Tarantool development patches archive
 help / color / mirror / Atom feed
* [Tarantool-patches] [PATCH luajit] Fix frame traversal for __gc handler frames.
@ 2021-10-05 10:28 Sergey Kaplun via Tarantool-patches
  2021-10-07 16:31 ` sergos via Tarantool-patches
  0 siblings, 1 reply; 4+ messages in thread
From: Sergey Kaplun via Tarantool-patches @ 2021-10-05 10:28 UTC (permalink / raw)
  To: Igor Munkin, Sergey Ostanevich; +Cc: tarantool-patches

From: Mike Pall <mike>

Reported by Changochen.

(cherry picked from 53f82e6e2e858a0a62fd1a2ff47e9866693382e6)

Additional stack traversal is needed to find an error function set for
handling runtime errors. cframe unwinding is missed for a C protected
frame during this stack traversal. It leads to undefined behaviour or
crash, when raising a runtime error on stack with the CP frame before an
error function handler (for example, an error in __gc handler).

This patch adds missing unwinding for CP frame.

Sergey Kaplun:
* added the description and the test for the problem
---

Branch: https://github.com/tarantool/luajit/tree/skaplun/lj-601-fix-gc-finderrfunc
Tarantool branch: https://github.com/tarantool/tarantool/tree/skaplun/gh-noticket-fix-gc-finderrfunc
LuaJIT issue: https://github.com/LuaJIT/LuaJIT/issues/601

 src/lj_err.c                                  |  1 +
 .../lj-601-fix-gc-finderrfunc.test.lua        | 25 +++++++++++++++++++
 2 files changed, 26 insertions(+)
 create mode 100644 test/tarantool-tests/lj-601-fix-gc-finderrfunc.test.lua

diff --git a/src/lj_err.c b/src/lj_err.c
index b6be357e..b520b3d3 100644
--- a/src/lj_err.c
+++ b/src/lj_err.c
@@ -585,6 +585,7 @@ static ptrdiff_t finderrfunc(lua_State *L)
       if (cframe_canyield(cf)) return 0;
       if (cframe_errfunc(cf) >= 0)
 	return cframe_errfunc(cf);
+      cf = cframe_prev(cf);
       frame = frame_prevd(frame);
       break;
     case FRAME_PCALL:
diff --git a/test/tarantool-tests/lj-601-fix-gc-finderrfunc.test.lua b/test/tarantool-tests/lj-601-fix-gc-finderrfunc.test.lua
new file mode 100644
index 00000000..d8d79100
--- /dev/null
+++ b/test/tarantool-tests/lj-601-fix-gc-finderrfunc.test.lua
@@ -0,0 +1,25 @@
+local tap = require('tap')
+
+local test = tap.test('lj-601-fix-gc-finderrfunc')
+test:plan(1)
+
+-- Test file to demonstrate LuaJIT incorrect behaviour, when
+-- throwing error in __gc finalizer.
+-- See also, https://github.com/LuaJIT/LuaJIT/issues/601.
+
+collectgarbage()
+
+local a = newproxy(true)
+getmetatable(a).__gc = function()
+  -- Function to raise error via `lj_err_run()` inside __gc.
+  local _ = load(function() collectgarbage()() end)
+end
+
+-- XXX: Generate a small bunch of proxies. Need several to call
+-- `collectgarbage()` on another proxy inside __gc. N cycles is
+-- empirical number.
+for _ = 1, 4 do newproxy(a) end
+collectgarbage('collect')
+
+test:ok(true, 'successfully collectgarbage with error')
+os.exit(test:check() and 0 or 1)
-- 
2.31.0


^ permalink raw reply	[flat|nested] 4+ messages in thread

* Re: [Tarantool-patches] [PATCH luajit] Fix frame traversal for __gc handler frames.
  2021-10-05 10:28 [Tarantool-patches] [PATCH luajit] Fix frame traversal for __gc handler frames Sergey Kaplun via Tarantool-patches
@ 2021-10-07 16:31 ` sergos via Tarantool-patches
  2021-10-08  8:39   ` Sergey Kaplun via Tarantool-patches
  0 siblings, 1 reply; 4+ messages in thread
From: sergos via Tarantool-patches @ 2021-10-07 16:31 UTC (permalink / raw)
  To: Sergey Kaplun; +Cc: tarantool-patches

Hi!
Thanks for the patch! See my 2 comments below.

