15 files changed, 93 insertions, 34 deletions

diff --git a/lapi.c b/lapi.c
index 04e09cff..588ab333 100644
--- a/lapi.c
+++ b/lapi.c
@@ -1089,6 +1089,7 @@ LUA_API int lua_load (lua_State *L, lua_Reader reader, void *data,
   ZIO z;
   int status;
   lua_lock(L);
+  luaC_checkGC(L);
   if (!chunkname) chunkname = "?";
   luaZ_init(L, &z, reader, data);
   status = luaD_protectedparser(L, &z, chunkname, mode);
diff --git a/lauxlib.c b/lauxlib.c
index 923105ed..f9a45384 100644
--- a/lauxlib.c
+++ b/lauxlib.c
@@ -501,12 +501,25 @@ static const luaL_Reg boxmt[] = {  /* box metamethods */
 };
 
 
+/*
+** Get/create metatable (MT) for boxes
+*/
+static void getBoxMT (lua_State *L) {
+  const char *BOXMT = "_UBOX*"; /* key for the metatable */
+  if (luaL_getmetatable(L, BOXMT) == LUA_TNIL) {  /* MT not created yet? */
+    luaL_newlibtable(L, boxmt);  /* create it */
+    luaL_setfuncs(L, boxmt, 0);  /* initialize it */
+    lua_copy(L, -1, -2);  /* change stack from nil,MT to MT,MT */
+    lua_setfield(L, LUA_REGISTRYINDEX, BOXMT);  /* store MT in the registry */
+  }
+}
+
+
 static void newbox (lua_State *L) {
   UBox *box = (UBox *)lua_newuserdatauv(L, sizeof(UBox), 0);
   box->box = NULL;
   box->bsize = 0;
-  if (luaL_newmetatable(L, "_UBOX*"))  /* creating metatable? */
-    luaL_setfuncs(L, boxmt, 0);  /* set its metamethods */
+  getBoxMT(L);
   lua_setmetatable(L, -2);
 }
 
diff --git a/ldo.c b/ldo.c
index c92573d6..8085b735 100644
--- a/ldo.c
+++ b/ldo.c
@@ -206,6 +206,25 @@ l_noret luaD_errerr (lua_State *L) {
 
 
 /*
+** Check whether stacks have enough space to run a simple function (such
+** as a finalizer): At least BASIC_STACK_SIZE in the Lua stack, two
+** available CallInfos, and two "slots" in the C stack.
+*/
+int luaD_checkminstack (lua_State *L) {
+  if (getCcalls(L) >= LUAI_MAXCCALLS - 2)
+    return 0;  /* not enough C-stack slots */
+  if (L->ci->next == NULL && luaE_extendCI(L, 0) == NULL)
+    return 0;  /* unable to allocate first ci */
+  if (L->ci->next->next == NULL && luaE_extendCI(L, 0) == NULL)
+    return 0;  /* unable to allocate second ci */
+  if (L->stack_last.p - L->top.p >= BASIC_STACK_SIZE)
+    return 1;  /* enough (BASIC_STACK_SIZE) free slots in the Lua stack */
+  else  /* try to grow stack to a size with enough free slots */
+    return luaD_growstack(L, BASIC_STACK_SIZE, 0);
+}
+
+
+/*
 ** Reallocate the stack to a new size, correcting all pointers into it.
 ** In ISO C, any pointer use after the pointer has been deallocated is
 ** undefined behavior. So, before the reallocation, all pointers are
@@ -503,7 +522,7 @@ void luaD_poscall (lua_State *L, CallInfo *ci, int nres) {
 
 
 
-#define next_ci(L)  (L->ci->next ? L->ci->next : luaE_extendCI(L))
+#define next_ci(L)  (L->ci->next ? L->ci->next : luaE_extendCI(L, 1))
 
 
 l_sinline CallInfo *prepCallInfo (lua_State *L, StkId func, int nret,
diff --git a/ldo.h b/ldo.h
index 4de9540e..4c8db865 100644
--- a/ldo.h
+++ b/ldo.h
@@ -80,6 +80,7 @@ LUAI_FUNC int luaD_reallocstack (lua_State *L, int newsize, int raiseerror);
 LUAI_FUNC int luaD_growstack (lua_State *L, int n, int raiseerror);
 LUAI_FUNC void luaD_shrinkstack (lua_State *L);
 LUAI_FUNC void luaD_inctop (lua_State *L);
+LUAI_FUNC int luaD_checkminstack (lua_State *L);
 
