Re: Heap overflow in luaH_get

[Roberto Ierusalimschy <roberto@...>]

> Roberto Ierusalimschy <roberto@inf.puc-rio.br> 于2020年7月9日周四 下午10:02写道：
> > so the object is still new and everything works fine. In the
> > crashing code, the «setmetatable({}, ...)» looks like the metable
> > is being set right after the «{}», but the code to create the
> > metatable is long and slow, aging the table.
> 
> As Andrew Gierth said, the table is G_OLD1 and the metatable is white
> and G_SURVIVAL. The age difference is strange.
> 
> How it happens ?

Sorry, I mixed my comments. That comment was actually about the
problem with luaC_checkfinalizer, not with separatetobefnz. In
that stage, the table is still survival (not old1). Anyway,
a survival object should not be in the beninning of the finobj
list, before the finobjsur pointer.

But keep in mind that the age difference is potentially unbounded,
as an object can have its metatable set way after being created.

-- Roberto