Re: Segfaults in lj_snap_shrink

  • From: "Vyacheslav Egorov" <dmarc-noreply@xxxxxxxxxxxxx> (Redacted sender "vegorov" for DMARC)
  • To: luajit@xxxxxxxxxxxxx
  • Date: Wed, 30 Nov 2016 13:27:07 +0100

Yeah, given that you increased both snapshot size and a trace size you are
most certainly just overflowing something in the snapshot implementation -
which does not guard against it.

On Wed, Nov 30, 2016 at 11:55 AM Denis Golovan <denis.golovan@xxxxxxxxx>
wrote:

I use the following options:
jit.opt.start("maxmcode=10240", "maxtrace=3000", "maxside=400",
"maxsnap=3000", "maxirconst=2000",
                 "hotloop=5", "hotexit=20", "instunroll=25",
"loopunroll=100", "callunroll=25")

Thanks, I'll try your suggestion and come back.

2016-11-30 12:34 GMT+02:00 Vyacheslav Egorov <dmarc-noreply@xxxxxxxxxxxxx>:

Are you running with default JIT parameters - or did you tweak any?

I have seen this sort of thing happen when things overflow uint16_t.

You can try running with:

if (((MSize)(uint16_t)(snap->mapofs + m)) != (snap->mapofs + m)) abort();

to check if this is the case.

Other related posts: