tarantool / luajit / 7875093264

70%

tarantool/master: 93%

push

github

Only emit proper parent references in snapshot replay.

Thanks to Peter Cawley.

(cherry picked from commit 9bdfd34dc)

Assume we have a trace containing the IR instruction:
| {sink}  tab TNEW   #32762  #0

`lj_snap_replay()` assumes that 32762 (0x7ffa) (op1 of TNEW) is a
constant reference. It is passed to the `snap_replay_const()` lookup to
the IR constant in the 0x7ffa slot. If this slot contains the second
part of the IR constant number 0.5029296875 (step of the cycle) in its
raw form (0x3fe0180000000000). The 0x18 part is treated as IROp
(IR_KGC), and JIT is trying to continue with a store of an invalid GC
object, which leads to a crash.

This patch checks that only the IRMref IR operand is needed to restore.

Sergey Kaplun:
* added the description and the test for the problem

Part of tarantool/tarantool#9595

Reviewed-by: Maxim Kokryashkin <m.kokryashkin@tarantool.org>
Reviewed-by: Sergey Bronnikov <sergeyb@tarantool.org>
Signed-off-by: Igor Munkin <imun@tarantool.org>
(cherry picked from commit 63c7672c9)

5399 of 5988 branches covered (0.0%)

Branch coverage included in aggregate %.

20651 of 23299 relevant lines covered (88.63%)

758815.45 hits per line