Re: Soundness of table.sort

[takuya hashimoto <takuya.hashimoto@...>]

> Can you explain your patch? What does it do and how does it do it? In
> particular, can you explain how it makes the implementation "sound"?

(lua-5.3.1/src/ltablib.c line 287-)
    /* a[l] <= P == a[u-1] <= a[u], only need to sort from l+1 to u-2 */
    i = l; j = u-1;
    for (;;) {  /* invariant: a[l..i] <= P <= a[j..u] */

a[i] and a[u-1] will be swapped after this loop.
If `i` is equal to `u` after this loop, `i` overruns.
My patch revises the range check so that `i` does not overrun.
There is an increment after the range check,
therefore it should be i>=u-1.