Re: [Tarantool-patches] [PATCH luajit] Fix frame traversal for __gc handler frames.

[Sergey Kaplun via Tarantool-patches <tarantool-patches@dev.tarantool.org>]

Igor,

Thanks for the review!

On 02.11.21, Igor Munkin wrote:
> Sergey,
> 
> Thanks for the patch! Please, consider my comments below.
> 
> On 08.10.21, Sergey Kaplun wrote:
> > Hi, Sergos!
> > 
> > Thanks for the review!
> > 
> 
> <snipped>
> 
> > 
> > The new commit message is the following:
> > 
> > | Fix frame traversal for __gc handler frames.
> > |
> > | Reported by Changochen.
> > |
> > | (cherry picked from 53f82e6e2e858a0a62fd1a2ff47e9866693382e6)
> > |
> > | A cframe unwinding is missed for a C protected frame during a search for
> > | an error function to handle a runtime error. It leads to undefined
> > | behaviour or crash, when raising a runtime error on stack with the CP
> > | frame before an error function handler (for example, an error in __gc
> > | handler).
> > |
> > | This patch adds missing unwinding for CP frame.
> > |
> > | Sergey Kaplun:
> > | * added the description and the test for the problem
> > 
> > Branch is force-pushed.
> > 
> > > > 
> > > > Branch: https://github.com/tarantool/luajit/tree/skaplun/lj-601-fix-gc-finderrfunc
> > > > Tarantool branch: https://github.com/tarantool/tarantool/tree/skaplun/gh-noticket-fix-gc-finderrfunc
> > > > LuaJIT issue: https://github.com/LuaJIT/LuaJIT/issues/601
> > > > 
> > > > src/lj_err.c                                  |  1 +
> > > > .../lj-601-fix-gc-finderrfunc.test.lua        | 25 +++++++++++++++++++
> > > > 2 files changed, 26 insertions(+)
> > > > create mode 100644 test/tarantool-tests/lj-601-fix-gc-finderrfunc.test.lua
> > > > 
> 
> <snipped>
> 
> > > > diff --git a/test/tarantool-tests/lj-601-fix-gc-finderrfunc.test.lua b/test/tarantool-tests/lj-601-fix-gc-finderrfunc.test.lua
> > > > new file mode 100644
> > > > index 00000000..d8d79100
> > > > --- /dev/null
> > > > +++ b/test/tarantool-tests/lj-601-fix-gc-finderrfunc.test.lua
> > > 
> > > Unfortunately the test passes on the ’tarantool’ branch 
> > > 
> > > s-ostanevich:luajit s.ostanevich$ git checkout tarantool
> > > Switched to branch 'tarantool'
> > > s-ostanevich:luajit s.ostanevich$ git clean -xdff
> > > […]
> > > s-ostanevich:luajit s.ostanevich$ cmake .
> > > […]
> > > s-ostanevich:luajit s.ostanevich$ make
> > > […]
> > > [100%] Built target libluajit_shared
> > > [100%] Built target libluajit
> > > [100%] Built target luajit
> > > s-ostanevich:luajit s.ostanevich$ git checkout   skaplun/lj-601-fix-gc-finderrfunc
> > > s-ostanevich:luajit s.ostanevich$ cd test/tarantool-tests
> > > s-ostanevich:tarantool-tests s.ostanevich$ ../../src/luajit lj-601-fix-gc-finderrfunc.test.lua 
> > > TAP version 13
> > > 1..1
> > > ok - successfully collectgarbage with error
> > 
> > Wild guess: it doesn't fail on Mac due to GC64 ;).
> > See CI [1] to check my hypothesis.
> 
> Is it possible to fix the test chunk making it check the error even with
> GC64 enabled?

Yes, may be, but it is hard to forecast its behaviour:
We need to generate some garbage on the C stack to be used as an errfunc
value from the unprotected C frame suggested as C protected frame (since
`cframe_prev()` unwinding is missing for C protected frame (*).

(*) I.e. C frames are the following CP|C|CP and during handling the second
CP frame in finderrfunc we return the errfunc for the unprotected C
frame.

> 
> > 
> > > 
> > > > @@ -0,0 +1,25 @@
> > > > +local tap = require('tap')
> > > > +
> > > > +local test = tap.test('lj-601-fix-gc-finderrfunc')
> > > > +test:plan(1)
> > > > +
> > > > +-- Test file to demonstrate LuaJIT incorrect behaviour, when
> > > > +-- throwing error in __gc finalizer.
> > > > +-- See also, https://github.com/LuaJIT/LuaJIT/issues/601.
> > > > +
> > > > +collectgarbage()
> > > > +
> > > > +local a = newproxy(true)
> > > > +getmetatable(a).__gc = function()
> > > > +  -- Function to raise error via `lj_err_run()` inside __gc.
> 
> What does exactly raise an error in this function?

`collectgarbage()` returns number and attemt to call this number raises
an error.

> 
> > > > +  local _ = load(function() collectgarbage()() end)
> > > > +end
> > > > +
> > > > +-- XXX: Generate a small bunch of proxies. Need several to call
> > > > +-- `collectgarbage()` on another proxy inside __gc. N cycles is
> > > > +-- empirical number.
> 
> Why do you even need this loop? Why can't you just assign nil to <a>?

We need to create a chain with C|CP frames to use errfunction value
(that is garbage) from C frame as it was from C protected frame.
Add the corresponding comment.

See the iterative patch below. Branch is force-pushed.

> 
> > > > +for _ = 1, 4 do newproxy(a) end
> > > > +collectgarbage('collect')
> > > > +
> > > > +test:ok(true, 'successfully collectgarbage with error')
> 
> Minor: I propose to reword the following way:
> | error in __gc is successfully handled

Fixed.

Side note: 4 cycles is not enough sometimes (test is flaky) -- change
them to 6. See no false positives oks after the changes without fix.

===================================================================
diff --git a/test/tarantool-tests/lj-601-fix-gc-finderrfunc.test.lua b/test/tarantool-tests/lj-601-fix-gc-finderrfunc.test.lua
index d8d79100..38248c5b 100644
--- a/test/tarantool-tests/lj-601-fix-gc-finderrfunc.test.lua
+++ b/test/tarantool-tests/lj-601-fix-gc-finderrfunc.test.lua
@@ -16,10 +16,12 @@ getmetatable(a).__gc = function()
 end
 
 -- XXX: Generate a small bunch of proxies. Need several to call
--- `collectgarbage()` on another proxy inside __gc. N cycles is
--- empirical number.
-for _ = 1, 4 do newproxy(a) end
+-- `collectgarbage()` on another proxy inside __gc to get mix from
+-- C and C protected frames (we call `collectgarbage()` that
+-- starts finalizer in __gc metamethod which calls
+-- `collectgarbage()` again). N cycles is empirical number.
+for _ = 1, 6 do newproxy(a) end
 collectgarbage('collect')
 
-test:ok(true, 'successfully collectgarbage with error')
+test:ok(true, 'error in __gc is successfully handled')
 os.exit(test:check() and 0 or 1)
===================================================================

> 
> > > > +os.exit(test:check() and 0 or 1)
> > > > -- 
> > > > 2.31.0
> > > > 
> > > 
> > 
> > [1]: https://github.com/tarantool/tarantool/tree/skaplun/gh-noticket-fix-gc-finderrfunc-no-fix
> > 
> > -- 
> > Best regards,
> > Sergey Kaplun
> 
> -- 
> Best regards,
> IM

-- 
Best regards,
Sergey Kaplun