tarantool / luajit / 12889718783

93%

tarantool/master: 93%

push

github

Prevent loop in snap_usedef().

Reported by XmiliaH.

(cherry picked from commit 0e66fc963)

It is possible to get an infinite loop in a function `snap_usedef` when
a `UCLO` makes a tight loop. This infinite loop could happen when
`snap_usedef()` called during trace recording (more precisely, on the
creation of the snapshot for the guarded trace check) processes UCLO
bytecode instruction, and this instruction attempts a jump back with a
negative offset value. The patch fixes the problem by checking a number
of slots in a jump argument and replacing this value by `maxslot` if a
value is negative, this means that no values will be purged from the
snapshot.

Sergey Bronnikov:
* added the description and the test for the problem

Part of tarantool/tarantool#10709

5693 of 6031 branches covered (94.4%)

Branch coverage included in aggregate %.

21702 of 23432 relevant lines covered (92.62%)

2947162.59 hits per line