Bug: Issues with write barrier for __newindex

In 'luaV_finishset', there is an update on a table that is a field on
another table. If the first table is the same as the one with the field
(e.g., after 't.__newindex = t'), the update can change the value on
that field (e.g., there may be a collision and the field is moved, or
the field being updated is '__newindex' itself). After that, the
barrier is called with the table stored in that field, which is not
the correct table anymore.

1 files changed, 12 insertions, 0 deletions

diff --git a/testes/events.lua b/testes/events.lua
index 7e434b1f..fa9966ab 100644
--- a/testes/events.lua
+++ b/testes/events.lua
@@ -390,6 +390,18 @@ do
   for i=1, 10 do t[i] = 1 end
 end
 
+
+do   -- bug since 5.4
+  local parent = {}
+  parent.__newindex = parent
+  collectgarbage()
+  local child = setmetatable({}, parent)
+  child.__newindex = {x = "hello"}
+  collectgarbage("step")
+  assert(parent.__newindex.x == "hello")
+end
+
+
 -- concat metamethod x numbers (bug in 5.1.1)
 c = {}
 local x