crash in newkey

["ZhaoBoqiang" <beckzar@...>]

Thanks for the remind of Patrick Donnelly.

My program encounter a crash.
> From the dump, they are same.
But I don't have a way to recreate this buy.
I am using lua 5.1,not the recently version,but I compare the two version. 
the ltable.c have only modify one line.

static TValue *newkey (lua_State *L, Table *t, const TValue *key) {
 Node *mp = mainposition(t, key);
 if (!ttisnil(gval(mp)) || mp == dummynode) {
   Node *othern;
   Node *n = getfreepos(t);  /* get a free place */
   if (n == NULL) {  /* cannot find a free place? */
     rehash(L, t, key);  /* grow table */
     return luaH_set(L, t, key);  /* re-insert key into grown table */
   }
   lua_assert(n != dummynode);
   othern = mainposition(t, key2tval(mp));
   if (othern != mp) {  /* is colliding node out of its main position? */
     /* yes; move colliding node into free position */
->      while (gnext(othern) != mp) othern = gnext(othern);  /* find 
previous */
     gnext(othern) = n;  /* redo the chain with `n' in place of `mp' */
     *n = *mp;  /* copy colliding node into free pos. (mp->next also goes) 
*/
     gnext(mp) = NULL;  /* now `mp' is free */
     setnilvalue(gval(mp));
   }
   else {  /* colliding node is in its own main position */
     /* new node will go into free position */
     gnext(n) = gnext(mp);  /* chain new position */
     gnext(mp) = n;
     mp = n;
   }
 }
 gkey(mp)->value = key->value; gkey(mp)->tt = key->tt;
 luaC_barriert(L, t, key);
 lua_assert(ttisnil(gval(mp)));
 return gval(mp);
}

crash in the "->" line.
I have analysed the dump file.
othern is 88 at this condition.

and the call stack is:
newkey
luaV_settable while luaH_set
luaV_execute while OP_MOD

Thank you very much.

Zwinger
beckzar@hotmail.com