tarantool / luajit / 12889039474

93%

tarantool/master: 93%

push

github

Prevent loop in snap_usedef().

Reported by XmiliaH.

(cherry picked from commit 0e66fc963)

It is possible to get an infinite loop in a function `snap_usedef`
when a `UCLO` makes a tight loop. This infinite loop could happen
when `snap_usedef()` called during trace recording (more
precisely on creation of the snapshot for the guarded trace
check) processes UCLO bytecode instruction and this instruction
attempts a jump with negative value. The patch fixes the problem
by checking a number of slots in a jump argument and replace this
value by `maxslot` if a value is negative, this means that no
values will be purged from the snapshot.

Sergey Bronnikov:
* added the description and the test for the problem

Part of tarantool/tarantool#10709

5691 of 6032 branches covered (94.35%)

Branch coverage included in aggregate %.

21682 of 23429 relevant lines covered (92.54%)

2935856.13 hits per line