569bc3c9
fix(wire): cap the Lua-number varint fast path at 2^51 (x86_64 corruption)
encode_varint had a fast path for Lua numbers in [2^28, 2^53) that emitted each byte via bit.band(n, 0x7f) / math.floor(n / 128). bit.band routes through LuaJIT's number->int32 conversion, which on x86_64 uses the magic-number trick (add 2^52 + 2^51, read the low bits). That is exact only while n + 2^52 + 2^51 < 2^53, i.e. n < 2^51; above it the addition rounds to an even double and silently drops low bits, corrupting the varint. arm64 LuaJIT uses an exact FP->int instruction, so the bug was invisible on Apple-Silicon dev machines and only surfaced on x86_64 (a 64-bit lease ID in tarantool-etcd round-tripped 3041234677171912 -> 3041234677171940 over gRPC, breaking lease lookups). Cap the fast path at 2^51; values in [2^51, 2^53) now fall through to the exact uint64 cdata loop. Adds test/wire_varint_test.lua pinning the round-trip at the boundaries.
Eugene Blikh <bigbes@gmail.com> — 2026-05-20 15:01:24 UTC
Commit 569bc3c9cbe68a88b744f3dd789421817fc6eeb0 —
view raw patch
Parent(s):
89e781b0
| File | Status | + | − |
|---|---|---|---|
runtime/pb/wire.lua
|
M | +14 | -6 |
test/wire_varint_test.lua
|
A | +49 |