Page 1 of 1

[1.1.42] Crash when getting debug info in bytecode with null local debug names

Posted: Tue Oct 19, 2021 6:26 pm
by jan1i3
What
When Lua tries to get the debug synbol name / varname for a register it crashes if that register currently has a "local" name that is `NULL` (or 0 or nullptr, whichever you prefer).
Expected
I'd expect Lua not to crash, and I believe it is because this function assumes that all varnames are not `NULL`.

The proper fix for this would be to validate that the given bytecode does not contain null strings for local debug symbols, similar to how the constant table must not contain null strings.

However, there is an alternative fix which I personally would prefer:
Allow "unnamed" registers (meaning local debug symbols with `NULL` names) between the registers that represent the local variables.
This may be a bit of a deviation from regular Lua, but it would allow me - or rather phobos, the compiler I'm working on - to have some crazy register management since Lua technically does not enforce normal stack behavior for it's stack. Additinally it would allow naming temporary registers to better describe what value they are holding instead of "?". For example when calling `foo[bar]()` where `foo[bar]` evaluates to nil, Lua falls back to "Attempt to call '?' (a nil value)". Phobos, or any bytecode compiler, could provide a better name, such that the error would be "Attempt to call local '(foo[bar])' (a nil value)", but in the process must pad all registers up to that location in the stack with some "unnamed" local name.
Reproduce
Run this command

Code: Select all

/c
assert(load("\z
\027\z L\z u\z a\z R\000\001\004\008\004\008\000\025\147\013\010\026\010\000\000\000\000\000\000\000\000\000\001\002\005\000\000\z
\000\z %\000\000\000\z @\000\000\000\z ]\z @\128\000\031\000\128\000\031\000\128\000\001\000\000\000\004\z 1\000\000\000\000\000\z
\000\000\027\z P\z h\z o\016\z B\255\000\000\000\000\000\000\000\000\000\005\000\000\000\007\000\000\000\001\000\000\000\004\000\z
\000\000\001\000\000\000\001\000\000\000\000\000\000\000\000\000\000\000\000\001\000\000\000\002\000\000\000\004\000\000\000\000\z
\000\003\006\000\000\000\006\000\z @\000\007\z @\z @\000\z A\128\000\000\129\192\000\000\029\z @\128\001\031\000\128\000\005\000\z
\000\000\004\006\000\000\000\000\000\000\000\z d\z e\z b\z u\z g\000\004\008\000\000\000\000\000\000\000\z g\z e\z t\z i\z n\z f\z
\z o\000\003\000\000\000\000\000\000\240\z ?\004\002\000\000\000\000\000\000\000\z n\000\004\z 5\000\000\000\000\000\000\000\027\z
\z P\z h\z o\016\z B\255\000\007\000\000\000\001\000\000\000\006\000\000\000\003\000\000\000\008\000\000\000\017\000\000\000\020\z
\000\000\000\016\000\000\000\001\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\001\000\000\000\000\000\015\000\z
\000\000\000\000\000\000\z @\z t\z e\z m\z p\z /\z t\z e\z s\z t\z .\z l\z u\z a\000\006\000\000\000\003\000\000\000\003\000\000\z
\000\003\000\000\000\003\000\000\000\003\000\000\000\004\000\000\000\004\000\000\000\000\000\000\000\000\000\000\000\000\000\000\z
\000\001\000\000\000\000\000\000\000\000\000\000\000\001\000\000\000\005\000\000\000\000\000\000\000\000\000\000\000\002\000\000\z
\000\005\000\000\000\000\000\000\000\000\000\000\000\003\000\000\000\005\000\000\000\001\000\000\000\005\000\000\000\000\000\000\z
\000\z _\z E\z N\z V\000\001\000\000\000\001\000\015\000\000\000\000\000\000\000\z @\z t\z e\z m\z p\z /\z t\z e\z s\z t\z .\z l\z
\z u\z a\000\005\000\000\000\002\000\000\000\006\000\000\000\006\000\000\000\008\000\000\000\008\000\000\000\002\000\000\000\000\z
\000\000\000\000\000\000\000\000\000\000\000\004\000\000\000\000\000\000\000\000\000\000\000\001\000\000\000\003\000\000\000\001\z
\000\000\000\005\000\000\000\000\000\000\000\z _\z E\z N\z V\000\z
", nil, 'b'))()
Which is the phobos compiled bytecode for the code below, except every single local debug info name is set to `null`. (This is also in a testing state, so there are a ton of unneccessary local name debug symbols)

Code: Select all


local function foo()
  debug.getinfo(1, "n")
end

foo()

return

Re: [1.1.42] Crash when getting debug info in bytecode with null local debug names

Posted: Mon Oct 25, 2021 12:21 pm
by Klonan
Is this fixed in the official Lua repo? I think it best if its reported to them, and we can fix it in our version of Lua when/if there is an upstream fix

Re: [1.1.42] Crash when getting debug info in bytecode with null local debug names

Posted: Tue Oct 26, 2021 1:52 am
by jan1i3
Oh good point, it's not addressed in regular Lua. I'll see about reporting it to them, though I'm far less confident reporting to them.

Regardless, if it is addressed in upstream Lua, I will let you know

Re: [1.1.42] Crash when getting debug info in bytecode with null local debug names

Posted: Tue Oct 26, 2021 7:07 am
by Klonan
jan1i3 wrote: Tue Oct 26, 2021 1:52 amI will let you know
Seems like Rseding has fixed it in the meantime :D