit_State *J, BCReg baseslot, BCReg topslot) ix.tab = top[-1]; ix.key = top[0]; memcpy(savetv, &J->L->base[topslot-1], sizeof(savetv)); /* Save slots. */ - rec_mm_arith(J, &ix, MM_concat); /* Call __concat metamethod. */ + rcd.J = J; + rcd.ix = &ix; + errcode = lj_vm_cpcall(J->L, NULL, &rcd, rec_mm_concat_cp); memcpy(&J->L->base[topslot-1], savetv, sizeof(savetv)); /* Restore slots. */ + if (errcode) return (TRef)(-errcode); return 0; /* No result yet. */ } @@ -2300,6 +2320,8 @@ void lj_record_ins(jit_State *J) case BC_CAT: rc = rec_cat(J, rb, rc); + if (rc >= 0xffffff00) + lj_err_throw(J->L, -(int32_t)rc); /* Propagate errors. */ break; /* -- Constant and move ops --------------------------------------------- */ diff --git a/test/tarantool-tests/lj-1234-err-in-record-concat.test.lua b/test/tarantool-tests/lj-1234-err-in-record-concat.test.lua new file mode 100644 index 00000000..9abaeba5 --- /dev/null +++ b/test/tarantool-tests/lj-1234-err-in-record-concat.test.lua @@ -0,0 +1,43 @@ +local tap = require('tap') + +-- Test file to demonstrate the crash during the concat recording +-- if it throws an error. +-- See also: https://github.com/LuaJIT/LuaJIT/issues/1234. + +local test = tap.test('lj-1234-err-in-record-concat'):skipcond({ + ['Test requires JIT enabled'] = not jit.status(), +}) + +test:plan(2) + +jit.opt.start('hotloop=1') + +local __concat = function(v1, v2) + return tostring(v1) .. tostring(v2) +end + +-- Need to use metamethod call in the concat recording. +debug.setmetatable(nil, { + __concat = __concat, +}) + +local function test_concat_p() + local counter = 0 + while counter < 1 do + counter = counter + 1 + -- The first result is placed on the Lua stack before the + -- error is raised. When the error is raised, it is handled by + -- the trace recorder, but since neither `rec_cat()` nor + -- `lj_record_ret()` restore the Lua stack (before the patch), + -- it becomes unbalanced after the instruction recording + -- attempt. + local _ = {} .. (nil .. nil) + end +end + +local result, errmsg = pcall(test_concat_p) + +test:ok(not result, 'the error is raised') +test:like(errmsg, 'attempt to concatenate a table value', 'correct error') + +test:done(true) -- 2.45.2