Handle partial snapshot restore due to stack overflow.

Reported by pwnhacker0x18. Fixed by Peter Cawley. #1196

1 files changed, 3 insertions, 1 deletions

diff --git a/src/lj_trace.c b/src/lj_trace.c
index d015f2ab..8385f3d1 100644
--- a/src/lj_trace.c
+++ b/src/lj_trace.c
@@ -788,8 +788,10 @@ int LJ_FASTCALL lj_trace_exit(jit_State *J, void *exptr)
   exd.J = J;
   exd.exptr = exptr;
   errcode = lj_vm_cpcall(L, NULL, &exd, trace_exit_cp);
-  if (errcode)
+  if (errcode) {
+    setcframe_pc(cframe_raw(L->cframe), L);  /* Point to any valid memory. */
     return -errcode;  /* Return negated error code. */
+  }
 
   lj_vmevent_send(L, TEXIT,
     lj_state_checkstack(L, 4+RID_NUM_GPR+RID_NUM_FPR+LUA_MINSTACK);