Sergos

> On 5 Oct 2021, at 13:28, Sergey Kaplun <skaplun@tarantool.org> wrote:
> 
> From: Mike Pall <mike>
> 
> Reported by Changochen.
> 
> (cherry picked from 53f82e6e2e858a0a62fd1a2ff47e9866693382e6)
> 
> Additional stack traversal is needed to find an error function set for
   ^^^                          ^^^
Additional to what?            
 				
> handling runtime errors. cframe unwinding is missed for a C protected
> frame during this stack traversal.

I would rephrase - 
A cframe unwinding is miseed for a C protected frame during a serach for 
an error function to handle a runtime error. 

> It leads to undefined behaviour or
> crash, when raising a runtime error on stack with the CP frame before an
> error function handler (for example, an error in __gc handler).
> 
> This patch adds missing unwinding for CP frame.
> 
> Sergey Kaplun:
> * added the description and the test for the problem
> ---
> 
> Branch: https://github.com/tarantool/luajit/tree/skaplun/lj-601-fix-gc-finderrfunc
> Tarantool branch: https://github.com/tarantool/tarantool/tree/skaplun/gh-noticket-fix-gc-finderrfunc
> LuaJIT issue: https://github.com/LuaJIT/LuaJIT/issues/601
> 
> src/lj_err.c                                  |  1 +
> .../lj-601-fix-gc-finderrfunc.test.lua        | 25 +++++++++++++++++++
> 2 files changed, 26 insertions(+)
> create mode 100644 test/tarantool-tests/lj-601-fix-gc-finderrfunc.test.lua
> 
> diff --git a/src/lj_err.c b/src/lj_err.c
> index b6be357e..b520b3d3 100644
> --- a/src/lj_err.c
> +++ b/src/lj_err.c
> @@ -585,6 +585,7 @@ static ptrdiff_t finderrfunc(lua_State *L)
>       if (cframe_canyield(cf)) return 0;
>       if (cframe_errfunc(cf) >= 0)
> 	return cframe_errfunc(cf);
> +      cf = cframe_prev(cf);
>       frame = frame_prevd(frame);
>       break;
>     case FRAME_PCALL:
> diff --git a/test/tarantool-tests/lj-601-fix-gc-finderrfunc.test.lua b/test/tarantool-tests/lj-601-fix-gc-finderrfunc.test.lua
> new file mode 100644
> index 00000000..d8d79100
> --- /dev/null
> +++ b/test/tarantool-tests/lj-601-fix-gc-finderrfunc.test.lua

Unfortunately the test passes on the ’tarantool’ branch 

s-ostanevich:luajit s.ostanevich$ git checkout tarantool
Switched to branch 'tarantool'
s-ostanevich:luajit s.ostanevich$ git clean -xdff
[…]
s-ostanevich:luajit s.ostanevich$ cmake .
[…]
s-ostanevich:luajit s.ostanevich$ make
[…]
[100%] Built target libluajit_shared
[100%] Built target libluajit
[100%] Built target luajit
s-ostanevich:luajit s.ostanevich$ git checkout   skaplun/lj-601-fix-gc-finderrfunc
s-ostanevich:luajit s.ostanevich$ cd test/tarantool-tests
s-ostanevich:tarantool-tests s.ostanevich$ ../../src/luajit lj-601-fix-gc-finderrfunc.test.lua 
TAP version 13
1..1
ok - successfully collectgarbage with error

