Re: crash in Lua 5.1 and 5.2: calling C function from unloaded lib

["Robert G. Jakabosky" <bobby@...>]

On Sunday 08, Josh Haberman wrote:
> The following extension and Lua program crash both Lua 5.1 and Lua
> 5.2.  From an strace it appears that the extension library is called
> into after it was unloaded.

One problem with unloading modules is that there is no simple way to 
invalidate "nil" all C function references to the module.  A module can create 
a new C function reference either when being loaded or later when one of it's 
C functions is called.

In your example the Lua VM doesn't know for sure that ext.nop() points into 
the module, so it can't "nil" that reference when the module is unloaded.

To support safe unloading the Lua C API would need to be changed provide a way 
to tell the VM what module a C function is a part of.

> Perhaps this is a GC-related bug where
> the loaded library is collected prematurely?

No, the collection order is correct.  The atexit() callback is registered (a 
userdata is created) before loading the 'ext' module (another userdata is 
created).  The GC will free userdata values in reverse order to when they were 
created.  So the GC will unload the module before running the atexit() 
callback, which calls ext.nop() a C function that still points into the 
unloaded module.

Try:
local ext = require "ext"
atexit(function() ext.nop() end)


-- 
Robert G. Jakabosky