 LUAI_FUNC l_noret luaD_throw (lua_State *L, int errcode);
 LUAI_FUNC int luaD_rawrunprotected (lua_State *L, Pfunc f, void *ud);
diff --git a/lgc.c b/lgc.c
index c01660ab..52cea240 100644
--- a/lgc.c
+++ b/lgc.c
@@ -1242,7 +1242,7 @@ static void finishgencycle (lua_State *L, global_State *g) {
   correctgraylists(g);
   checkSizes(L, g);
   g->gcstate = GCSpropagate;  /* skip restart */
-  if (!g->gcemergency)
+  if (g->tobefnz != NULL && !g->gcemergency && luaD_checkminstack(L))
     callallpendingfinalizers(L);
 }
 
@@ -1632,11 +1632,12 @@ static lu_mem singlestep (lua_State *L) {
       break;
     }
     case GCScallfin: {  /* call remaining finalizers */
-      if (g->tobefnz && !g->gcemergency) {
+      if (g->tobefnz && !g->gcemergency && luaD_checkminstack(L)) {
         g->gcstopem = 0;  /* ok collections during finalizers */
         work = runafewfinalizers(L, GCFINMAX) * GCFINALIZECOST;
       }
-      else {  /* emergency mode or no more finalizers */
+      else {  /* no more finalizers or emergency mode or no enough stack
+                 to run finalizers */
         g->gcstate = GCSpause;  /* finish collection */
         work = 0;
       }
diff --git a/lparser.c b/lparser.c
index 1ac82990..f4bfc963 100644
--- a/lparser.c
+++ b/lparser.c
@@ -940,6 +940,8 @@ static void constructor (LexState *ls, expdesc *t) {
     if (ls->t.token == '}') break;
     closelistfield(fs, &cc);
     field(ls, &cc);
+    checklimit(fs, cc.tostore + cc.na + cc.nh, INT_MAX/2,
+               "items in a constructor");
   } while (testnext(ls, ',') || testnext(ls, ';'));
   check_match(ls, '}', '{', line);
   lastlistfield(fs, &cc);
diff --git a/lstate.c b/lstate.c
index f3f2ccfd..059be806 100644
--- a/lstate.c
+++ b/lstate.c
@@ -102,14 +102,19 @@ LUA_API int lua_setcstacklimit (lua_State *L, unsigned int limit) {
 }
 
 
-CallInfo *luaE_extendCI (lua_State *L) {
+CallInfo *luaE_extendCI (lua_State *L, int err) {
   CallInfo *ci;
-  lua_assert(L->ci->next == NULL);
-  ci = luaM_new(L, CallInfo);
-  lua_assert(L->ci->next == NULL);
-  L->ci->next = ci;
+  ci = luaM_reallocvector(L, NULL, 0, 1, CallInfo);
+  if (l_unlikely(ci == NULL)) {  /* allocation failed? */
+    if (err)
+      luaM_error(L);  /* raise the error */
+    return NULL;  /* else only report it */
+  }
+  ci->next = L->ci->next;
   ci->previous = L->ci;
-  ci->next = NULL;
+  L->ci->next = ci;
+  if (ci->next)
+    ci->next->previous = ci;
   ci->u.l.trap = 0;
   L->nci++;
   return ci;
diff --git a/lstate.h b/lstate.h
index 007704c8..97bb3e8f 100644
--- a/lstate.h
+++ b/lstate.h
@@ -395,7 +395,7 @@ union GCUnion {
 
 LUAI_FUNC void luaE_setdebt (global_State *g, l_mem debt);
 LUAI_FUNC void luaE_freethread (lua_State *L, lua_State *L1);
-LUAI_FUNC CallInfo *luaE_extendCI (lua_State *L);
+LUAI_FUNC CallInfo *luaE_extendCI (lua_State *L, int err);
 LUAI_FUNC void luaE_shrinkCI (lua_State *L);
 LUAI_FUNC void luaE_checkcstack (lua_State *L);
 LUAI_FUNC void luaE_incCstack (lua_State *L);
diff --git a/lstrlib.c b/lstrlib.c
index 03167161..f748bf88 100644
--- a/lstrlib.c
+++ b/lstrlib.c
@@ -757,7 +757,6 @@ static int nospecials (const char *p, size_t l) {
 static void prepstate (MatchState *ms, lua_State *L,
                        const char *s, size_t ls, const char *p, size_t lp) {
   ms->L = L;
-  ms->matchdepth = MAXCCALLS;
   ms->src_init = s;
   ms->src_end = s + ls;
   ms->p_end = p + lp;
@@ -765,8 +764,8 @@ static void prepstate (MatchState *ms, lua_State *L,
 
 
 static void reprepstate (MatchState *ms) {
+  ms->matchdepth = MAXCCALLS;
   ms->level = 0;
-  lua_assert(ms->matchdepth == MAXCCALLS);
 }
 
 
diff --git a/lua.h b/lua.h
index f3ea590d..211b97cf 100644
--- a/lua.h
+++ b/lua.h
@@ -18,14 +18,14 @@
 
