From: Sergey Bronnikov via Tarantool-patches <tarantool-patches@dev.tarantool.org> To: Sergey Kaplun <skaplun@tarantool.org>, Maxim Kokryashkin <m.kokryashkin@tarantool.org> Cc: tarantool-patches@dev.tarantool.org Subject: Re: [Tarantool-patches] [PATCH luajit] Fix predict_next() in parser. Date: Mon, 21 Aug 2023 15:04:47 +0300 [thread overview] Message-ID: <35c90999-f893-ed59-034d-4986e7b44b72@tarantool.org> (raw) In-Reply-To: <20230815142541.29855-1-skaplun@tarantool.org> Hi, Sergey thanks for the patch! See comments inline. On 8/15/23 17:25, Sergey Kaplun wrote: > From: Mike Pall <mike> > > Reported by Sergey Kaplun. > > (cherry-picked from commit caf7cbc57c945f7b68871ad72abafb2b6e6fb7f5) > > Assume, we have the following Lua code: > | local _ > | for _ in (nil):foo() do end > > The first part of the bytecode emitted for it is the following: > | 0001 KNIL 0 1 > | 0002 MOV 2 1 > | 0003 TGETS 1 1 0 ; "foo" > | 0004 CALL 1 4 2 > > The `0001 KNIL` is a result of merging two `KPRI` instructions: one for > the local variable, one for the slot with `nil` object. During parsing in > `predict_next()` the second `MOV` bytecode is examined to set `pairs` or > `next` local variable. But, as far as it moves `nil` value, that isn't > an actual variable, so it has no the name this leads to the crash. > > This patch adds the check to be sure that `RD` in the `MOV` bytecode is > an actual variable. > > Sergey Kaplun: > * added the description and the test for the problem > > Part of tarantool/tarantool#8825 > --- > > Branch: https://github.com/tarantool/luajit/tree/skaplun/lj-1033-fix-parsing-predict-next > PR: https://github.com/tarantool/tarantool/pull/8987 > Related issues: > * https://github.com/LuaJIT/LuaJIT/issues/1033 > * https://github.com/tarantool/tarantool/issues/8825 > > src/lj_parse.c | 1 + > .../lj-1033-fix-parsing-predict-next.test.lua | 30 +++++++++++++++++++ > 2 files changed, 31 insertions(+) > create mode 100644 test/tarantool-tests/lj-1033-fix-parsing-predict-next.test.lua > > diff --git a/src/lj_parse.c b/src/lj_parse.c > index 3f6caaec..420b95cb 100644 > --- a/src/lj_parse.c > +++ b/src/lj_parse.c > @@ -2532,6 +2532,7 @@ static int predict_next(LexState *ls, FuncState *fs, BCPos pc) > cTValue *o; > switch (bc_op(ins)) { > case BC_MOV: > + if (bc_d(ins) >= fs->nactvar) return 0; > name = gco2str(gcref(var_get(ls, fs, bc_d(ins)).name)); > break; > case BC_UGET: > diff --git a/test/tarantool-tests/lj-1033-fix-parsing-predict-next.test.lua b/test/tarantool-tests/lj-1033-fix-parsing-predict-next.test.lua > new file mode 100644 > index 00000000..624344eb > --- /dev/null > +++ b/test/tarantool-tests/lj-1033-fix-parsing-predict-next.test.lua > @@ -0,0 +1,30 @@ > +local tap = require('tap') > +local test = tap.test('lj-1033-fix-parsing-predict-next') > + > +test:plan(3) > + > +local res_f = loadstring([[ > +-- This local variable is necessary, because it emits `KPRI` > +-- bytecode, with which the next `KPRI` bytecode will be merged. > +-- > +-- The resulting bytecode is the following: > +-- > +-- 0001 KNIL 0 1 > +-- 0002 MOV 2 1 > +-- 0003 TGETS 1 1 0 ; "foo" > +-- 0004 CALL 1 4 2 > +-- > +-- This MOV don't use any variable value from the stack, so the > +-- attempt to get the name in `predict_next() leads to the crash. What is a point to put a comment inside loadstring, not before it? > +local _ > +for _ in (nil):foo() do end > +]]) > + > +test:ok(res_f, 'chunk loaded sucsessfully') typo: sucsessfully -> successfully > + > +local res, err = pcall(res_f) > + > +test:ok(not res, 'loaded function not executed') it is not clear for me what for do you need checking result code. I would omit it. Feel free to ignore. > +test:like(err, 'attempt to index a nil value', 'correct error message') > + > +test:done(true)
next prev parent reply other threads:[~2023-08-21 12:04 UTC|newest] Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top 2023-08-15 14:25 Sergey Kaplun via Tarantool-patches 2023-08-16 12:25 ` Maxim Kokryashkin via Tarantool-patches 2023-08-16 15:52 ` Sergey Kaplun via Tarantool-patches 2023-08-21 12:04 ` Sergey Bronnikov via Tarantool-patches [this message] 2023-08-22 15:17 ` Sergey Kaplun via Tarantool-patches 2023-08-24 7:50 ` Sergey Bronnikov via Tarantool-patches 2023-08-31 15:19 ` Igor Munkin via Tarantool-patches
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=35c90999-f893-ed59-034d-4986e7b44b72@tarantool.org \ --to=tarantool-patches@dev.tarantool.org \ --cc=m.kokryashkin@tarantool.org \ --cc=sergeyb@tarantool.org \ --cc=skaplun@tarantool.org \ --subject='Re: [Tarantool-patches] [PATCH luajit] Fix predict_next() in parser.' \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: link
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox