[BUG] SUMMARY: AddressSanitizer: SEGV /home/lua-5.4.7/src/lgc.c:310 in reallymarkobject

[Jizhou Chen]

Hi there,

Here is another bug report.

Version: 5.4.7 (ASAN enabled)

Testcase (fuzzer-generated):

do
 
  local a = collectgarbage("setpause", 200)
  local b = collectgarbage("generational", 1)
  local t = {pcall(pcall,pcall,pcall,pcall,assert,pcall,pcall,error,"hi")}
  for i=1,20 do
    local p = t[i]
    for n = 1, 10 do
  local r = debug.getregistry()
  local tt = {}
  tt.__gc = function (x)
      assert(debug.setlocal(2, #t, x) == "(vararg)")
      assert(thread_id < 1000)
     end
  local a,b = setmetatable({}, tt)
  ___Glob = {u}
end
  end
 
  collectgarbage("generational", a)
  debug.getuservalue(b, -2)
  collectgarbage()
end


_G["while"] = 234

Stack dump:

AddressSanitizer:DEADLYSIGNAL

=================================================================

==984094==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000008 (pc 0x55d5119984ab bp 0x61b000000150 sp 0x7ffe80f630e0 T0)

==984094==The signal is caused by a READ memory access.

==984094==Hint: address points to the zero page.

    #0 0x55d5119984aa in reallymarkobject /home/lua-5.4.7/src/lgc.c:310

    #1 0x55d51199c278 in traversethread /home/lua-5.4.7/src/lgc.c:639

    #2 0x55d51199c278 in propagatemark /home/lua-5.4.7/src/lgc.c:670

    #3 0x55d51199c4a0 in propagateall /home/lua-5.4.7/src/lgc.c:679

    #4 0x55d51199c996 in atomic /home/lua-5.4.7/src/lgc.c:1543

    #5 0x55d51199e359 in youngcollection /home/lua-5.4.7/src/lgc.c:1261

    #6 0x55d51199e359 in genstep /home/lua-5.4.7/src/lgc.c:1461

    #7 0x55d51199e359 in luaC_step /home/lua-5.4.7/src/lgc.c:1696

    #8 0x55d5119bba75 in luaV_execute /home/lua-5.4.7/src/lvm.c:1377

    #9 0x55d511994995 in ccall /home/lua-5.4.7/src/ldo.c:637

    #10 0x55d511994995 in luaD_callnoyield /home/lua-5.4.7/src/ldo.c:655

    #11 0x55d51198552e in f_call /home/lua-5.4.7/src/lapi.c:1038

    #12 0x55d511991205 in luaD_rawrunprotected /home/lua-5.4.7/src/ldo.c:144

    #13 0x55d5119954fd in luaD_pcall /home/lua-5.4.7/src/ldo.c:957

    #14 0x55d51198a28a in lua_pcallk /home/lua-5.4.7/src/lapi.c:1064

    #15 0x55d51198348e in docall /home/lua-5.4.7/src/lua.c:161

    #16 0x55d511984920 in handle_script /home/lua-5.4.7/src/lua.c:265

    #17 0x55d511984920 in pmain /home/lua-5.4.7/src/lua.c:654

    #18 0x55d511993ff5 in precallC /home/lua-5.4.7/src/ldo.c:529

    #19 0x55d511993ff5 in luaD_precall /home/lua-5.4.7/src/ldo.c:595

    #20 0x55d511994958 in ccall /home/lua-5.4.7/src/ldo.c:635

    #21 0x55d511994958 in luaD_callnoyield /home/lua-5.4.7/src/ldo.c:655

    #22 0x55d51198552e in f_call /home/lua-5.4.7/src/lapi.c:1038

    #23 0x55d511991205 in luaD_rawrunprotected /home/lua-5.4.7/src/ldo.c:144

    #24 0x55d5119954fd in luaD_pcall /home/lua-5.4.7/src/ldo.c:957

    #25 0x55d51198a28a in lua_pcallk /home/lua-5.4.7/src/lapi.c:1064

    #26 0x55d511984a70 in main /home/lua-5.4.7/src/lua.c:682

    #27 0x7fd9fe98e082 in __libc_start_main ../csu/libc-start.c:308

    #28 0x55d511982fcd in _start (/usr/local/bin/lua+0x17fcd)

AddressSanitizer can not provide additional info.

SUMMARY: AddressSanitizer: SEGV /home/lua-5.4.7/src/lgc.c:310 in reallymarkobject

==984094==ABORTING