From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from [87.239.111.99] (localhost [127.0.0.1]) by dev.tarantool.org (Postfix) with ESMTP id 7DC661B72C48; Fri, 6 Mar 2026 16:43:07 +0300 (MSK) DKIM-Filter: OpenDKIM Filter v2.11.0 dev.tarantool.org 7DC661B72C48 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tarantool.org; s=dev; t=1772804587; bh=yumvvoKqpEEYq95tZRT1Zb/HKHgO23NRA77i9Nswv/8=; h=To:Date:In-Reply-To:References:Subject:List-Id:List-Unsubscribe: List-Archive:List-Post:List-Help:List-Subscribe:From:Reply-To:Cc: From; b=IhQ7nO8hsWOMeXST1SSl4zpO3n/NPZIBeF8MjbYDBgrrh84LL6czMyfLf+FJO/8l8 HtNleRVhTbHfIGveNrlH+4vcjxdcjnTRTgsQ5RdKRFGZk1cXj2HxZ0ARZ9UuRIjWip eTKzbXbIVYFdNnMSCmUOboVE8Do7l8vrlCq3OpLk= Received: from send175.i.mail.ru (send175.i.mail.ru [95.163.59.14]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by dev.tarantool.org (Postfix) with ESMTPS id 2614419AD73C for ; Fri, 6 Mar 2026 16:42:09 +0300 (MSK) DKIM-Filter: OpenDKIM Filter v2.11.0 dev.tarantool.org 2614419AD73C Received: by exim-smtp-695fc89d9f-w2j46 with esmtpa (envelope-from ) id 1vyVRP-00000000I8k-3xaJ; Fri, 06 Mar 2026 16:42:08 +0300 To: Sergey Bronnikov Date: Fri, 6 Mar 2026 16:42:55 +0300 Message-ID: X-Mailer: git-send-email 2.53.0 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Mailru-Src: smtp X-4EC0790: 10 X-7564579A: B8F34718100C35BD X-77F55803: 4F1203BC0FB41BD91ABAE9865AC7DC8850146831463F184C5FE898FE311831A4182A05F5380850405F5DCD448E9599F93DE06ABAFEAF6705482B1E7268883F07DCE0344743397B70BB4A5D54B34CC71E X-7FA49CB5: FF5795518A3D127A4AD6D5ED66289B5278DA827A17800CE76D9A64DA33E5B915EA1F7E6F0F101C67BD4B6F7A4D31EC0BCC500DACC3FED6E28638F802B75D45FF8AA50765F7900637AC83A81C8FD4AD23D82A6BABE6F325AC2E85FA5F3EDFCBAA7353EFBB553375666F44369204E714C71A41C76590B8617C34C2904774DD7533FE2FB068F1593403389733CBF5DBD5E913377AFFFEAFD269176DF2183F8FC7C0565C7A4E90E531F78941B15DA834481FCF19DD082D7633A0EF3E4896CB9E6436389733CBF5DBD5E9D5E8D9A59859A8B6F532FBFD8162E58CCC7F00164DA146DA6F5DAA56C3B73B237318B6A418E8EAB8D32BA5DBAC0009BE9E8FC8737B5C22499945D34D3FC23A0C76E601842F6C81A12EF20D2F80756B5FB606B96278B59C4276E601842F6C81A127C277FBC8AE2E8BDAD9BF5102A1C0363AA81AA40904B5D99C9F4D5AE37F343AD1F44FA8B9022EA23BBE47FD9DD3FB595F5C1EE8F4F765FC72CEEB2601E22B093A03B725D353964B0B7D0EA88DDEDAC722CA9DD8327EE4930A3850AC1BE2E7352629B07FD02F83A6C4224003CC83647689D4C264860C145E X-C1DE0DAB: 0D63561A33F958A5D7244C9C563402105002B1117B3ED696BBBAD03973BC748C72305013E4AE841E823CB91A9FED034534781492E4B8EEAD85CCBA673D36D1A4C79554A2A72441328621D336A7BC284946AD531847A6065A17B107DEF921CE79BDAD6C7F3747799A X-C8649E89: 1C3962B70DF3F0AD73CAD6646DEDE191716CD42B3DD1D34CAB70F9BE574AE9C625B6776AC983F447FC0B9F89525902EE6F57B2FD27647F25E66C117BDB76D659E10AF66F1A20F81CCA2568B5C4141C8D407EFDCDEAB3C1E3E959F183B0837AF66FB55BE927E9D4EDB8341EE9D5BE9A0A2472A4F3EFB6B45BEF77CD829DB9C1E0E118843C829A687F6536EB022892E5344C41F94D744909CECFA6C6B0C050A61A8CAF69B82BA93681CD72808BE417F3B9E0E7457915DAA85F X-D57D3AED: 3ZO7eAau8CL7WIMRKs4sN3D3tLDjz0dLbV79QFUyzQ2Ujvy7cMT6pYYqY16iZVKkSc3dCLJ7zSJH7+u4VD18S7Vl4ZUrpaVfd2+vE6kuoey4m4VkSEu53w8ahmwBjZKM/YPHZyZHvz5uv+WouB9+ObcCpyrx6l7KImUglyhkEat/+ysWwi0gdhEs0JGjl6ggRWTy1haxBpVdbIX1nthFXMZebaIdHP2ghjoIc/363UZI6Kf1ptIMVbwN8XFWZxQUA6HgT/HmIhk= X-Mailru-Sender: 583F1D7ACE8F49BDD951BA70C165859EFF7D02DFA92120F9E9E07FF329DA7D474377EB9DC5AC5F4778CBAE4DDE79EAA5F2400F607609286E924004A7DEC283833C7120B22964430C52B393F8C72A41A84198E0F3ECE9B5443453F38A29522196 X-Mras: Ok Subject: [Tarantool-patches] [PATCH luajit 2/2] Fix edge cases when recording string.byte/sub. X-BeenThere: tarantool-patches@dev.tarantool.