> @@ -0,0 +1,25 @@
> +local tap = require('tap')
> +
> +local test = tap.test('lj-601-fix-gc-finderrfunc')
> +test:plan(1)
> +
> +-- Test file to demonstrate LuaJIT incorrect behaviour, when
> +-- throwing error in __gc finalizer.
> +-- See also, https://github.com/LuaJIT/LuaJIT/issues/601.
> +
> +collectgarbage()
> +
> +local a = newproxy(true)
> +getmetatable(a).__gc = function()
> +  -- Function to raise error via `lj_err_run()` inside __gc.
> +  local _ = load(function() collectgarbage()() end)
> +end
> +
> +-- XXX: Generate a small bunch of proxies. Need several to call
> +-- `collectgarbage()` on another proxy inside __gc. N cycles is
> +-- empirical number.
> +for _ = 1, 4 do newproxy(a) end
> +collectgarbage('collect')
> +
> +test:ok(true, 'successfully collectgarbage with error')
> +os.exit(test:check() and 0 or 1)
> -- 
> 2.31.0
> 


^ permalink raw reply	[flat|nested] 4+ messages in thread

* Re: [Tarantool-patches] [PATCH luajit] Fix frame traversal for __gc handler frames.
  2021-10-07 16:31 ` sergos via Tarantool-patches
@ 2021-10-08  8:39   ` Sergey Kaplun via Tarantool-patches
  2021-10-14  8:58     ` sergos via Tarantool-patches
  0 siblings, 1 reply; 4+ messages in thread
From: Sergey Kaplun via Tarantool-patches @ 2021-10-08  8:39 UTC (permalink / raw)
  To: sergos; +Cc: tarantool-patches

Hi, Sergos!

Thanks for the review!

On 07.10.21, sergos wrote:
> Hi!
> Thanks for the patch! See my 2 comments below.
> 
> Sergos
> 
> > On 5 Oct 2021, at 13:28, Sergey Kaplun <skaplun@tarantool.org> wrote:
> > 
> > From: Mike Pall <mike>
> > 
> > Reported by Changochen.
> > 
> > (cherry picked from 53f82e6e2e858a0a62fd1a2ff47e9866693382e6)
> > 
> > Additional stack traversal is needed to find an error function set for
>    ^^^                          ^^^
> Additional to what?            
>  				

I mean additional to stack traversal during error raising to find
protected frame, but it is confusing, so I rephrase it as you suggested.

> > handling runtime errors. cframe unwinding is missed for a C protected
> > frame during this stack traversal.
> 
> I would rephrase - 
> A cframe unwinding is miseed for a C protected frame during a serach for 
> an error function to handle a runtime error. 
> 
> > It leads to undefined behaviour or
> > crash, when raising a runtime error on stack with the CP frame before an
> > error function handler (for example, an error in __gc handler).
> > 
> > This patch adds missing unwinding for CP frame.
> > 
> > Sergey Kaplun:
> > * added the description and the test for the problem
> > ---

The new commit message is the following:

| Fix frame traversal for __gc handler frames.
|
| Reported by Changochen.
|
| (cherry picked from 53f82e6e2e858a0a62fd1a2ff47e9866693382e6)
|
| A cframe unwinding is missed for a C protected frame during a search for
| an error function to handle a runtime error. It leads to undefined
| behaviour or crash, when raising a runtime error on stack with the CP
| frame before an error function handler (for example, an error in __gc
| handler).
|
| This patch adds missing unwinding for CP frame.
|
| Sergey Kaplun:
| * added the description and the test for the problem

Branch is force-pushed.

