Public bug reported:

This is a bit of a niche bug, that only happens on a particular
combination of OS, CPU architecture, and LUA package, and admittedly is
a pretty unusual use-case.

The original error report relates to my vlcj bindings for the vlc media
player - but I have been able to distil the problem down to a very
specific and simple test case.

My test case embeds the execution of a LUA script inside Java code.

I have tested this using the Oracle provided Java6 and Java7 JVMs, and
the OpenJDK Java6 and Java7 JVMs. All with the same results. There is no
observed problem with LUA outside of a JVM.

My test case works just fine on 64-bit Ubuntu/Kubuntu and Lubuntu.

My unchanged test case fails on 32-bit Ubuntu/Kubuntu and Lubuntu.

The nature of the failure is a fatal JVM crash caused by a segfault
triggered by some lua code. This is repeatable 100% of the time.

An example JVM crash dump contains this:

#  SIGSEGV (0xb) at pc=0xb767c688, pid=4407, tid=2080172864
#
# JRE version: 7.0_05-b05
# Java VM: Java HotSpot(TM) Server VM (23.1-b03 mixed mode linux-x86 )
# Problematic frame:
# C  [libc.so.6+0x128688]  _IO_file_underflow+0x68

The backtrace from gdb contains this:

#0  0x0028f688 in _IO_file_underflow () from /lib/i386-linux-gnu/libc.so.6
#1  0x001d83a9 in _IO_default_uflow () from /lib/i386-linux-gnu/libc.so.6
#2  0x001d81c0 in __uflow () from /lib/i386-linux-gnu/libc.so.6
#3  0x001ce6d2 in getc () from /lib/i386-linux-gnu/libc.so.6
#4  0x02c8abc4 in luaL_loadfile () from /usr/lib/i386-linux-gnu/liblua5.1.so.0

The piece of code that triggers this bug is in lauxlib.c in the
luaL_loadfile method:

while ((c = getc(lf.f)) != EOF && c != LUA_SIGNATURE[0]) ; <--- Crash
failure triggered here after freopen

This bug is only triggered when the LUA script being opened has been
compiled by luac - if I run the same test with a source script rather
than a compiled script the fatal crash is not triggered. I think the lua
code essentially opens the script file, sniffs for a magic number to
check if it is a binary script, and if so reopens the file. I think it
is this act of reopening the file that ultimately triggers the bug.

There is a long thread on github with my entire history of investigating
this issue: https://github.com/caprica/vlcj/issues/62

I am reporting this as an Ubuntu bug rather than a JVM or lua bug
because if I remove the lua package provided by Ubuntu and instead build
lua myself using the vanilla untouched 5.1 source code from lua.org, my
test case does in fact work on 32-bit Ubuntu.

cat /etc/issue
Ubuntu 12.04.2 LTS

uname -a
Linux Ubuntu32 3.2.0-38-generic #61-Ubuntu SMP Tue Feb 19 12:20:02 UTC 2013 
i686 i686 i386 GNU/Linux

lsb_release -rd
Description:    Ubuntu 12.04.2 LTS
Release:        12.04

apt-cache policy liblua5.1-0-dev
liblua5.1-0-dev:
  Installed: 5.1.4-12ubuntu1
  Candidate: 5.1.4-12ubuntu1
  Version table:
 *** 5.1.4-12ubuntu1 0
        500 http://gb.archive.ubuntu.com/ubuntu/ precise/main i386 Packages
        100 /var/lib/dpkg/status

** Affects: lua5.1 (Ubuntu)
     Importance: Undecided
         Status: New

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1136432

Title:
  luaL_loadfile segfault in _IO_file_underflow

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/lua5.1/+bug/1136432/+subscriptions

-- 
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

Reply via email to