tarantool / luajit / 12890351680 / 1

70%

tarantool/master: 93%

push

github

Prevent loop in snap_usedef().

Reported by XmiliaH.

(cherry picked from commit 0e66fc963)

It is possible to get an infinite loop in a function `snap_usedef` when
a `UCLO` makes a tight loop. This infinite loop could happen when
`snap_usedef()` called during trace recording (more precisely, on the
creation of the snapshot for the guarded trace check) processes UCLO
bytecode instruction, and this instruction attempts a jump back with a
negative offset value. The patch fixes the problem by checking a number
of slots in a jump argument and replacing this value by `maxslot` if a
value is negative, this means that no values will be purged from the
snapshot.

Sergey Bronnikov:
* added the description and the test for the problem

Part of tarantool/tarantool#10709

Reviewed-by: Sergey Kaplun <skaplun@tarantool.org>
Signed-off-by: Sergey Kaplun <skaplun@tarantool.org>
(cherry picked from commit baa75545e)

5675 of 6012 branches covered (94.39%)

Branch coverage included in aggregate %.

21606 of 23340 relevant lines covered (92.57%)

879042.95 hits per line