lua55: test suite fails on i586

[Matěj Cepl]

Hello,

when packaging lua55 for openSUSE/Factory the test suite fails on
i586, when running strings.lua tests lua55 crashes:

(gdb) run strings.lua
Starting program: /home/abuild/rpmbuild/BUILD/lua55-5.5.0_beta1-build/BUILDROOT/usr/bin/lua5.5 strings.lua
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/libthread_db.so.1".
testing strings and string library

Program received signal SIGSEGV, Segmentation fault.
__GI_memcpy () at ../sysdeps/i386/i586/memcpy.S:107
107 L(1): rep; movsb
(gdb) t a a bt

Thread 1 (Thread 0xf7c54700 (LWP 615583) "lua5.5"):
#0 __GI_memcpy () at ../sysdeps/i386/i586/memcpy.S:107
#1 0xf7f9c22a in ?? () from /home/abuild/rpmbuild/BUILD/lua55-5.5.0_beta1-build/BUILDROOT/usr/lib/liblua5.5.so.5
#2 0x61616161 in ?? ()
[ this same frame repeats endlessly ]

Any thoughts on what’s going on? Or how to get more debugging information?

Best,

Matěj

--
http://matej.ceplovi.cz/blog/, @mc...@en.osm.town
GPG Finger: 3C76 A027 CA45 AD70 98B5 BC1D 7920 5802 880B C9D8

There are two ways of constructing a software design: One way is
to make it so simple that there are obviously no deficiencies,
and the other way is to make it so complicated that there are no
obvious deficiencies.
-- C. A. R. Hoare

[Sainan]

> how to get more debugging information?

Add -g to the compiler arguments so it generates debug symbols.

> [ this same frame repeats endlessly ]

Maybe a stack overflow? Try compiling with -O3.

-- Sainan

[Matěj Cepl]

Build once more this time with -O3 (see the complete build log with all details on https://mcepl.fedorapeople.org/tmp/_log-lua55-O3.txt):

abuild@mitmanek:~/rpmbuild/BUILD/lua55-5.5.0_beta1-build/lua-5.5.0-beta/testes> file /home/abuild/rpmbuild/BUILD/lua55-5.5.0_beta1-build/lua-5.5.0-beta/src/.libs/liblua5.5.so.5.5.0
/home/abuild/rpmbuild/BUILD/lua55-5.5.0_beta1-build/lua-5.5.0-beta/src/.libs/liblua5.5.so.5.5.0: ELF 32-bit LSB shared object, Intel i386, version 1 (SYSV), dynamically linked, BuildID[sha1]=afd2ad08a7ae9133d55912d079eb7bc27f1edadb, with debug_info, not stripped
abuild@mitmanek:~/rpmbuild/BUILD/lua55-5.5.0_beta1-build/lua-5.5.0-beta/testes> file /home/abuild/rpmbuild/BUILD/lua55-5.5.0_beta1-build/lua-5.5.0-beta/src/.libs/lua5.5
/home/abuild/rpmbuild/BUILD/lua55-5.5.0_beta1-build/lua-5.5.0-beta/src/.libs/lua5.5: ELF 32-bit LSB pie executable, Intel i386, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux.so.2, for GNU/Linux 4.3.0, BuildID[sha1]=41cbe7f4dcc291e0e3f6cbbaaa6b7002666ad15b, with debug_info, not stripped
abuild@mitmanek:~/rpmbuild/BUILD/lua55-5.5.0_beta1-build/lua-5.5.0-beta/testes> export LD_LIBRARY_PATH=/home/abuild/rpmbuild/BUILD/lua55-5.5.0_beta1-build/lua-5.5.0-beta/src/.libs/
abuild@mitmanek:~/rpmbuild/BUILD/lua55-5.5.0_beta1-build/lua-5.5.0-beta/testes> gdb /home/abuild/rpmbuild/BUILD/lua55-5.5.0_beta1-build/lua-5.5.0-beta/src/.libs/lua5.5
Reading symbols from /home/abuild/rpmbuild/BUILD/lua55-5.5.0_beta1-build/lua-5.5.0-beta/src/.libs/lua5.5...
(gdb) run strings.lua
Starting program: /home/abuild/rpmbuild/BUILD/lua55-5.5.0_beta1-build/lua-5.5.0-beta/src/.libs/lua5.5 strings.lua

[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/libthread_db.so.1".
testing strings and string library

