Re: [BUG] crash in Lua on table insertion

[Roberto Ierusalimschy <roberto@...>]

> 'twotoi' is overflowing, and then the loop goes wild until a crash, so
> the final 'i' is noise.
> 
> With 0x40000001, a size of 0x80000000 for the array part is already
> justified, so the algorithm tries to go to the next size (0x100000000)
> to see if it can fill that, but 0x100000000 overflows 'twotoi',
> which is an unsigned integer.

The obvious fix seems to be limiting the loop explicitly:

-  for (i = 0, twotoi = 1; *pna > twotoi / 2; i++, twotoi *= 2) {
+  for (i = 0, twotoi = 1; i <= MAXABITS && *pna > twotoi / 2; i++, twotoi *= 2) {

Can you try this fix? If possible, could you report the initial value
of '*pna' and the final value of 'optimal' in the last 10 calls to
'computesizes', with your original test?

Thanks again,

-- Roberto