Re: Heap overflow in luaH_get

[Roberto Ierusalimschy <roberto@...>]

>  云风> I'm curious about that if the object moved back to the front of
>  云风> allgc list and remaining G_OLD1, why this assert in sweepgen()
>  云风> haven't been triggered ?
> 
>  云风> lua_assert(!isold(curr) && isdead(g, curr))
>  云风> (https://github.com/lua/lua/blob/master/lgc.c#L1014)
> 
> That assert is not reached if the object (in this case the table, not
> the metatable) is not white, and in this case it's black. The metatable,
> which is in fact freed in that code, is white and SURVIVAL (not OLD*).

Moreover, are the assertions on in the tests? They are no on by
default in Lua.

-- Roberto