Program received signal SIGSEGV, Segmentation fault.
__GI_memcpy () at ../sysdeps/i386/i586/memcpy.S:107
107 L(1): rep; movsb

(gdb) bt

#0 __GI_memcpy () at ../sysdeps/i386/i586/memcpy.S:107

#1 0xf7f9e9ca in memcpy (__dest=<optimized out>, __src=<optimized out>, __len=<optimized out>,
__dest=<optimized out>, __src=<optimized out>, __len=<optimized out>)
at /usr/include/bits/string_fortified.h:29
#2 str_rep (L=0x61616161)
at /home/abuild/rpmbuild/BUILD/lua55-5.5.0_beta1-build/lua-5.5.0-beta/src/lstrlib.c:149
#3 0x61616161 in ?? ()
(tens of repeats of the last frame)

I would suggest some kind of memory corruption, what do you think?

Best,

Matěj

--
http://matej.ceplovi.cz/blog/, @mc...@en.osm.town
GPG Finger: 3C76 A027 CA45 AD70 98B5 BC1D 7920 5802 880B C9D8

If only there were evil people somewhere insidiously committing
evil deeds, and it were necessary only to separate them from the
rest of us and destroy them. But the line dividing good and evil
cuts through the heart of every human being. And who is willing
to destroy a piece of his own heart?
-- Aleksandr Solzhenitsyn: The Gulag Archipelago

[gottfried leibniz]

On 7/21/2025 3:17 PM, Matěj Cepl wrote:
> On Sat Jul 19, 2025 at 2:52 PM CEST, 'Sainan' via lua-l wrote:
>>> how to get more debugging information?
>>

> I would suggest some kind of memory corruption, what do you think?
>

Quick reproduction for this on x64 machines would be to compile/link Lua
with -m32 (requires multilib). str_rep is not sanitizing extremely large
values gracefully.

There are also a couple sign-conversion warnings that exist when
compiling under this configuration.

Thanks.

[Roberto Ierusalimschy]

Could you send us these warnings? Thanks,

-- Roberto

[gottfried leibniz]

I should add this reproduction requires LUA_32BITS to be zero in luaconf
thereby making the lua_Integer to size_t cast unsafe. The tests causing
a segfault are related to:

assert(not pcall(string.rep, "aa", maxi // 2 + 10))

On 7/21/2025 6:58 PM, Roberto Ierusalimschy wrote:
> Could you send us these warnings? Thanks,

Current HEAD w/ -m32 appended to C and LD flags:

└> gcc --version
gcc (Ubuntu 14.2.0-19ubuntu2) 14.2.0

lgc.c: In function ‘traversetable’:
lgc.c:627:28: warning: conversion to ‘l_mem’ {aka ‘int’} from ‘unsigned
int’ may change the sign of the result [-Wsign-conversion]
627 | return 1 + 2*sizenode(h) + h->asize;

lobject.c: In function ‘luaO_applyparam’:
lobject.c:98:17: warning: conversion to ‘unsigned int’ from ‘l_mem’ {aka
‘int’} may change the sign of the result [-Wsign-conversion]
98 | return (x * m) << e; /* order doesn't matter here */
| ^
lobject.c:98:22: warning: conversion to ‘l_mem’ {aka ‘int’} from
‘unsigned int’ may change the sign of the result [-Wsign-conversion]
98 | return (x * m) << e; /* order doesn't matter here */
| ~~~~~~~~^~~~
lobject.c:105:17: warning: conversion to ‘unsigned int’ from ‘l_mem’
{aka ‘int’} may change the sign of the result [-Wsign-conversion]
105 | return (x * m) >> e; /* multiplying first gives more
precision */
| ^
lobject.c:105:22: warning: conversion to ‘l_mem’ {aka ‘int’} from
‘unsigned int’ may change the sign of the result [-Wsign-conversion]
105 | return (x * m) >> e; /* multiplying first gives more
precision */
| ~~~~~~~~^~~~
lobject.c:107:23: warning: conversion to ‘unsigned int’ from ‘l_mem’
{aka ‘int’} may change the sign of the result [-Wsign-conversion]
107 | return (x >> e) * m;
| ^
lobject.c:107:23: warning: conversion to ‘l_mem’ {aka ‘int’} from
‘unsigned int’ may change the sign of the result [-Wsign-conversion]
107 | return (x >> e) * m;