 #define LUA_VERSION_MAJOR       "5"
 #define LUA_VERSION_MINOR       "4"
-#define LUA_VERSION_RELEASE     "8"
+#define LUA_VERSION_RELEASE     "9"
 
 #define LUA_VERSION_NUM                 504
-#define LUA_VERSION_RELEASE_NUM         (LUA_VERSION_NUM * 100 + 8)
+#define LUA_VERSION_RELEASE_NUM         (LUA_VERSION_NUM * 100 + 9)
 
 #define LUA_VERSION     "Lua " LUA_VERSION_MAJOR "." LUA_VERSION_MINOR
 #define LUA_RELEASE     LUA_VERSION "." LUA_VERSION_RELEASE
-#define LUA_COPYRIGHT   LUA_RELEASE "  Copyright (C) 1994-2025 Lua.org, PUC-Rio"
+#define LUA_COPYRIGHT   LUA_RELEASE "  Copyright (C) 1994-2026 Lua.org, PUC-Rio"
 #define LUA_AUTHORS     "R. Ierusalimschy, L. H. de Figueiredo, W. Celes"
 
 
@@ -497,7 +497,7 @@ struct lua_Debug {
 
 
 /******************************************************************************
-* Copyright (C) 1994-2025 Lua.org, PUC-Rio.
+* Copyright (C) 1994-2026 Lua.org, PUC-Rio.
 *
 * Permission is hereby granted, free of charge, to any person obtaining
 * a copy of this software and associated documentation files (the
diff --git a/lutf8lib.c b/lutf8lib.c
index 3a5b9bc3..e41a8255 100644
--- a/lutf8lib.c
+++ b/lutf8lib.c
@@ -65,6 +65,8 @@ static const char *utf8_decode (const char *s, utfint *val, int strict) {
   utfint res = 0;  /* final result */
   if (c < 0x80)  /* ascii? */
     res = c;
+  else if (c >= 0xfe)  /* c >= 1111 1110b ? */
+    return NULL;  /* would need six or more continuation bytes */
   else {
     int count = 0;  /* to count number of continuation bytes */
     for (; c & 0x40; c <<= 1) {  /* while it needs continuation bytes... */
@@ -74,7 +76,7 @@ static const char *utf8_decode (const char *s, utfint *val, int strict) {
       res = (res << 6) | (cc & 0x3F);  /* add lower 6 bits from cont. byte */
     }
     res |= ((utfint)(c & 0x7F) << (count * 5));  /* add first byte */
-    if (count > 5 || res > MAXUTF || res < limits[count])
+    if (res > MAXUTF || res < limits[count])
       return NULL;  /* invalid byte sequence */
     s += count;  /* skip continuation bytes read */
   }
diff --git a/lvm.c b/lvm.c
index 7023a04d..bbadf0a6 100644
--- a/lvm.c
+++ b/lvm.c
@@ -361,7 +361,12 @@ void luaV_finishset (lua_State *L, const TValue *t, TValue *key,
     }
     t = tm;  /* else repeat assignment over 'tm' */
     if (luaV_fastget(L, t, key, slot, luaH_get)) {
-      luaV_finishfastset(L, t, slot, val);
+      /* execute 'luaV_finishfastset', but preserving the original 't'
+         for the barrier. 't' and 'slot' can point to the same value,
+         and so the assignment can change 't' value */
+      GCObject *h = gcvalue(t);
+      setobj2t(L, cast(TValue *,slot), val);
+      luaC_barrierback(L, h, val);
       return;  /* done */
     }
     /* else 'return luaV_finishset(L, t, key, val, slot)' (loop) */
diff --git a/manual/2html b/manual/2html
index 1588c1e6..f7952bd6 100755
--- a/manual/2html
+++ b/manual/2html
@@ -30,7 +30,7 @@ by Roberto Ierusalimschy, Luiz Henrique de Figueiredo, Waldemar Celes
 <p>
 <small>
 <a href="http://www.lua.org/copyright.html">Copyright</a>
-&copy; 2025 Lua.org, PUC-Rio.  All rights reserved.
+&copy; 2026 Lua.org, PUC-Rio.  All rights reserved.
 </small>
 <hr>
 
@@ -58,7 +58,7 @@ end
 
 local function compose (f,g)
   assert(f and g)
-  return function (s) return g(f(s)) end
+  return function (...) return g(f(...)) end
 end
 
 local function concat (f, g)
@@ -395,9 +395,10 @@ APIEntry = function (e)
   local apiicmd, ne = string.match(e, "^(.-</span>)(.*)")
 --io.stderr:write(e)
   if not apiicmd then
-    return antipara(Tag.hr() .. Tag.h3(a)) .. Tag.pre(h) .. e
+    return antipara(Tag.hr() .. Tag.h3(a)) .. Tag.pre(h, {class="api"}) .. e
   else
-    return antipara(Tag.hr() .. Tag.h3(a)) .. apiicmd .. Tag.pre(h) .. ne
+    return antipara(Tag.hr() .. Tag.h3(a)) .. apiicmd ..
+                    Tag.pre(h, {class="api"}) .. ne
   end
 end,
 
diff --git a/manual/manual.of b/manual/manual.of
index da71fbe9..e565ea7e 100644
--- a/manual/manual.of
+++ b/manual/manual.of
@@ -107,7 +107,7 @@ for small machines and embedded systems.
 
 Unless stated otherwise,
 any overflow when manipulating integer values @def{wrap around},
-according to the usual rules of two-complement arithmetic.
+according to the usual rules of two's complement arithmetic.
 (In other words,
 the actual result is the unique representable integer
 that is equal modulo @M{2@sp{n}} to the mathematical result,
@@ -609,7 +609,7 @@ as soon as the collector can be sure the object
 will not be accessed again in the normal execution of the program.
 (@Q{Normal execution} here excludes finalizers,
 which can resurrect dead objects @see{finalizers},
-and excludes also operations using the debug library.)
+and it excludes also operations using the debug library.)
 Note that the time when the collector can be sure that an object
 is dead may not coincide with the programmer's expectations.
 The only guarantees are that Lua will not collect an object
@@ -1950,12 +1950,12 @@ Note that keys that are not positive integers
 do not interfere with borders.
 
 A table with exactly one border is called a @def{sequence}.
-For instance, the table @T{{10, 20, 30, 40, 50}} is a sequence,
+For instance, the table @T{{10,20,30,40,50}} is a sequence,
 as it has only one border (5).
-The table @T{{10, 20, 30, nil, 50}} has two borders (3 and 5),
+The table @T{{10,20,30,nil,50}} has two borders (3 and 5),
 and therefore it is not a sequence.
 (The @nil at index 4 is called a @emphx{hole}.)
-The table @T{{nil, 20, 30, nil, nil, 60, nil}}
+The table @T{{nil,20,30,nil,nil,60,nil}}
 has three borders (0, 3, and 6),
 so it is not a sequence, too.
 The table @T{{}} is a sequence with border 0.
@@ -2318,7 +2318,7 @@ we recommend assigning the vararg expression
 to a single variable and using that variable
 in its place.
 
-Here are some examples of uses of mutlres expressions.
+Here are some examples of uses of multires expressions.
 In all cases, when the construction needs
 @Q{the n-th result} and there is no such result,
 it uses a @nil.
@@ -3471,9 +3471,9 @@ because a pseudo-index is not an actual stack position.
 The type of integers in Lua.
 
 By default this type is @id{long long},
-(usually a 64-bit two-complement integer),
+(usually a 64-bit two's complement integer),
 but that can be changed to @id{long} or @id{int}
-(usually a 32-bit two-complement integer).
+(usually a 32-bit two's complement integer).
 (See @id{LUA_INT_TYPE} in @id{luaconf.h}.)
 
 Lua also defines the constants
@@ -3689,7 +3689,7 @@ passes to the allocator in every call.
 @apii{0,1,m}
 
 Creates a new empty table and pushes it onto the stack.
-It is equivalent to @T{lua_createtable(L, 0, 0)}.
+It is equivalent to @T{lua_createtable(L,0,0)}.
 
 }
 
diff --git a/testes/events.lua b/testes/events.lua
index def13dc8..d0a48c66 100644
--- a/testes/events.lua
+++ b/testes/events.lua
@@ -382,6 +382,16 @@ do
 end
 
 
+do   -- bug in 5.4
+  local parent = {}
+  parent.__newindex = parent
+  collectgarbage()
+  local child = setmetatable({}, parent)
+  child.__newindex = {x = "hello"}
+  collectgarbage("step")
+  assert(parent.__newindex.x == "hello")
+end
+
 
 -- concat metamethod x numbers (bug in 5.1.1)
 c = {}