From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from [87.239.111.99] (localhost [127.0.0.1]) by dev.tarantool.org (Postfix) with ESMTP id 2EBF1BFB29C; Tue, 9 Jul 2024 15:14:50 +0300 (MSK) DKIM-Filter: OpenDKIM Filter v2.11.0 dev.tarantool.org 2EBF1BFB29C DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tarantool.org; s=dev; t=1720527290; bh=dYrcVqn2v6h29CzjBw8Tfn1NEB3n435DNGoZSTxM17s=; h=Date:To:References:In-Reply-To:Subject:List-Id:List-Unsubscribe: List-Archive:List-Post:List-Help:List-Subscribe:From:Reply-To:Cc: From; b=ThaqRUpobpVlUuOz28J0Ko6fmpoKGYqUkBEMx+XlWniwLLkHGk14MUY+drELF14el /uQbuN+p3s5zhXdBAcBkAPdw2tI1DVYrpU74YWmiNsBVLYFfb9cq8z3zLLvZRESpjz tKWv/A4SBnmX0FCnSxAs1TO/BWB0oLMVmyUPqI/0= Received: from smtp47.i.mail.ru (smtp47.i.mail.ru [95.163.41.85]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by dev.tarantool.org (Postfix) with ESMTPS id D4567BFB29D for ; Tue, 9 Jul 2024 15:14:48 +0300 (MSK) DKIM-Filter: OpenDKIM Filter v2.11.0 dev.tarantool.org D4567BFB29D Received: by smtp47.i.mail.ru with esmtpa (envelope-from ) id 1sR9k7-00000002eHV-21xw; Tue, 09 Jul 2024 15:14:47 +0300 Date: Tue, 9 Jul 2024 15:14:39 +0300 To: Sergey Bronnikov Message-ID: References: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: X-Mailru-Src: smtp X-4EC0790: 10 X-7564579A: 646B95376F6C166E X-77F55803: 4F1203BC0FB41BD979CF149FBD7EF9212AD048B08BE905115B29837A56FE852E00894C459B0CD1B94336ABFB17F433720D8C7DEFAB83460F25EBC9ADCFBE41EA8581BE4BC852DDB1B04C393452CF6677 X-7FA49CB5: FF5795518A3D127A4AD6D5ED66289B5278DA827A17800CE7922D113DFDC6D5A3EA1F7E6F0F101C67BD4B6F7A4D31EC0BCC500DACC3FED6E28638F802B75D45FF8AA50765F79006373BFF7CCD9F2968778638F802B75D45FF36EB9D2243A4F8B5A6FCA7DBDB1FC311F39EFFDF887939037866D6147AF826D843B75149109216696D62628E100FD74728DDA8520419F566CC7F00164DA146DAFE8445B8C89999728AA50765F790063783E00425F71A4181389733CBF5DBD5E9C8A9BA7A39EFB766F5D81C698A659EA7CC7F00164DA146DA9985D098DBDEAEC8062BEEFFB5F8EA3EF6B57BC7E6449061A352F6E88A58FB86F5D81C698A659EA7E827F84554CEF5019E625A9149C048EE9ECD01F8117BC8BEE2021AF6380DFAD18AA50765F790063735872C767BF85DA227C277FBC8AE2E8B81DF583BEE9BDE68EFF80C71ABB335746BA297DBC24807EABDAD6C7F3747799A X-C1DE0DAB: 0D63561A33F958A5B47FF41A4581BBBA5002B1117B3ED6961B8D02EBFEC0451430E4A65F242F5898823CB91A9FED034534781492E4B8EEAD9DB614F8F96CFA30BDAD6C7F3747799A X-C8649E89: 1C3962B70DF3F0ADE00A9FD3E00BEEDF3FED46C3ACD6F73ED3581295AF09D3DF87807E0823442EA2ED31085941D9CD0AF7F820E7B07EA4CF8A75901D419565A0562A7361C6F318A178923CE49BAFACCA6083E5F5EE871B318853F4E7B59623288E7497A9C4BD18FF0A5FC09BED0AE89A10C007248FBCCAF77729792A9F051C595F4332CA8FE04980913E6812662D5F2A5EAB5682573093F7837F15F2B5E4A70B33F2C28C22F508233FCF178C6DD14203 X-D57D3AED: 3ZO7eAau8CL7WIMRKs4sN3D3tLDjz0dLbV79QFUyzQ2Ujvy7cMT6pYYqY16iZVKkSc3dCLJ7zSJH7+u4VD18S7Vl4ZUrpaVfd2+vE6kuoey4m4VkSEu530nj6fImhcD4MUrOEAnl0W826KZ9Q+tr5ycPtXkTV4k65bRjmOUUP8cvGozZ33TWg5HZplvhhXbhDGzqmQDTd6OAevLeAnq3Ra9uf7zvY2zzsIhlcp/Y7m53TZgf2aB4JOg4gkr2biojfJERNbCcGXNTV0yfz0kaJw== X-DA7885C5: 5E818EE3ED3F6A23F255D290C0D534F9C8AEA0F7372856251C5492E7DF6E5C9611A31AE65E28E49A5B1A4C17EAA7BC4BEF2421ABFA55128DAF83EF9164C44C7E X-Mailru-Sender: 689FA8AB762F7393C6D0B12EA33CAA9BE6890A632375D1449462D603E11B7EAB30FD4B6BBEC90209E49D44BB4BD9522A059A1ED8796F048DB274557F927329BE89D5A3BC2B10C37545BD1C3CC395C826B4A721A3011E896F X-Mras: Ok Subject: Re: [Tarantool-patches] [PATCH luajit 2/2][v2] FFI: Turn FFI finalizer table into a proper GC root. X-BeenThere: tarantool-patches@dev.tarantool.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Tarantool development patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , From: Sergey Kaplun via Tarantool-patches Reply-To: Sergey Kaplun Cc: tarantool-patches@dev.tarantool.org Errors-To: tarantool-patches-bounces@dev.tarantool.org Sender: "Tarantool-patches" Hi, Sergey! Thanks for the patch! Please consider my comments below. On 09.07.24, Sergey Bronnikov wrote: > From: Mike Pall > > Reported by Sergey Bronnikov. > > (cherry picked from commit f5affaa6c4e7524e661484f22f24255f9a83eb47) > > Previous patch fixes the problem partially because the introduced Typo: s/Previous/The previous/ Typo: s/fixes (.