> > 
> > Branch: https://github.com/tarantool/luajit/tree/skaplun/lj-601-fix-gc-finderrfunc
> > Tarantool branch: https://github.com/tarantool/tarantool/tree/skaplun/gh-noticket-fix-gc-finderrfunc
> > LuaJIT issue: https://github.com/LuaJIT/LuaJIT/issues/601
> > 
> > src/lj_err.c                                  |  1 +
> > .../lj-601-fix-gc-finderrfunc.test.lua        | 25 +++++++++++++++++++
> > 2 files changed, 26 insertions(+)
> > create mode 100644 test/tarantool-tests/lj-601-fix-gc-finderrfunc.test.lua
> > 
> > diff --git a/src/lj_err.c b/src/lj_err.c
> > index b6be357e..b520b3d3 100644
> > --- a/src/lj_err.c
> > +++ b/src/lj_err.c
> > @@ -585,6 +585,7 @@ static ptrdiff_t finderrfunc(lua_State *L)
> >       if (cframe_canyield(cf)) return 0;
> >       if (cframe_errfunc(cf) >= 0)
> > 	return cframe_errfunc(cf);
> > +      cf = cframe_prev(cf);
> >       frame = frame_prevd(frame);
> >       break;
> >     case FRAME_PCALL:
> > diff --git a/test/tarantool-tests/lj-601-fix-gc-finderrfunc.test.lua b/test/tarantool-tests/lj-601-fix-gc-finderrfunc.test.lua
> > new file mode 100644
> > index 00000000..d8d79100
> > --- /dev/null
> > +++ b/test/tarantool-tests/lj-601-fix-gc-finderrfunc.test.lua
> 
> Unfortunately the test passes on the ’tarantool’ branch 
> 
> s-ostanevich:luajit s.ostanevich$ git checkout tarantool
> Switched to branch 'tarantool'
> s-ostanevich:luajit s.ostanevich$ git clean -xdff
> […]
> s-ostanevich:luajit s.ostanevich$ cmake .
> […]
> s-ostanevich:luajit s.ostanevich$ make
> […]
> [100%] Built target libluajit_shared
> [100%] Built target libluajit
> [100%] Built target luajit
> s-ostanevich:luajit s.ostanevich$ git checkout   skaplun/lj-601-fix-gc-finderrfunc
> s-ostanevich:luajit s.ostanevich$ cd test/tarantool-tests
> s-ostanevich:tarantool-tests s.ostanevich$ ../../src/luajit lj-601-fix-gc-finderrfunc.test.lua 
> TAP version 13
> 1..1
> ok - successfully collectgarbage with error

Wild guess: it doesn't fail on Mac due to GC64 ;).
See CI [1] to check my hypothesis.

> 
> > @@ -0,0 +1,25 @@
> > +local tap = require('tap')
> > +
> > +local test = tap.test('lj-601-fix-gc-finderrfunc')
> > +test:plan(1)
> > +
> > +-- Test file to demonstrate LuaJIT incorrect behaviour, when
> > +-- throwing error in __gc finalizer.
> > +-- See also, https://github.com/LuaJIT/LuaJIT/issues/601.
> > +
> > +collectgarbage()
> > +
> > +local a = newproxy(true)
> > +getmetatable(a).__gc = function()
> > +  -- Function to raise error via `lj_err_run()` inside __gc.
> > +  local _ = load(function() collectgarbage()() end)
> > +end
> > +
> > +-- XXX: Generate a small bunch of proxies. Need several to call
> > +-- `collectgarbage()` on another proxy inside __gc. N cycles is
> > +-- empirical number.
> > +for _ = 1, 4 do newproxy(a) end
> > +collectgarbage('collect')
> > +
> > +test:ok(true, 'successfully collectgarbage with error')
> > +os.exit(test:check() and 0 or 1)
> > -- 
> > 2.31.0
> > 
> 

[1]: https://github.com/tarantool/tarantool/tree/skaplun/gh-noticket-fix-gc-finderrfunc-no-fix

-- 
Best regards,
Sergey Kaplun

^ permalink raw reply	[flat|nested] 4+ messages in thread

* Re: [Tarantool-patches] [PATCH luajit] Fix frame traversal for __gc handler frames.
  2021-10-08  8:39   ` Sergey Kaplun via Tarantool-patches
@ 2021-10-14  8:58     ` sergos via Tarantool-patches
  0 siblings, 0 replies; 4+ messages in thread
From: sergos via Tarantool-patches @ 2021-10-14  8:58 UTC (permalink / raw)
  To: Sergey Kaplun; +Cc: tarantool-patches

[-- Attachment #1: Type: text/plain, Size: 5494 bytes --]

Hi!

