Regression: stack corruption with pcalls

[CoffeeFlux]

Originally reported at TypesettingTools/Aegisub#116

Calling LuaJSON's decode function on Linux via pcall with a trivial JSON file eventually produces a failure like the following:

./json/decode/util.lua:35: unexpected character @ character: 1 0:1 [*] line: 
*

Bisecting indicates this is caused by a32aead, testing with ddd0fd8 works correctly. HEAD in v2.1 still exhibits the issue as of today. I couldn't get this to work on anything other than Linux, but it works on both Ubuntu 20.04 and Arch.

Repro here: https://sharex.thevacuumof.space/2021/05/luajit-bug.tar.gz

Unfortunately, this isn't exactly a minimal repro since I didn't have much luck simplifying the LuaJSON portion. It also relies on lpeg being somewhere on your system to work. If you need something simpler I can take another swing at it, but I'm hoping that knowing the exact commit responsible for the regression will make this doable as-is.

[inkydragon]

Repetition steps (Ubuntu 20.04):

# build LuaJIT
cd ~
git clone https://github.com/LuaJIT/LuaJIT
cd ~/LuaJIT/
git checkout v2.1
make

# download test lua files
cd ~/LuaJIT
wget https://sharex.thevacuumof.space/2021/05/luajit-bug.tar.gz
tar -zxvf luajit-bug.tar.gz

# build lpeg
cd ~/LuaJIT
wget http://www.inf.puc-rio.br/~roberto/lpeg/lpeg-1.0.2.tar.gz
tar -zxvf lpeg-1.0.2.tar.gz
cd ~/LuaJIT/lpeg-1.0.2
make LUADIR=../src/

# set LUA_CPATH
cd ~/LuaJIT/lpeg-1.0.2
export LUA_CPATH="./?.so;/usr/local/lib/lua/5.3/?.so;/usr/local/share/lua/5.3/?.so;$(pwd)/?.so"
echo $LUA_CPATH

# rpetition error
cd ~/LuaJIT/luajit-bug
~/LuaJIT/src/luajit json-decode-test.lua

System version:

$ cat /proc/version
Linux version 5.8.0-50-generic (buildd@lgw01-amd64-030) (gcc (Ubuntu 9.3.0-17ubuntu1~20.04) 9.3.0, GNU ld (GNU Binutils for Ubuntu) 2.34) #56~20.04.1-Ubuntu SMP Mon Apr 12 21:46:35 UTC 2021

[MikePall]

Fixed. Thanks!

Oh my ... that sent me down a rabbit hole. The issue happens with pcall(obj, x) where obj has a __call metamethod pointing to a vararg function. The mentioned commit forced a snapshot after pcall, which is required to handle on-trace errors. That snapshot was missing x. But the commit is fine and only uncovered a different issue: the use-def analysis for BC_VARG was completely wrong (since 10 years).

[CoffeeFlux]

Thanks a bunch!