tarantool / luajit / 12890351666

93%

push

github

Prevent loop in snap_usedef().

Reported by XmiliaH.

(cherry picked from commit 0e66fc963)

It is possible to get an infinite loop in a function `snap_usedef` when
a `UCLO` makes a tight loop. This infinite loop could happen when
`snap_usedef()` called during trace recording (more precisely, on the
creation of the snapshot for the guarded trace check) processes UCLO
bytecode instruction, and this instruction attempts a jump back with a
negative offset value. The patch fixes the problem by checking a number
of slots in a jump argument and replacing this value by `maxslot` if a
value is negative, this means that no values will be purged from the
snapshot.

Sergey Bronnikov:
* added the description and the test for the problem

Part of tarantool/tarantool#10709

Reviewed-by: Sergey Kaplun <skaplun@tarantool.org>
Signed-off-by: Sergey Kaplun <skaplun@tarantool.org>

5692 of 6031 branches covered (94.38%)

Branch coverage included in aggregate %.

21695 of 23432 relevant lines covered (92.59%)

2948761.45 hits per line