LuaJIT segfault

[Pierre Chapuis <catwell@...>]

LuaJIT segfaults at GC step when running this snippet:

  local ffi = require "ffi"

  local get_str = function()
    local f = io.popen("dd if=/dev/urandom bs=1 count=10000")
    local s = f:read("*all")
    f:close()
    return s
  end

  local convert = function(str)
    local l = #str
    local s = ffi.new("char[?]",l,str) // <=
    return ffi.string(s,l)
  end

  for i=1,200 do
    print(i)
    convert(get_str())
  end

If I replace the line marked "<=" by this:

  local s = ffi.new("char[?]",l+1,str)

the problem goes away.

Is that behavior expected? It looks like a bug to me.

--
Pierre Chapuis