{"action":"created","issue":{"url":"https://api.github.com/repos/LuaJIT/LuaJIT/issues/158","repository_url":"https://api.github.com/repos/LuaJIT/LuaJIT","labels_url":"https://api.github.com/repos/LuaJIT/LuaJIT/issues/158/labels{/name}","comments_url":"https://api.github.com/repos/LuaJIT/LuaJIT/issues/158/comments","events_url":"https://api.github.com/repos/LuaJIT/LuaJIT/issues/158/events","html_url":"https://github.com/LuaJIT/LuaJIT/issues/158","id":149775687,"number":158,"title":"Got a segfault","user":{"login":"mah0x211","id":460352,"avatar_url":"https://avatars.githubusercontent.com/u/460352?v=3","gravatar_id":"","url":"https://api.github.com/users/mah0x211","html_url":"https://github.com/mah0x211","followers_url":"https://api.github.com/users/mah0x211/followers","following_url":"https://api.github.com/users/mah0x211/following{/other_user}","gists_url":"https://api.github.com/users/mah0x211/gists{/gist_id}","starred_url":"https://api.github.com/users/mah0x211/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mah0x211/subscriptions","organizations_url":"https://api.github.com/users/mah0x211/orgs","repos_url":"https://api.github.com/users/mah0x211/repos","events_url":"https://api.github.com/users/mah0x211/events{/privacy}","received_events_url":"https://api.github.com/users/mah0x211/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2016-04-20T13:58:04Z","updated_at":"2016-04-20T16:00:09Z","closed_at":null,"body":"Segfault error occurs with a following code on the current stable version 2.0.4 and latest version 2.1.0-beta2;\r\n\r\nhttps://gist.github.com/mah0x211/5417916#file-segfault-lua-L325\r\n\r\nNOTE: That code is automatically generated by my experimental template engine.\r\n\r\n```\r\nMacBook-2:LuaJIT-2.1.0-beta2 mah$ lldb ./src/luajit ./test.lua \r\n(lldb) target create \"./src/luajit\"\r\nCurrent executable set to './src/luajit' (x86_64).\r\n(lldb) settings set -- target.run-args  \"./test.lua\"\r\n(lldb) r\r\nProcess 21418 launched: './src/luajit' (x86_64)\r\nProcess 21418 stopped\r\n* thread #1: tid = 0x2ad82, 0x00000001000317ba luajit`lj_record_mm_lookup(J=0x0000000000042558, ix=0x00007fff5fbff098, mm=MM_tostring) + 122 at lj_record.c:903, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x10)\r\n    frame #0: 0x00000001000317ba luajit`lj_record_mm_lookup(J=0x0000000000042558, ix=0x00007fff5fbff098, mm=MM_tostring) + 122 at lj_record.c:903\r\n   900 \t  RecordIndex mix;\r\n   901 \t  GCtab *mt;\r\n   902 \t  if (tref_istab(ix->tab)) {\r\n-> 903 \t    mt = tabref(tabV(&ix->tabv)->metatable);\r\n   904 \t    mix.tab = emitir(IRT(IR_FLOAD, IRT_TAB), ix->tab, IRFL_TAB_META);\r\n   905 \t  } else if (tref_isudata(ix->tab)) {\r\n   906 \t    int udtype = udataV(&ix->tabv)->udtype;\r\n(lldb) bt\r\n* thread #1: tid = 0x2ad82, 0x00000001000317ba luajit`lj_record_mm_lookup(J=0x0000000000042558, ix=0x00007fff5fbff098, mm=MM_tostring) + 122 at lj_record.c:903, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x10)\r\n  * frame #0: 0x00000001000317ba luajit`lj_record_mm_lookup(J=0x0000000000042558, ix=0x00007fff5fbff098, mm=MM_tostring) + 122 at lj_record.c:903\r\n    frame #1: 0x000000010003ff11 luajit`recff_metacall(J=0x0000000000042558, rd=0x00007fff5fbff138, mm=<unavailable>) + 49 at lj_ffrecord.c:379\r\n    frame #2: 0x000000010003da5e luajit`recff_tostring(J=0x0000000000042558, rd=0x00007fff5fbff138) + 62 at lj_ffrecord.c:406\r\n    frame #3: 0x000000010003d04c luajit`lj_ffrecord_func(J=0x0000000000042558) + 108 at lj_ffrecord.c:1207\r\n    frame #4: 0x0000000100032ceb luajit`lj_record_ins(J=0x0000000000042558) + 1755 at lj_record.c:2359\r\n    frame #5: 0x0000000100054a14 luajit`trace_state(L=0x0000000000042378, dummy=<unavailable>, ud=0x0000000000042558) + 468 at lj_trace.c:619\r\n    frame #6: 0x0000000100004526 luajit`lj_vm_cpcall + 74\r\n    frame #7: 0x00000001000547fe luajit`lj_trace_ins(J=0x0000000000042558, pc=<unavailable>) + 62 at lj_trace.c:678\r\n    frame #8: 0x000000010000fb0b luajit`lj_dispatch_call(L=0x0000000000042378, pc=0x000000000004376c) + 203 at lj_dispatch.c:493\r\n    frame #9: 0x0000000100005b9a luajit`lj_vm_hotcall + 30\r\n    frame #10: 0x000000010001916b luajit`lua_pcall(L=<unavailable>, nargs=<unavailable>, nresults=<unavailable>, errfunc=<unavailable>) + 91 at lj_api.c:1055\r\n    frame #11: 0x0000000100002429 luajit`docall(L=0x0000000000042378, narg=0, clear=0) + 89 at luajit.c:121\r\n    frame #12: 0x0000000100001ecb luajit`pmain [inlined] handle_script + 351 at luajit.c:288\r\n    frame #13: 0x0000000100001d6c luajit`pmain(L=0x0000000000042378) + 1724 at luajit.c:537\r\n    frame #14: 0x00000001000041b7 luajit`lj_BC_FUNCC + 52\r\n    frame #15: 0x00000001000191a6 luajit`lua_cpcall(L=<unavailable>, func=<unavailable>, ud=<unavailable>) + 22 at lj_api.c:1079\r\n    frame #16: 0x00000001000015b4 luajit`main(argc=2, argv=0x00007fff5fbff608) + 52 at luajit.c:565\r\n    frame #17: 0x0000000100001558 luajit`_start + 230\r\n    frame #18: 0x0000000100001471 luajit`start + 33\r\n(lldb) \r\n```"},"comment":{"url":"https://api.github.com/repos/LuaJIT/LuaJIT/issues/comments/212489835","html_url":"https://github.com/LuaJIT/LuaJIT/issues/158#issuecomment-212489835","issue_url":"https://api.github.com/repos/LuaJIT/LuaJIT/issues/158","id":212489835,"user":{"login":"mraleph","id":131846,"avatar_url":"https://avatars.githubusercontent.com/u/131846?v=3","gravatar_id":"","url":"https://api.github.com/users/mraleph","html_url":"https://github.com/mraleph","followers_url":"https://api.github.com/users/mraleph/followers","following_url":"https://api.github.com/users/mraleph/following{/other_user}","gists_url":"https://api.github.com/users/mraleph/gists{/gist_id}","starred_url":"https://api.github.com/users/mraleph/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mraleph/subscriptions","organizations_url":"https://api.github.com/users/mraleph/orgs","repos_url":"https://api.github.com/users/mraleph/repos","events_url":"https://api.github.com/users/mraleph/events{/privacy}","received_events_url":"https://api.github.com/users/mraleph/received_events","type":"User","site_admin":false},"created_at":"2016-04-20T16:00:09Z","updated_at":"2016-04-20T16:00:09Z","body":"Bug is caused by the inconsistency between `BC_ADDVV` recording and it's implementation.\r\n\r\n[Recording](https://github.com/LuaJIT/LuaJIT/blob/cc4f5d056ab93521451631f28501015f054d8976/src/lj_record.c#L1876) assumes that metamethod is *not* invoked if both operands are strings or numbers. However [implementation](https://github.com/LuaJIT/LuaJIT/blob/cc4f5d056ab93521451631f28501015f054d8976/src/lj_meta.c#L210-L214) falls into a metamethod if string operands are not convertible to integers. This causes divergence of state between recorder and interpreter and subsequent crash. \r\n\r\nCompiling with assertions catches this divergence:\r\n\r\n```\r\nAssertion failed: (itype2irt(tv) == ((IRType)(((tr)>>24) & IRT_TYPE))), function rec_check_slots, file lj_record.c, line 135.\r\n```\r\n\r\nReduction: \r\n\r\n```lua\r\n\r\ndo\r\n    local meta = debug.getmetatable( '' );\r\n    meta.__add = function( op1, op2 )\r\n        local t1 = type( op1 );\r\n        local t2 = type( op2 );\r\n\r\n        if t1 == t2 then\r\n            return op1 .. op2;\r\n        elseif t1 == 'string' then\r\n            return op1 .. tostring( op2 );\r\n        end\r\n\r\n        return tostring( op1 ) .. op2;\r\n    end\r\nend\r\n\r\nlocal function add(x, b)\r\n  return x.a + b\r\nend\r\n\r\nlocal function foo()\r\n  local x = { a = \"a\" }\r\n  for i = 1, 120 do\r\n    x.res = add(x, i)\r\n  end\r\nend\r\n\r\njit.off(foo)\r\nfoo()\r\n```"}}