tarantool / luajit / 6010772579

93%

push

github

Fix maxslots when recording BC_TSETM.

Analyzed by Sergey Kaplun.

(cherry-picked from commit 0cc5fdfbc)

Recording of the `BC_TSETM` bytecode may keep the JIT maxslot too
optimistic. In that case, the slot above the top of the Lua stack may be
considered used. When any VM event handler is called before the
recording of the next instruction, this leads to an assertion failure in
`rec_check_slots()`.

This patch sets the `ra` as a maxslot, as far as the `ra` - 1 contains a
table, which is always the highest slot after this bytecode. Also, it
adds an assertion that we check slots below the top of the Lua stack.

Sergey Kaplun:
* added the description and the test for the problem

Part of tarantool/tarantool#8825

Reviewed-by: Maxim Kokryashkin <m.kokryashkin@tarantool.org>
Reviewed-by: Sergey Bronnikov <sergeyb@tarantool.org>
Signed-off-by: Igor Munkin <imun@tarantool.org>

5328 of 5969 branches covered (0.0%)

Branch coverage included in aggregate %.

1 of 1 new or added line in 1 file covered. (100.0%)

20421 of 23288 relevant lines covered (87.69%)

1296448.59 hits per line