Re: Heap overflow in luaH_get
[
Date Prev][
Date Next][
Thread Prev][
Thread Next]
[
Date Index]
[
Thread Index]
- Subject: Re: Heap overflow in luaH_get
- From: Roberto Ierusalimschy <roberto@...>
- Date: Thu, 9 Jul 2020 11:02:24 -0300
> 云风> I'm curious about that if the object moved back to the front of
> 云风> allgc list and remaining G_OLD1, why this assert in sweepgen()
> 云风> haven't been triggered ?
>
> 云风> lua_assert(!isold(curr) && isdead(g, curr))
> 云风> (https://github.com/lua/lua/blob/master/lgc.c#L1014)
>
> That assert is not reached if the object (in this case the table, not
> the metatable) is not white, and in this case it's black. The metatable,
> which is in fact freed in that code, is white and SURVIVAL (not OLD*).
Moreover, are the assertions on in the tests? They are no on by
default in Lua.
-- Roberto