tarantool / luajit / 8249042173 / 1

93%

tarantool/master: 93%

push

github

FFI: Treat cdata finalizer table as a GC root.

Thanks to Sergey Bronnikov.

(cherry picked from commit dda1ac273)

There is a table `CTState->finalizer` that contains cdata finalizers.
This table is created on initialization of the `ffi` module
by calling the functions `luaopen_ffi` and `ffi_finalizer`. In some
circumstances, this table could be collected by GC and then accessed by
the function `lj_gc_finalize_cdata`. This leads to a heap-use-after-free
problem. The patch fixes the problem.

Sergey Bronnikov:
* added the description and the tests for the problem

Part of tarantool/tarantool#9595

5661 of 6017 branches covered (94.08%)

Branch coverage included in aggregate %.

21600 of 23410 relevant lines covered (92.27%)

2815504.06 hits per line