You were absolutely right on my MacOS testing.
With your fixes applied - LGTM.

Sergos


> On 8 Oct 2021, at 11:39, Sergey Kaplun <skaplun@tarantool.org> wrote:
> 
> Hi, Sergos!
> 
> Thanks for the review!
> 
> On 07.10.21, sergos wrote:
>> Hi!
>> Thanks for the patch! See my 2 comments below.
>> 
>> Sergos
>> 
>>> On 5 Oct 2021, at 13:28, Sergey Kaplun <skaplun@tarantool.org> wrote:
>>> 
>>> From: Mike Pall <mike>
>>> 
>>> Reported by Changochen.
>>> 
>>> (cherry picked from 53f82e6e2e858a0a62fd1a2ff47e9866693382e6)
>>> 
>>> Additional stack traversal is needed to find an error function set for
>>   ^^^                          ^^^
>> Additional to what?            
>> 				
> 
> I mean additional to stack traversal during error raising to find
> protected frame, but it is confusing, so I rephrase it as you suggested.
> 
>>> handling runtime errors. cframe unwinding is missed for a C protected
>>> frame during this stack traversal.
>> 
>> I would rephrase - 
>> A cframe unwinding is miseed for a C protected frame during a serach for 
>> an error function to handle a runtime error. 
>> 
>>> It leads to undefined behaviour or
>>> crash, when raising a runtime error on stack with the CP frame before an
>>> error function handler (for example, an error in __gc handler).
>>> 
>>> This patch adds missing unwinding for CP frame.
>>> 
>>> Sergey Kaplun:
>>> * added the description and the test for the problem
>>> ---
> 
> The new commit message is the following:
> 
> | Fix frame traversal for __gc handler frames.
> |
> | Reported by Changochen.
> |
> | (cherry picked from 53f82e6e2e858a0a62fd1a2ff47e9866693382e6)
> |
> | A cframe unwinding is missed for a C protected frame during a search for
> | an error function to handle a runtime error. It leads to undefined
> | behaviour or crash, when raising a runtime error on stack with the CP
> | frame before an error function handler (for example, an error in __gc
> | handler).
> |
> | This patch adds missing unwinding for CP frame.
> |
> | Sergey Kaplun:
> | * added the description and the test for the problem
> 
> Branch is force-pushed.
> 
>>> 
>>> Branch: https://github.com/tarantool/luajit/tree/skaplun/lj-601-fix-gc-finderrfunc
>>> Tarantool branch: https://github.com/tarantool/tarantool/tree/skaplun/gh-noticket-fix-gc-finderrfunc
>>> LuaJIT issue: https://github.com/LuaJIT/LuaJIT/issues/601
>>> 
>>> src/lj_err.c                                  |  1 +
>>> .../lj-601-fix-gc-finderrfunc.test.lua        | 25 +++++++++++++++++++
>>> 2 files changed, 26 insertions(+)
>>> create mode 100644 test/tarantool-tests/lj-601-fix-gc-finderrfunc.test.lua
>>> 
>>> diff --git a/src/lj_err.c b/src/lj_err.c
>>> index b6be357e..b520b3d3 100644
>>> --- a/src/lj_err.c
>>> +++ b/src/lj_err.c
>>> @@ -585,6 +585,7 @@ static ptrdiff_t finderrfunc(lua_State *L)
>>>      if (cframe_canyield(cf)) return 0;
>>>      if (cframe_errfunc(cf) >= 0)
>>> 	return cframe_errfunc(cf);
>>> +      cf = cframe_prev(cf);
>>>      frame = frame_prevd(frame);
>>>      break;
>>>    case FRAME_PCALL:
>>> diff --git a/test/tarantool-tests/lj-601-fix-gc-finderrfunc.test.lua b/test/tarantool-tests/lj-601-fix-gc-finderrfunc.test.lua
