Re: [Tarantool-patches] [PATCH luajit] Fix unsinking of IR_FSTORE for NULL metatable.

[Igor Munkin via Tarantool-patches <tarantool-patches@dev.tarantool.org>]

Sergey,

I've checked the patchset into all long-term branches in
tarantool/luajit and bumped a new version in master, release/3.0 and
release/2.11.

On 31.01.24, Sergey Kaplun via Tarantool-patches wrote:
> From: Mike Pall <mike>
> 
> Reported by pwnhacker0x18.
> 
> (cherry picked from commit 85b4fed0b0353dd78c8c875c2f562d522a2b310f)
> 
> The `FSTORE` restoring of a sunk table from a snapshot for
> `IRFL_TAB_META` misses the case when the second argument of
> `setmetatable()` is `nil` (so, the `FSTORE` second operand is `NULL`).
> This may lead to the corresponding assertion failure in the
> `snap_replay_const()` or the crash.
> 
> This patch handles the aforementioned case.
> 
> Sergey Kaplun:
> * added the description and the test for the problem
> 
> Part of tarantool/tarantool#9595
> ---
> 
> Branch: https://github.com/tarantool/luajit/tree/skaplun/lj-1147-fstore-null-meta
> Tarantool PR: https://github.com/tarantool/tarantool/pull/9635
> Related issues:
> * https://github.com/tarantool/tarantool/issues/9595
> * https://github.com/LuaJIT/LuaJIT/issues/1147
> 
>  src/lj_snap.c                                 | 11 +++--
>  .../lj-1147-fstore-null-meta.test.lua         | 41 +++++++++++++++++++
>  2 files changed, 49 insertions(+), 3 deletions(-)
>  create mode 100644 test/tarantool-tests/lj-1147-fstore-null-meta.test.lua
> 

<snipped>

> -- 
> 2.43.0
> 

-- 
Best regards,
IM