tarantool / luajit / 6877584730

89%

tarantool/master: 93%

Build Type

push

github

Committed by ligurio

Commit Message

LJ_GC64: Fix lua_concat().

Reported by Mathias Westerdahl.

(cherry picked from commit 633f265f6)

Lua 5.1 Reference Manual [1] defines a function `lua_concat`, that:

> void lua_concat (lua_State *L, int n);
>
> Concatenates the n values at the top of the stack, pops them, and leaves
> the result at the top.

Without the patch, `lua_concat()` behaved incorrectly with userdata with
the defined `__concat` metamethod. The problem is GC64-specific.

Assuming we have three literals and a userdata with the defined
`__concat` metamethod on top of the Lua stack:

1 [string]
2 [string]
3 [string]
4 [string]
5 [userdata] <--- top

On attempt to concatenate *two* items on top of the Lua stack,
`lua_concat()` concatenates *four* items and leaves the result on top of
the Lua stack:

1 [string]
2 [string][string][string][userdata] <--- top

The problem is in the incorrect calculation of `n` counter in the loop
in the implementation of function `lua_concat`. Without the fix, `n` is
equal to 3 at the end of the first iteration, and therefore it goes to
the next iteration of concatenation. In the fixed implementation of
`lua_concat()`, `n` is equal to 1 at the end of the first loop iteration,
decremented in a loop postcondition, and breaks the loop.

For details see implementation of `lj_meta_cat()` in <src/lj_meta.c>.

The patch fixes incorrect behaviour.

1. https://www.lua.org/manual/5.1/manual.html

Sergey Bronnikov:
* added the description and the test for the problem

Part of tarantool/tarantool#9145

Run Details

5345 of 5972 branches covered (0.0%)

Branch coverage included in aggregate %.

1 of 1 new or added line in 1 file covered. (100.0%)

28 existing lines in 5 files now uncovered.

20494 of 23293 relevant lines covered (87.98%)

2742856.61 hits per line