*) partially/partially fixes \1/ > GC root may not exist at the start phase of the GC cycle. In that > case, the cdata finalizer table will be collected at the end of > the cycle. Access to the cdata finalizer table exhibits heap use Minor: "will be collected at the end of the cycle if it is created after the start phase." > after free. The patch is turned the finalizer table into a proper Typo: s/is turned/turns/ > GC root. It is worth mentioning that this table is created on the initialization of the main Lua State instead of loading the FFI library. > > Sergey Bronnikov: > * added the description and the tests for the problem > > Part of tarantool/tarantool#10199 > --- > src/lib_ffi.c | 20 +-------- > src/lj_cdata.c | 2 +- > src/lj_ctype.c | 12 ++++++ > src/lj_ctype.h | 2 +- > src/lj_gc.c | 41 ++++++++---------- > src/lj_obj.h | 3 ++ > src/lj_state.c | 3 ++ > ...free-on-access-to-CTState-finalizer.test.c | 42 +++++++++++++++++++ > 8 files changed, 81 insertions(+), 44 deletions(-) > > diff --git a/src/lib_ffi.c b/src/lib_ffi.c > index 7ed6fc78..3c8dd77f 100644 > --- a/src/lib_ffi.c > +++ b/src/lib_ffi.c > diff --git a/src/lj_cdata.c b/src/lj_cdata.c > index 35d0e76a..3d6ff1cc 100644 > --- a/src/lj_cdata.c > +++ b/src/lj_cdata.c > diff --git a/src/lj_ctype.c b/src/lj_ctype.c > index 53b83031..c0213629 100644 > --- a/src/lj_ctype.c > +++ b/src/lj_ctype.c > diff --git a/src/lj_ctype.h b/src/lj_ctype.h > index 8edbd561..2d393eb9 100644 > --- a/src/lj_ctype.h > +++ b/src/lj_ctype.h > diff --git a/src/lj_gc.c b/src/lj_gc.c > index 42348a34..4c222f21 100644 > --- a/src/lj_gc.c > +++ b/src/lj_gc.c > diff --git a/src/lj_obj.h b/src/lj_obj.h > index 69e94ff2..06ea0cd0 100644 > --- a/src/lj_obj.h > +++ b/src/lj_obj.h > diff --git a/src/lj_state.c b/src/lj_state.c > index 01d4901a..5a920102 100644 > --- a/src/lj_state.c > +++ b/src/lj_state.c > diff --git a/test/tarantool-c-tests/lj-1168-heap-use-after-free-on-access-to-CTState-finalizer.test.c b/test/tarantool-c-tests/lj-1168-heap-use-after-free-on-access-to-CTState-finalizer.test.c > index c388c6a7..259528cb 100644 > --- a/test/tarantool-c-tests/lj-1168-heap-use-after-free-on-access-to-CTState-finalizer.test.c > +++ b/test/tarantool-c-tests/lj-1168-heap-use-after-free-on-access-to-CTState-finalizer.test.c > @@ -55,10 +55,52 @@ static int unmarked_finalizer_tab_gcstart(void *test_state) > return TEST_EXIT_SUCCESS; > } > > +static int > +unmarked_finalizer_tab_gcsweep(void *test_state) > +{ > + const char buff[] = "return 1LL"; Why do we need an additional buffer if the same one already exists? > + > + /* Shared Lua state is not needed. */ > + (void)test_state; > + > + /* Setup. */ > + lua_State *L = luaL_newstate(); > + > + /* Set GC at the start. */ > + lua_gc(L, LUA_GCCOLLECT, 0); > + > + /* > + * Default step is too big -- one step ends after the > + * atomic phase. > + */ > + lua_gc(L, LUA_GCSETSTEPMUL, 1); > + > + /* Skip marking roots. */ > + lua_gc(L, LUA_GCSTEP, 1); > + > + /* Not trigger GC during `lua_openffi()`. */ > + lua_gc(L, LUA_GCSTOP, 0); Maybe it is worth adding this GC stop for the first test case too to make it more robust. > + > + int res = luaL_loadbufferx(L, buff, sizeof(buff) - 1, "chunk", "t"); > + assert_true(res == LUA_OK); I suppose it is better to use not assert_true here but `test_comment()` and `bail_out()`, since this is not behaviour that we are testing. > + > + /* Finish GC cycle. */ > + while (!lua_gc(L, LUA_GCSTEP, -1)); > + > + assert_true(lua_gettop(L) == 1); Why do we need this assert? > + > + /* Teardown. */ > + lua_settop(L, 0); > + lua_close(L); > + > + return TEST_EXIT_SUCCESS; > +} > + > int main(void) > { > const struct test_unit tgroup[] = { > test_unit_def(unmarked_finalizer_tab_gcstart), > + test_unit_def(unmarked_finalizer_tab_gcsweep), > }; > const int test_result = test_run_group(tgroup, NULL); > > -- > 2.34.1 > -- Best regards, Sergey Kaplun