From: Sergey Kaplun via Tarantool-patches <tarantool-patches@dev.tarantool.org> To: Maxim Kokryashkin <max.kokryashkin@gmail.com> Cc: tarantool-patches@dev.tarantool.org Subject: Re: [Tarantool-patches] [PATCH luajit] Fix recording of __concat metamethod. Date: Mon, 15 Jan 2024 18:39:38 +0300 [thread overview] Message-ID: <ZaVRuqzH2D7Uxg2B@root> (raw) In-Reply-To: <20240115142914.22527-1-m.kokryashkin@tarantool.org> Hi, Maxim! Thanks for the patch! LGTM, after adding a comment about the magic sequence of values for the concatenation (see the comment below). On 15.01.24, Maxim Kokryashkin wrote: > From: Mike Pall <mike> > > Reported by Elias Oelschner. Analyzed by XmiliaH. > > (cherry-picked from commit 3ee3c9cfa988339f1bf3068530515e2a6fb179d2) > > During the recording of `__concat` methametod, the `rec_mm_arith` > function overrides stack slots that are not restored for GC64 > mode later after the call. This leads to a segmentation fault > later on. This patch fixes the issue by accounting for those > additional slots in the array that is used to restore stack Minor: "slots in the array that is used to restore" sounds a little cumbersome. I suggest to say "slots in the array used for restoring" Feel free to ignore. > values. > > Maxim Kokryashkin: > * added the description and the test for the problem > > Part of tarantool/tarantool#9145 > --- > Branch: https://github.com/tarantool/luajit/tree/fckxorg/lj-839-concat-recording > PR: https://github.com/tarantool/tarantool/pull/9597 > Issues: https://github.com/tarantool/tarantool/issues/9145 > https://github.com/luajit/luajit/issues/839 > > src/lj_record.c | 2 +- > .../lj-839-concat-recording.test.lua | 27 +++++++++++++++++++ > 2 files changed, 28 insertions(+), 1 deletion(-) > create mode 100644 test/tarantool-tests/lj-839-concat-recording.test.lua > > diff --git a/src/lj_record.c b/src/lj_record.c > index a929b8aa..59549b03 100644 > --- a/src/lj_record.c > +++ b/src/lj_record.c > @@ -1932,7 +1932,7 @@ static TRef rec_tnew(jit_State *J, uint32_t ah) > static TRef rec_cat(jit_State *J, BCReg baseslot, BCReg topslot) > { > TRef *top = &J->base[topslot]; > - TValue savetv[5]; > + TValue savetv[5+LJ_FR2]; > BCReg s; > RecordIndex ix; > lj_assertJ(baseslot < topslot, "bad CAT arg"); > diff --git a/test/tarantool-tests/lj-839-concat-recording.test.lua b/test/tarantool-tests/lj-839-concat-recording.test.lua > new file mode 100644 > index 00000000..9ec0ed96 > --- /dev/null > +++ b/test/tarantool-tests/lj-839-concat-recording.test.lua > @@ -0,0 +1,27 @@ > +local tap = require('tap') > +local test = tap.test('lj-839-concat-recording'):skipcond({ > + ['Test requires JIT enabled'] = not jit.status(), > +}) > +test:plan(1) > + > +-- Test file to demonstrate LuaJIT overriding stack slots without > +-- restoration during the recording of the concat metamethod. > +-- See also: https://github.com/LuaJIT/LuaJIT/issues/839. > + > +-- Setup value with the `__concat` metamethod. > +local v1 = setmetatable({}, { > + __concat = function() return "" end, Typo: s/""/''/, according to the codestyle. Nit: 2 extra whitespaces at the beginning. > +}); > + > +jit.opt.start('hotloop=1') > +local result > +for _ = 1, 4 do > + result = v1 .. "" .. v1 .. "" Typo: s/""/''/g, according to the codestyle. Why do we need exactly this sequence? Please add a comment. > +end > + > +-- There should be an empty string in case of success. Typo: s/case/the case/ > +-- Failure results in a segmentation fault. > +-- The issue is GC64-specific, yet it is still being tested for > +-- other builds. > +test:is(result, '', 'correct stack restoration') > +test:done(true) > -- > 2.43.0 > -- Best regards, Sergey Kaplun
next prev parent reply other threads:[~2024-01-15 15:43 UTC|newest] Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top 2024-01-15 14:29 Maxim Kokryashkin via Tarantool-patches 2024-01-15 15:39 ` Sergey Kaplun via Tarantool-patches [this message] 2024-01-16 9:46 ` Sergey Bronnikov via Tarantool-patches 2024-03-11 12:30 Sergey Kaplun via Tarantool-patches 2024-03-12 7:43 ` Sergey Bronnikov via Tarantool-patches 2024-03-12 12:05 ` Maxim Kokryashkin via Tarantool-patches 2024-03-20 15:08 ` Sergey Kaplun via Tarantool-patches
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=ZaVRuqzH2D7Uxg2B@root \ --to=tarantool-patches@dev.tarantool.org \ --cc=max.kokryashkin@gmail.com \ --cc=skaplun@tarantool.org \ --subject='Re: [Tarantool-patches] [PATCH luajit] Fix recording of __concat metamethod.' \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: link
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox