Strange LuaJIT segfault

[Pierre Chapuis <catwell@...>]

Hello,

I have code that uses the FFI that segfaults when I run it in 
LuaJIT-2.0.0-beta8 with hotfix #1 on Mac OS X. It is part of the code 
that implements a bitset.

Here is a simplified version:

  #!/usr/bin/env luajit -lluarocks.loader

  local ffi = require "ffi"

  local bmask_1,bmask_0 = ffi.new("uint8_t[8]"),ffi.new("uint8_t[8]")
  local allones = bit.tobit(0xff)
  for i=0,7 do
    bmask_1[i] = bit.lshift(1,7-i)
    bmask_0[i] = bit.bxor(allones,bmask_1[i])
  end

  local bit_set_0 = function(_bset,_byte,_bit)
    io.stderr:write("A\n")
    -- if _bit == 0 then end
    local y = bmask_0[_bit]
    io.stderr:write("B\n")
    _bset[_byte] = bit.band(_bset[_byte],bmask_0[_bit])
  end

  local NBYTES = 30
  local _bset = ffi.new("uint8_t[?]",NBYTES)

  for i=1,2 do
    local _byte,_bit = 0,-1
    for j=1,NBYTES*8 do
      _bit = _bit + 1
      if _bit == 8 then _byte,_bit = _byte+1,0 end
      io.stderr:write(_byte," ",_bit,"\n")
      bit_set_0(_bset,_byte,_bit)
    end
  end

If I run this script, it segfaults at the beginning second iteration of 
the loop (for i=1,2 do). The output is:

  [...]
  A
  B
  29 6
  A
  B
  29 7
  A
  B
  0 0
  A
  Segmentation fault

If I run it in GDB I get:

  [...]
  A
  B
  29 6
  A
  B
  29 7
  A
  B
  0 0
  A

  Program received signal EXC_BAD_ACCESS, Could not access memory.
  Reason: KERN_INVALID_ADDRESS at address: 0x0000000100085240
  0x00000001390bfdea in ?? ()

It does NOT segfault for NBYTES < 22. It does NOT segfault if I 
uncomment the line that has been commented out (if _bit == 0 then end). 
It does NOT segfault if I do not require luarocks.loader.

Does anybody have an idea of why this happens or how I could help debug 
it? Can anybody reproduce it?

Thanks for your help,

--
Pierre 'catwell' Chapuis