lua

commit afb3f7e754bde70895d639ff2a2738409a51c60e
parent 88564c3aec8122ce20bd257e01d4ab32c9663051
Author: Roberto Ierusalimschy <roberto@inf.puc-rio.br>
Date:   Wed,  1 Jul 2009 17:31:01 -0300

bug: 'luaV_settable' may invalidate a reference to a table and try
to reuse it.

Diffstat:
M
lvm.c
 | 
9
++++++---

1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/lvm.c b/lvm.c
@@ -1,5 +1,5 @@
 /*
-** $Id: lvm.c,v 2.92 2009/06/17 16:17:14 roberto Exp roberto $
+** $Id: lvm.c,v 2.93 2009/06/17 17:50:09 roberto Exp roberto $
 ** Lua virtual machine
 ** See Copyright Notice in lua.h
 */
@@ -115,7 +115,7 @@ void luaV_gettable (lua_State *L, const TValue *t, TValue *key, StkId val) {
       callTM(L, tm, t, key, val, 1);
       return;
     }
-    t = tm;  /* else repeat with `tm' */
+    t = tm;  /* else repeat with 'tm' */
   }
   luaG_runerror(L, "loop in gettable");
 }
@@ -123,6 +123,7 @@ void luaV_gettable (lua_State *L, const TValue *t, TValue *key, StkId val) {
 
 void luaV_settable (lua_State *L, const TValue *t, TValue *key, StkId val) {
   int loop;
+  TValue temp;
   for (loop = 0; loop < MAXTAGLOOP; loop++) {
     const TValue *tm;
     if (ttistable(t)) {  /* `t' is a table? */
@@ -142,7 +143,9 @@ void luaV_settable (lua_State *L, const TValue *t, TValue *key, StkId val) {
       callTM(L, tm, t, key, val, 0);
       return;
     }
-    t = tm;  /* else repeat with `tm' */
+    /* else repeat with 'tm' */
+    setobj(L, &temp, tm);  /* avoid pointing inside table (may rehash) */
+    t = &temp;
   }
   luaG_runerror(L, "loop in settable");
 }