From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from [87.239.111.99] (localhost [127.0.0.1]) by dev.tarantool.org (Postfix) with ESMTP id 80267F401AE; Thu, 9 Jan 2025 18:02:04 +0300 (MSK) DKIM-Filter: OpenDKIM Filter v2.11.0 dev.tarantool.org 80267F401AE DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tarantool.org; s=dev; t=1736434924; bh=3o+Zwp7EVcIaDY4RKFhKvny8iwpxUGu/DEjLhzEq/NM=; h=To:Date:Subject:List-Id:List-Unsubscribe:List-Archive:List-Post: List-Help:List-Subscribe:From:Reply-To:Cc:From; b=cmH/0qKiHQB7jUR2F7CR2DPB/NgIgwbX3sNZ5RiDfxQdWQx1h7JEHqnrAK7LEvBWh 8trD4OeR6vM37rauZu4QZD2uFHfkl2Ikmjinsz4Osrax+Hukm5HZVo3h/TUm+bvKxs Zsl6ZhSmjtYwUq+fMBz210b5yKAYR/EQuAVp4MTs= Received: from send217.i.mail.ru (send217.i.mail.ru [95.163.59.56]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by dev.tarantool.org (Postfix) with ESMTPS id DDA0E4242D2 for ; Thu, 9 Jan 2025 18:02:03 +0300 (MSK) DKIM-Filter: OpenDKIM Filter v2.11.0 dev.tarantool.org DDA0E4242D2 Received: by exim-smtp-bcf9586c5-h4d4p with esmtpa (envelope-from ) id 1tVu2q-000000007wG-0p20; Thu, 09 Jan 2025 18:02:03 +0300 To: Sergey Bronnikov Date: Thu, 9 Jan 2025 18:01:24 +0300 Message-ID: <20250109150124.23841-1-skaplun@tarantool.org> X-Mailer: git-send-email 2.47.1 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Mailru-Src: smtp X-7564579A: B8F34718100C35BD X-77F55803: 4F1203BC0FB41BD97C62A2C8925CC647B11223E654DDE28102A451326EF43BBE182A05F53808504069204BC3BE5A8D4F3DE06ABAFEAF6705F5F4DD694C0959B07BB3A72AE79D3D87128E90E6EA85A331 X-7FA49CB5: FF5795518A3D127A4AD6D5ED66289B5278DA827A17800CE7569E19AE644B2ACAEA1F7E6F0F101C67BD4B6F7A4D31EC0BCC500DACC3FED6E28638F802B75D45FF8AA50765F79006376976B91E969631F08638F802B75D45FF36EB9D2243A4F8B5A6FCA7DBDB1FC311F39EFFDF887939037866D6147AF826D834344C44CCB9536A6903821238BFE6C9BECA28B97AFB5D02CC7F00164DA146DAFE8445B8C89999728AA50765F79006372A3B24BF85B2E607389733CBF5DBD5E9C8A9BA7A39EFB766F5D81C698A659EA7CC7F00164DA146DA9985D098DBDEAEC821E93C0F2A571C7BF6B57BC7E6449061A352F6E88A58FB86F5D81C698A659EA73AA81AA40904B5D9A18204E546F3947CB28C6475D0D32330302FCEF25BFAB3454AD6D5ED66289B523666184CF4C3C14F6136E347CC761E07725E5C173C3A84C323E089EB4CE75FDEBA3038C0950A5D36B5C8C57E37DE458B330BD67F2E7D9AF16D1867E19FE14079C09775C1D3CA48CF3D321E7403792E342EB15956EA79C166176DF2183F8FC7C04E672349037D5FA5725E5C173C3A84C325A81A29FB5043FD35872C767BF85DA2F004C90652538430E4A6367B16DE6309 X-C1DE0DAB: 0D63561A33F958A55E29C3791A906DA55002B1117B3ED6967DC27BD6BF493ABB4869453249F34FA4823CB91A9FED034534781492E4B8EEAD5C5DFC4BFF39B799F36E2E0160E5C55395B8A2A0B6518DF68C46860778A80D548E8926FB43031F38 X-C8649E89: 1C3962B70DF3F0ADE00A9FD3E00BEEDF77DD89D51EBB7742D3581295AF09D3DF87807E0823442EA2ED31085941D9CD0AF7F820E7B07EA4CF0FBF858673EFE108C1D54C4A3A549F285BB82CFF9EA33B697E913D31CAEB1899265F63FF884E79B340B22F28660E28AC4A7C2F612F4CB7280BB39C8369A98431138CE97C921EF55D5F4332CA8FE04980913E6812662D5F2A5EAB5682573093F7837F15F2B5E4A70B33F2C28C22F508233FCF178C6DD14203 X-D57D3AED: 3ZO7eAau8CL7WIMRKs4sN3D3tLDjz0dLbV79QFUyzQ2Ujvy7cMT6pYYqY16iZVKkSc3dCLJ7zSJH7+u4VD18S7Vl4ZUrpaVfd2+vE6kuoey4m4VkSEu530nj6fImhcD4MUrOEAnl0W826KZ9Q+tr5ycPtXkTV4k65bRjmOUUP8cvGozZ33TWg5HZplvhhXbhDGzqmQDTd6OAevLeAnq3Ra9uf7zvY2zzsIhlcp/Y7m53TZgf2aB4JOg4gkr2biojbL9S8ysBdXjY/y9WH+CwlXGI82jnA0PT X-Mailru-Sender: 520A125C2F17F0B1A9638AD358559B594AD9E2463FDE28A83DE06ABAFEAF6705F5F4DD694C0959B0B7CBEF92542CD7C88B0A2698F12F5C9EC77752E0C033A69E86920BD37369036789A8C6A0E60D2BB63A5DB60FBEB33A8A0DA7A0AF5A3A8387 X-Mras: Ok Subject: [Tarantool-patches] [PATCH luajit] Fix predict_next() in parser (for real now). X-BeenThere: tarantool-patches@dev.tarantool.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Tarantool development patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , From: Sergey Kaplun via Tarantool-patches Reply-To: Sergey Kaplun Cc: tarantool-patches@dev.tarantool.org Errors-To: tarantool-patches-bounces@dev.tarantool.org Sender: "Tarantool-patches" From: Mike Pall Reported by Sergey Kaplun. (cherry picked from commit f602f0154b644211283cfeea92a570ca38f71947) Before the patch `predict_next()` uses the pc allocation limit (`fs->bclim`) instead of the real limit of the defined bytecodes (`fs->pc`). This leads to the use of undefined value and possible crash. This patch fixes the check. Sergey Kaplun: * added the description and the test for the problem Part of tarantool/tarantool#10709 --- Branch: https://github.com/tarantool/luajit/tree/skaplun/lj-1226-fix-predict-next Related issues: * https://github.com/LuaJIT/LuaJIT/issues/1226 * https://github.com/tarantool/tarantool/issues/10709 src/lj_parse.c | 6 ++-- .../lj-1226-fix-predict-next.test.lua | 31 +++++++++++++++++++ 2 files changed, 33 insertions(+), 4 deletions(-) create mode 100644 test/tarantool-tests/lj-1226-fix-predict-next.test.lua diff --git a/src/lj_parse.c b/src/lj_parse.c index 9b45b103..ec85ac9b 100644 --- a/src/lj_parse.c +++ b/src/lj_parse.c @@ -2527,11 +2527,9 @@ static void parse_for_num(LexState *ls, GCstr *varname, BCLine line) */ static int predict_next(LexState *ls, FuncState *fs, BCPos pc) { - BCIns ins; + BCIns ins = fs->bcbase[pc].ins; GCstr *name; cTValue *o; - if (pc >= fs->bclim) return 0; - ins = fs->bcbase[pc].ins; switch (bc_op(ins)) { case BC_MOV: if (bc_d(ins) >= fs->nactvar) return 0; @@ -2580,7 +2578,7 @@ static void parse_for_iter(LexState *ls, GCstr *indexname) assign_adjust(ls, 3, expr_list(ls, &e), &e); /* The iterator needs another 3 [4] slots (func [pc] | state ctl). */ bcreg_bump(fs, 3+LJ_FR2); - isnext = (nvars <= 5 && predict_next(ls, fs, exprpc)); + isnext = (nvars <= 5 && fs->pc > exprpc && predict_next(ls, fs, exprpc)); var_add(ls, 3); /* Hidden control variables. */ lex_check(ls, TK_do); loop = bcemit_AJ(fs, isnext ? BC_ISNEXT : BC_JMP, base, NO_JMP); diff --git a/test/tarantool-tests/lj-1226-fix-predict-next.test.lua b/test/tarantool-tests/lj-1226-fix-predict-next.test.lua new file mode 100644 index 00000000..3cd2c8f5 --- /dev/null +++ b/test/tarantool-tests/lj-1226-fix-predict-next.test.lua @@ -0,0 +1,31 @@ +local tap = require('tap') +local test = tap.test('lj-1226-fix-predict-next') + +test:plan(3) + +-- The resulting bytecode is the following: +-- +-- 0001 KNIL 0 3 +-- 0002 JMP 4 => 0003 +-- 0003 => ITERC 4 2 3 +-- 0004 ITERL 4 => 0003 +-- +-- The parsing of the `for` iterator uses the incorrect check for +-- `fs->bclim`, which allows the usage of an uninitialized value, +-- so the test fails under Valgrind. +local res_f = loadstring([[ +-- This local variable is necessary, because it emits `KPRI` +-- bytecode, with which the next `KPRI` bytecode will be merged. +local _ +for _ in nil do end +]]) + +test:ok(res_f, 'chunk loaded successfully') + +local res, err = pcall(res_f) + +-- Check consistency with PUC Rio Lua 5.1 behaviour. +test:ok(not res, 'loaded function not executed') +test:like(err, 'attempt to call a nil value', 'correct error message') + +test:done(true) -- 2.47.1