luajit-bugfix-fixed-a-segfault-when-unsinking-64-bit-pointers.patch

From a6a2720ddc22f9f62f119325881d05722c4f392e Mon Sep 17 00:00:00 2001
From: Thibault Charbonnier <thibaultcha@me.com>
Date: Tue, 19 Mar 2019 13:52:51 -0700
Subject: [PATCH 1/3] bugfix: fixed a segfault when unsinking 64-bit pointers.

The unsinking code was not using the correct layout for GC64 IR
constants (value in adjacent slot) for this case.

This patch is a derivative of
https://github.com/raptorjit/raptorjit/pull/246 ported for LuaJIT
itself.

Fixed after an intense debugging session with @lukego.

Co-authored-by: Luke Gorrie <lukego@gmail.com>
---
 src/lj_ir.h   | 12 ++++++------
 src/lj_snap.c |  2 +-
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/src/lj_ir.h b/src/lj_ir.h
index 8057a750..a46b561f 100644
--- a/src/lj_ir.h
+++ b/src/lj_ir.h
@@ -562,6 +562,11 @@ typedef union IRIns {
   TValue tv;		/* TValue constant (overlaps entire slot). */
 } IRIns;
 
+#define ir_isk64(ir) ((ir)->o == IR_KNUM || (ir)->o == IR_KINT64 || \
+                      (LJ_GC64 && \
+                       ((ir)->o == IR_KGC || \
+                       (ir)->o == IR_KPTR || (ir)->o == IR_KKPTR)))
+
 #define ir_kgc(ir)	check_exp((ir)->o == IR_KGC, gcref((ir)[LJ_GC64].gcr))
 #define ir_kstr(ir)	(gco2str(ir_kgc((ir))))
 #define ir_ktab(ir)	(gco2tab(ir_kgc((ir))))
@@ -569,12 +574,7 @@ typedef union IRIns {
 #define ir_kcdata(ir)	(gco2cd(ir_kgc((ir))))
 #define ir_knum(ir)	check_exp((ir)->o == IR_KNUM, &(ir)[1].tv)
 #define ir_kint64(ir)	check_exp((ir)->o == IR_KINT64, &(ir)[1].tv)
-#define ir_k64(ir) \
-  check_exp((ir)->o == IR_KNUM || (ir)->o == IR_KINT64 || \
-	    (LJ_GC64 && \
-	     ((ir)->o == IR_KGC || \
-	      (ir)->o == IR_KPTR || (ir)->o == IR_KKPTR)), \
-	    &(ir)[1].tv)
+#define ir_k64(ir)	check_exp(ir_isk64(ir), &(ir)[1].tv)
 #define ir_kptr(ir) \
   check_exp((ir)->o == IR_KPTR || (ir)->o == IR_KKPTR, \
     mref((ir)[LJ_GC64].ptr, void))
diff --git a/src/lj_snap.c b/src/lj_snap.c
index ceaf2ca5..75888d80 100644
--- a/src/lj_snap.c
+++ b/src/lj_snap.c
@@ -688,7 +688,7 @@ static void snap_restoredata(GCtrace *T, ExitState *ex,
   int32_t *src;
   uint64_t tmp;
   if (irref_isk(ref)) {
-    if (ir->o == IR_KNUM || ir->o == IR_KINT64) {
+    if (ir_isk64(ir)) {
       src = (int32_t *)&ir[1];
     } else if (sz == 8) {
       tmp = (uint64_t)(uint32_t)ir->i;
-- 
2.21.0