From b996f8fd1be7fb711cc6f754a31a1c87d2c2fd9b Mon Sep 17 00:00:00 2001 From: Roberto I Date: Sun, 12 Jul 2026 14:57:55 -0300 Subject: Bug: Issues with write barrier for __newindex In 'luaV_finishset', there is an update on a table that is a field on another table. If the first table is the same as the one with the field (e.g., after 't.__newindex = t'), the update can change the value on that field (e.g., there may be a collision and the field is moved, or the field being updated is '__newindex' itself). After that, the barrier is called with the table stored in that field, which is not the correct table anymore. --- testes/events.lua | 12 ++++++++++++ 1 file changed, 12 insertions(+) (limited to 'testes') diff --git a/testes/events.lua b/testes/events.lua index 7e434b1f..fa9966ab 100644 --- a/testes/events.lua +++ b/testes/events.lua @@ -390,6 +390,18 @@ do for i=1, 10 do t[i] = 1 end end + +do -- bug since 5.4 + local parent = {} + parent.__newindex = parent + collectgarbage() + local child = setmetatable({}, parent) + child.__newindex = {x = "hello"} + collectgarbage("step") + assert(parent.__newindex.x == "hello") +end + + -- concat metamethod x numbers (bug in 5.1.1) c = {} local x -- cgit v1.2.3-55-g6feb