UB Sanitizer warning about out-of-bonds access in snap_restoredata

[Buristan]

If build LuaJIT with UB finalizer checks enabled:

make -j CCDEBUG=" -g -ggdb3" CFLAGS=" -O0" TARGET_CFLAGS="-fsanitize=bounds" TARGET_LDFLAGS="-fsanitize=bounds" XCFLAGS=" -DLUA_USE_APICHECK -DLUA_USE_ASSERT "

The following snippet produces the out-of-bounds warning:

src/luajit -Ohotloop=1 -Ohotexit=1 -e '
local ffi = require("ffi")
local tp = ffi.typeof("double")
local x = 1LL
for _ = 1, 5 do x = tp(x + 1) end
'
lj_snap.c:804:32: runtime error: index 23 out of bounds for type 'intptr_t [16]'

Due to indexing ex->gpr with a fpr register, which number is >= RID_MAX_GPR.
The situation itself is harmless since this is read from spill[256] array and is rewritten in the next if branch. Nevertheless, this is a little bit nasty, and the fix looks simple:

diff --git a/src/lj_snap.c b/src/lj_snap.c
index f3645e87..6fda08ba 100644
--- a/src/lj_snap.c
+++ b/src/lj_snap.c
@@ -801,7 +801,6 @@ static void snap_restoredata(jit_State *J, GCtrace *T, ExitState *ex,
         *(lua_Number *)dst = (lua_Number)*(int32_t *)dst;
         return;
       }
-      src = (int32_t *)&ex->gpr[r-RID_MIN_GPR];
 #if !LJ_SOFTFP
       if (r >= RID_MAX_GPR) {
         src = (int32_t *)&ex->fpr[r-RID_MIN_FPR];
@@ -815,7 +814,10 @@ static void snap_restoredata(jit_State *J, GCtrace *T, ExitState *ex,
 #endif
       } else
 #endif
-      if (LJ_64 && LJ_BE && sz == 4) src++;
+      {
+	src = (int32_t *)&ex->gpr[r-RID_MIN_GPR];
+	if (LJ_64 && LJ_BE && sz == 4) src++;
+      }
     }
   }
   lj_assertJ(sz == 1 || sz == 2 || sz == 4 || sz == 8,

[MikePall]

Fixed. Thanks!