An assertion is triggered in luaK_storevar

[Sergey Bronnikov]

Hello,

an assertion is triggered on execution of a Lua chunk below:

lua -e "function a(...|_ENV) global b = c end"

Reproduced on the latest version of Lua (fca974486d12aa29bb6d731fdb5b25055157ece8)
that built with enabled macro -DLUAI_ASSERT. The behaviour is introduced by the following commit:

commit 25c54fe60e22d05cdfaa48c64372d354efa59547 (HEAD)
Author: Roberto I <rob...@inf.puc-rio.br>
Date:   Wed Sep 24 18:33:08 2025 -0300

    Optimization for vararg tables
   
    A vararg table can be virtual. If the vararg table is used only as
    a base in indexing expressions, the code does not need to create an
    actual table for it. Instead, it compiles the indexing expressions
    into direct accesses to the internal vararg data.
   
How to reproduce:

--- a/makefile
+++ b/makefile
@@ -71,7 +71,7 @@ LOCAL = $(TESTS) $(CWARNS)
 # To enable Linux goodies, -DLUA_USE_LINUX
 # For C89, "-std=c89 -DLUA_USE_C89"
 # Note that Linux/Posix options are not compatible with C89
-MYCFLAGS= $(LOCAL) -std=c99 -DLUA_USE_LINUX
+MYCFLAGS= $(LOCAL) -std=c99 -DLUA_USE_LINUX -DLUAI_ASSERT
 MYLDFLAGS= $(LOCAL) -Wl,-E
 MYLIBS= -ldl
 
CFLAGS=-ggdb make -j
 
Full backtrace:

