aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorMike Pall <mike>2024-01-23 18:58:52 +0100
committerMike Pall <mike>2024-01-23 18:58:52 +0100
commit85b4fed0b0353dd78c8c875c2f562d522a2b310f (patch)
treec61dd687a8de78868d0ffe911c9bc80d9b74e57a
parent658530562c2ac7ffa8e4ca5d18856857471244e9 (diff)
downloadluajit-85b4fed0b0353dd78c8c875c2f562d522a2b310f.tar.gz
luajit-85b4fed0b0353dd78c8c875c2f562d522a2b310f.tar.bz2
luajit-85b4fed0b0353dd78c8c875c2f562d522a2b310f.zip
Fix unsinking of IR_FSTORE for NULL metatable.
Reported by pwnhacker0x18. #1147
-rw-r--r--src/lj_snap.c11
1 files changed, 8 insertions, 3 deletions
diff --git a/src/lj_snap.c b/src/lj_snap.c
index b387dd76..4a773048 100644
--- a/src/lj_snap.c
+++ b/src/lj_snap.c
@@ -412,6 +412,7 @@ static TRef snap_replay_const(jit_State *J, IRIns *ir)
412 case IR_KNUM: return lj_ir_k64(J, IR_KNUM, ir_knum(ir)); 412 case IR_KNUM: return lj_ir_k64(J, IR_KNUM, ir_knum(ir));
413 case IR_KINT64: return lj_ir_k64(J, IR_KINT64, ir_kint64(ir)); 413 case IR_KINT64: return lj_ir_k64(J, IR_KINT64, ir_kint64(ir));
414 case IR_KPTR: return lj_ir_kptr(J, ir_kptr(ir)); /* Continuation. */ 414 case IR_KPTR: return lj_ir_kptr(J, ir_kptr(ir)); /* Continuation. */
415 case IR_KNULL: return lj_ir_knull(J, irt_type(ir->t));
415 default: lua_assert(0); return TREF_NIL; break; 416 default: lua_assert(0); return TREF_NIL; break;
416 } 417 }
417} 418}
@@ -821,9 +822,13 @@ static void snap_unsink(jit_State *J, GCtrace *T, ExitState *ex,
821 if (irk->o == IR_FREF) { 822 if (irk->o == IR_FREF) {
822 switch (irk->op2) { 823 switch (irk->op2) {
823 case IRFL_TAB_META: 824 case IRFL_TAB_META:
824 snap_restoreval(J, T, ex, snapno, rfilt, irs->op2, &tmp); 825 if (T->ir[irs->op2].o == IR_KNULL) {
825 /* NOBARRIER: The table is new (marked white). */ 826 setgcrefnull(t->metatable);
826 setgcref(t->metatable, obj2gco(tabV(&tmp))); 827 } else {
828 snap_restoreval(J, T, ex, snapno, rfilt, irs->op2, &tmp);
829 /* NOBARRIER: The table is new (marked white). */
830 setgcref(t->metatable, obj2gco(tabV(&tmp)));
831 }
827 break; 832 break;
828 case IRFL_TAB_NOMM: 833 case IRFL_TAB_NOMM:
829 /* Negative metamethod cache invalidated by lj_tab_set() below. */ 834 /* Negative metamethod cache invalidated by lj_tab_set() below. */