>>> new file mode 100644
>>> index 00000000..d8d79100
>>> --- /dev/null
>>> +++ b/test/tarantool-tests/lj-601-fix-gc-finderrfunc.test.lua
>> 
>> Unfortunately the test passes on the ’tarantool’ branch 
>> 
>> s-ostanevich:luajit s.ostanevich$ git checkout tarantool
>> Switched to branch 'tarantool'
>> s-ostanevich:luajit s.ostanevich$ git clean -xdff
>> […]
>> s-ostanevich:luajit s.ostanevich$ cmake .
>> […]
>> s-ostanevich:luajit s.ostanevich$ make
>> […]
>> [100%] Built target libluajit_shared
>> [100%] Built target libluajit
>> [100%] Built target luajit
>> s-ostanevich:luajit s.ostanevich$ git checkout   skaplun/lj-601-fix-gc-finderrfunc
>> s-ostanevich:luajit s.ostanevich$ cd test/tarantool-tests
>> s-ostanevich:tarantool-tests s.ostanevich$ ../../src/luajit lj-601-fix-gc-finderrfunc.test.lua 
>> TAP version 13
>> 1..1
>> ok - successfully collectgarbage with error
> 
> Wild guess: it doesn't fail on Mac due to GC64 ;).
> See CI [1] to check my hypothesis.
> 
>> 
>>> @@ -0,0 +1,25 @@
>>> +local tap = require('tap')
>>> +
>>> +local test = tap.test('lj-601-fix-gc-finderrfunc')
>>> +test:plan(1)
>>> +
>>> +-- Test file to demonstrate LuaJIT incorrect behaviour, when
>>> +-- throwing error in __gc finalizer.
>>> +-- See also, https://github.com/LuaJIT/LuaJIT/issues/601.
>>> +
>>> +collectgarbage()
>>> +
>>> +local a = newproxy(true)
>>> +getmetatable(a).__gc = function()
>>> +  -- Function to raise error via `lj_err_run()` inside __gc.
>>> +  local _ = load(function() collectgarbage()() end)
>>> +end
>>> +
>>> +-- XXX: Generate a small bunch of proxies. Need several to call
>>> +-- `collectgarbage()` on another proxy inside __gc. N cycles is
>>> +-- empirical number.
>>> +for _ = 1, 4 do newproxy(a) end
>>> +collectgarbage('collect')
>>> +
>>> +test:ok(true, 'successfully collectgarbage with error')
>>> +os.exit(test:check() and 0 or 1)
>>> -- 
>>> 2.31.0
>>> 
>> 
> 
> [1]: https://github.com/tarantool/tarantool/tree/skaplun/gh-noticket-fix-gc-finderrfunc-no-fix <https://github.com/tarantool/tarantool/tree/skaplun/gh-noticket-fix-gc-finderrfunc-no-fix>
> 
> -- 
> Best regards,
> Sergey Kaplun


[-- Attachment #2: Type: text/html, Size: 35435 bytes --]

^ permalink raw reply	[flat|nested] 4+ messages in thread

end of thread, other threads:[~2021-10-14  8:58 UTC | newest]

Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-10-05 10:28 [Tarantool-patches] [PATCH luajit] Fix frame traversal for __gc handler frames Sergey Kaplun via Tarantool-patches
2021-10-07 16:31 ` sergos via Tarantool-patches
2021-10-08  8:39   ` Sergey Kaplun via Tarantool-patches
2021-10-14  8:58     ` sergos via Tarantool-patches

Tarantool development patches archive

This inbox may be cloned and mirrored by anyone:

	git clone --mirror https://lists.tarantool.org/tarantool-patches/0 tarantool-patches/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 tarantool-patches tarantool-patches/ https://lists.tarantool.org/tarantool-patches \
		tarantool-patches@dev.tarantool.org.
	public-inbox-index tarantool-patches

Example config snippet for mirrors.


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git