#0  __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>) at ./nptl/pthread_kill.c:44
#1  __pthread_kill_internal (signo=6, threadid=<optimized out>) at ./nptl/pthread_kill.c:78
#2  __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=6) at ./nptl/pthread_kill.c:89
#3  0x00007ffff744527e in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
#4  0x00007ffff74288ff in __GI_abort () at ./stdlib/abort.c:79
#5  0x00007ffff742881b in __assert_fail_base (fmt=0x7ffff75d01e8 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n",
    assertion=assertion@entry=0x555555630920 "0", file=file@entry=0x5555556306c0 "lcode.c", line=line@entry=1116,
    function=function@entry=0x555555632840 <__PRETTY_FUNCTION__.22> "luaK_storevar") at ./assert/assert.c:96
#6  0x00007ffff743b517 in __assert_fail (assertion=assertion@entry=0x555555630920 "0",
    file=file@entry=0x5555556306c0 "lcode.c", line=line@entry=1116,
    function=function@entry=0x555555632840 <__PRETTY_FUNCTION__.22> "luaK_storevar") at ./assert/assert.c:105
#7  0x00005555555f73cd in luaK_storevar (fs=fs@entry=0x7ffff5503a70, var=var@entry=0x7ffff5600c60,
    ex=ex@entry=0x7ffff5600ca0) at lcode.c:1116
#8  0x00005555555bff42 in storevartop (var=0x7ffff5600c60, fs=0x7ffff5503a70) at lparser.c:1489
#9  globalnames (defkind=<optimized out>, ls=0x7ffff5600ae0) at lparser.c:1897
#10 globalstat (ls=0x7ffff5600ae0) at lparser.c:1911
#11 globalstatfunc (ls=0x7ffff5600ae0, line=<optimized out>) at lparser.c:1940
#12 0x00005555555b97e2 in statement (ls=ls@entry=0x7ffff5600ae0) at lparser.c:2095
#13 0x00005555555bbb84 in statlist (ls=0x7ffff5600ae0) at lparser.c:882
#14 body (ls=ls@entry=0x7ffff5600ae0, e=e@entry=0x7ffff5801300, ismethod=ismethod@entry=0, line=line@entry=1)
    at lparser.c:1119
#15 0x00005555555b84fb in funcstat (line=1, ls=0x7ffff5600ae0) at lparser.c:1965
#16 statement (ls=ls@entry=0x7ffff5600ae0) at lparser.c:2052
#17 0x00005555555c0ded in statlist (ls=0x7ffff5600ae0) at lparser.c:882
#18 mainfunc (fs=0x7ffff5600a70, ls=0x7ffff5600ae0) at lparser.c:2134
#19 luaY_parser (L=L@entry=0x51b000000608, z=<optimized out>, buff=buff@entry=0x7ffff5503528,
    dyd=dyd@entry=0x7ffff5503540, name=<optimized out>, firstchar=firstchar@entry=102) at lparser.c:2158
#20 0x0000555555597e14 in f_parser (L=L@entry=0x51b000000608, ud=ud@entry=0x7ffff5503520) at ldo.c:1127
#21 0x000055555559810a in luaD_rawrunprotected (L=L@entry=0x51b000000608, f=<optimized out>, ud=<optimized out>)
    at ldo.c:166
#22 0x000055555559db07 in luaD_pcall (L=L@entry=0x51b000000608, func=func@entry=0x555555597c10 <f_parser>,
    u=<optimized out>, old_top=<optimized out>, ef=<optimized out>) at ldo.c:1077
#23 0x000055555559e0b8 in luaD_protectedparser (L=L@entry=0x51b000000608, z=z@entry=0x7ffff5503450,
    name=name@entry=0x555555618bc0 "=(command line)", mode=mode@entry=0x0) at ldo.c:1144
#24 0x000055555558df70 in lua_load (L=L@entry=0x51b000000608, reader=reader@entry=0x5555555eb080 <getS>,
    data=data@entry=0x7ffff5314b20, chunkname=0x555555618bc0 "=(command line)", mode=<optimized out>) at lapi.c:1127
#25 0x00005555555edd20 in luaL_loadbufferx (L=L@entry=0x51b000000608,
    buff=buff@entry=0x7fffffffd848 "function a(...|_ENV) global b=c", size=31,
    name=name@entry=0x555555618bc0 "=(command line)", mode=mode@entry=0x0) at lauxlib.c:872
#26 0x0000555555582c29 in dostring (L=L@entry=0x51b000000608, s=0x7fffffffd848 "function a(...|_ENV) global b=c",
    name=name@entry=0x555555618bc0 "=(command line)") at lua.c:209
#27 0x00005555555835cf in runargs (n=<optimized out>, argv=<optimized out>, L=<optimized out>) at lua.c:362
#28 pmain (L=0x51b000000608) at lua.c:728
#29 0x000055555559bf52 in precallC (f=<optimized out>, status=<optimized out>, func=0x517000000090, L=0x51b000000608)
    at ldo.c:644
#30 luaD_precall (L=L@entry=0x51b000000608, func=0x517000000090, nresults=nresults@entry=1) at ldo.c:713
#31 0x000055555559cb7f in ccall (inc=65537, nResults=1, func=<optimized out>, L=0x51b000000608) at ldo.c:753
#32 luaD_callnoyield (L=0x51b000000608, func=<optimized out>, nResults=1) at ldo.c:773
#33 0x000055555559810a in luaD_rawrunprotected (L=L@entry=0x51b000000608, f=<optimized out>, ud=<optimized out>)
    at ldo.c:166
#34 0x000055555559db07 in luaD_pcall (L=L@entry=0x51b000000608, func=func@entry=0x5555555851a0 <f_call>,
    u=<optimized out>, old_top=<optimized out>, ef=<optimized out>) at ldo.c:1077
#35 0x000055555558dbd7 in lua_pcallk (L=L@entry=0x51b000000608, nargs=nargs@entry=2, nresults=nresults@entry=1,
    errfunc=errfunc@entry=0, ctx=ctx@entry=0, k=k@entry=0x0) at lapi.c:1097
#36 0x00005555555813ab in main (argc=3, argv=0x7fffffffd2b8) at lua.c:759

Sergey

[Roberto Ierusalimschy]

> an assertion is triggered on execution of a Lua chunk below:
>
> lua -e "function a(...|_ENV) global b = c end"

Many thanks for the feedback.

-- Roberto