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Tarantool development patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , From: Sergey Kaplun via Tarantool-patches Reply-To: Sergey Kaplun Cc: tarantool-patches@dev.tarantool.org Errors-To: tarantool-patches-bounces@dev.tarantool.org Sender: "Tarantool-patches" From: Mike Pall Thanks to Sergey Kaplun. (cherry picked from commit 89f268b3f745dba80da6350d3cbbb0964f3fdbee) It is possible that the `len` (`end - start`) will underflow and become positive in the `recff_string_range()` when the `end` is negative. For `string.sub()` this is not crucial, since the trace will be valid anyway. But for `string.byte()` it may lead to the assertion failure in the `rec_check_slots()`. This patch fixes those underflows by the correct comparison. Sergey Kaplun: * added the description and the test for the problem Part of tarantool/tarantool#12134 --- src/lj_ffrecord.c | 6 ++--- .../lj-1443-stirng-byte-underflow.test.lua | 25 +++++++++++++++++++ 2 files changed, 28 insertions(+), 3 deletions(-) create mode 100644 test/tarantool-tests/lj-1443-stirng-byte-underflow.test.lua diff --git a/src/lj_ffrecord.c b/src/lj_ffrecord.c index d888e83e..aad1bd87 100644 --- a/src/lj_ffrecord.c +++ b/src/lj_ffrecord.c @@ -810,7 +810,7 @@ static void LJ_FASTCALL recff_string_range(jit_State *J, RecordFFData *rd) } trstart = recff_string_start(J, str, &start, trstart, trlen, tr0); if (rd->data) { /* Return string.sub result. */ - if (end - start >= 0) { + if (start <= end) { /* Also handle empty range here, to avoid extra traces. */ TRef trptr, trslen = emitir(IRTGI(IR_SUBOV), trend, trstart); emitir(IRTGI(IR_GE), trslen, tr0); @@ -821,8 +821,8 @@ static void LJ_FASTCALL recff_string_range(jit_State *J, RecordFFData *rd) J->base[0] = lj_ir_kstr(J, &J2G(J)->strempty); } } else { /* Return string.byte result(s). */ - ptrdiff_t i, len = end - start; - if (len > 0) { + if (start < end) { + ptrdiff_t i, len = end - start; TRef trslen = emitir(IRTGI(IR_SUBOV), trend, trstart); emitir(IRTGI(IR_EQ), trslen, lj_ir_kint(J, (int32_t)len)); if (J->baseslot + len > LJ_MAX_JSLOTS) diff --git a/test/tarantool-tests/lj-1443-stirng-byte-underflow.test.lua b/test/tarantool-tests/lj-1443-stirng-byte-underflow.test.lua new file mode 100644 index 00000000..9f91718c --- /dev/null +++ b/test/tarantool-tests/lj-1443-stirng-byte-underflow.test.lua @@ -0,0 +1,25 @@ +local tap = require('tap') + +-- The test file to demonstrate integer underflow during recording +-- for the `string.byte()` built-in. +-- See also https://github.com/LuaJIT/LuaJIT/issues/1443. + +local test = tap.test('lj-1443-stirng-byte-underflow'):skipcond({ + ['Test requires JIT enabled'] = not jit.status(), +}) + +test:plan(1) + +jit.opt.start('hotloop=1') + +local result +local str = 'xxx' +for _ = 1, 4 do + -- Failed assertion in `rec_check_slots()` due to incorrect + -- number of results after underflow. + result = (str):byte(0X7FFFFFFF, -0X7FFFFFFF) +end + +test:is(result, nil, 'correct result on trace') + +test:done(true) -- 2.53.0