tarantool / luajit / 7890154942

93%

push

github

LJ_GC64: Always snapshot functions for non-base frames.

Reported by Arseny Vakhrushev.
Analysis and fix contributed by Peter Cawley.

(cherry picked from commit ff1e72ace)

The problem is GC64-specific and could be reproduced with enabled
compiler options LUA_USE_ASSERT and LUA_USE_APICHECK.

The case with the bug is the following: imagine we have a function that
is recorded to a trace and calls a built-in function that is not
JIT-compilable (see NYI) and therefore triggers exit to the interpreter,
and then it resumes tracing just after the call returns - this is trace
stitching. Then, within the call, we need the potential for a side
trace. Finally, we need that side exit to be taken enough times for the
exit to be compiled into a trace. This compilation hits the assertion
failure.

The patch adds a function below the frame in the snapshot for the
`LJ_FR2` mode.

Sergey Kaplun:
* minimized reproducer made by fuzzing test

Sergey Bronnikov:
* added the description (see a comment in the test)
* added tests for the problem: first one based on the original
  reproducer and second one based on a reproducer made by fuzzing test.

Part of tarantool/tarantool#9145

Reviewed-by: Maxim Kokryashkin <m.kokryashkin@tarantool.org>
Reviewed-by: Sergey Kaplun <skaplun@tarantool.org>
Signed-off-by: Igor Munkin <imun@tarantool.org>

5423 of 6016 branches covered (90.14%)

Branch coverage included in aggregate %.

20755 of 23409 relevant lines covered (88.66%)

2800398.37 hits per line