diff options
author | Mike Pall <mike> | 2024-01-23 18:58:52 +0100 |
---|---|---|
committer | Mike Pall <mike> | 2024-01-23 18:58:52 +0100 |
commit | 85b4fed0b0353dd78c8c875c2f562d522a2b310f (patch) | |
tree | c61dd687a8de78868d0ffe911c9bc80d9b74e57a | |
parent | 658530562c2ac7ffa8e4ca5d18856857471244e9 (diff) | |
download | luajit-85b4fed0b0353dd78c8c875c2f562d522a2b310f.tar.gz luajit-85b4fed0b0353dd78c8c875c2f562d522a2b310f.tar.bz2 luajit-85b4fed0b0353dd78c8c875c2f562d522a2b310f.zip |
Fix unsinking of IR_FSTORE for NULL metatable.
Reported by pwnhacker0x18. #1147
-rw-r--r-- | src/lj_snap.c | 11 |
1 files changed, 8 insertions, 3 deletions
diff --git a/src/lj_snap.c b/src/lj_snap.c index b387dd76..4a773048 100644 --- a/src/lj_snap.c +++ b/src/lj_snap.c | |||
@@ -412,6 +412,7 @@ static TRef snap_replay_const(jit_State *J, IRIns *ir) | |||
412 | case IR_KNUM: return lj_ir_k64(J, IR_KNUM, ir_knum(ir)); | 412 | case IR_KNUM: return lj_ir_k64(J, IR_KNUM, ir_knum(ir)); |
413 | case IR_KINT64: return lj_ir_k64(J, IR_KINT64, ir_kint64(ir)); | 413 | case IR_KINT64: return lj_ir_k64(J, IR_KINT64, ir_kint64(ir)); |
414 | case IR_KPTR: return lj_ir_kptr(J, ir_kptr(ir)); /* Continuation. */ | 414 | case IR_KPTR: return lj_ir_kptr(J, ir_kptr(ir)); /* Continuation. */ |
415 | case IR_KNULL: return lj_ir_knull(J, irt_type(ir->t)); | ||
415 | default: lua_assert(0); return TREF_NIL; break; | 416 | default: lua_assert(0); return TREF_NIL; break; |
416 | } | 417 | } |
417 | } | 418 | } |
@@ -821,9 +822,13 @@ static void snap_unsink(jit_State *J, GCtrace *T, ExitState *ex, | |||
821 | if (irk->o == IR_FREF) { | 822 | if (irk->o == IR_FREF) { |
822 | switch (irk->op2) { | 823 | switch (irk->op2) { |
823 | case IRFL_TAB_META: | 824 | case IRFL_TAB_META: |
824 | snap_restoreval(J, T, ex, snapno, rfilt, irs->op2, &tmp); | 825 | if (T->ir[irs->op2].o == IR_KNULL) { |
825 | /* NOBARRIER: The table is new (marked white). */ | 826 | setgcrefnull(t->metatable); |
826 | setgcref(t->metatable, obj2gco(tabV(&tmp))); | 827 | } else { |
828 | snap_restoreval(J, T, ex, snapno, rfilt, irs->op2, &tmp); | ||
829 | /* NOBARRIER: The table is new (marked white). */ | ||
830 | setgcref(t->metatable, obj2gco(tabV(&tmp))); | ||
831 | } | ||
827 | break; | 832 | break; |
828 | case IRFL_TAB_NOMM: | 833 | case IRFL_TAB_NOMM: |
829 | /* Negative metamethod cache invalidated by lj_tab_set() below. */ | 834 | /* Negative metamethod cache invalidated by lj_tab_set() below. */ |