tarantool / luajit / 12890351665

93%

tarantool/master: 93%

push

github

Prevent loop in snap_usedef().

Reported by XmiliaH.

(cherry picked from commit 0e66fc963)

It is possible to get an infinite loop in a function `snap_usedef` when
a `UCLO` makes a tight loop. This infinite loop could happen when
`snap_usedef()` called during trace recording (more precisely, on the
creation of the snapshot for the guarded trace check) processes UCLO
bytecode instruction, and this instruction attempts a jump back with a
negative offset value. The patch fixes the problem by checking a number
of slots in a jump argument and replacing this value by `maxslot` if a
value is negative, this means that no values will be purged from the
snapshot.

Sergey Bronnikov:
* added the description and the test for the problem

Part of tarantool/tarantool#10709

Reviewed-by: Sergey Kaplun <skaplun@tarantool.org>
Signed-off-by: Sergey Kaplun <skaplun@tarantool.org>
(cherry picked from commit baa75545e)

5695 of 6031 branches covered (94.43%)

Branch coverage included in aggregate %.

21701 of 23432 relevant lines covered (92.61%)

2948729.98 hits per line