Re: Heap overflow in luaH_get

[Andrew Gierth <andrew@...>]

>>>>> "云风" == 云风 Cloud Wu <cloudwu@gmail.com> writes:

 >> But what happens in this case is that some table with an age of OLD1 has
 >> a metatable with a __gc metamethod, and when GCTM is being called for
 >> it, it gets moved back to the allgc list _at the front_, while remaining
 >> G_OLD1 (this is in udata2finalize).

 云风> I'm curious about that if the object moved back to the front of
 云风> allgc list and remaining G_OLD1, why this assert in sweepgen()
 云风> haven't been triggered ?

 云风> lua_assert(!isold(curr) && isdead(g, curr))
 云风> (https://github.com/lua/lua/blob/master/lgc.c#L1014)

That assert is not reached if the object (in this case the table, not
the metatable) is not white, and in this case it's black. The metatable,
which is in fact freed in that code, is white and SURVIVAL (not OLD*).

-- 
Andrew.