Re: another crash bug in lua5.1work6

[Mike Pall <mikelu-0506@...>]

Hi,

Alex Evans wrote:
> it crashes eventually in luaH_getstr() - trying to extract
> the __tostring field from the thread's metatable.

This is the same bug. The metatable pointer gets overwritten
because the G(L)->mt array is too short by one entry (the one
for LUA_TTHREAD).

Change the following lines in lobject.h from:

#define NUM_TAGS        LUA_TTHREAD
...
#define LUA_TPROTO      (NUM_TAGS+1)
#define LUA_TUPVAL      (NUM_TAGS+2)
#define LUA_TDEADKEY    (NUM_TAGS+3)

to:

#define NUM_TAGS        (LUA_TTHREAD+1)
...
#define LUA_TPROTO      NUM_TAGS
#define LUA_TUPVAL      (NUM_TAGS+1)
#define LUA_TDEADKEY    (NUM_TAGS+2)

... and recompile.

Bye,
     Mike