#1150883 luabind: object_rep buffer over-aligned for lua_newuserdata memory, tests segfault with LTO

Package:
src:luabind
Source:
src:luabind
Submitter:
Sebastien Bacher
Date:
2026-10-14 09:11:07 UTC
Severity:
normal
Tags:
#1150883#5
Date:
2026-10-14 09:08:52 UTC
From:
To:
luabind 1.1.1-1 fails to build in Ubuntu on amd64: tests in
the static build segfault. Ubuntu builds with -flto=auto. The bug itself
is in the code, and Debian only escapes it because it doesn't build with
LTO.

object_rep is placement-new'ed into memory from lua_newuserdata()
(src/object_rep.cpp, push_new_instance()). That memory is only aligned
like LUAI_USER_ALIGNMENT_T (double/void*/long), i.e. 8 bytes. object_rep
starts with

    boost::aligned_storage<instance_buffer_size> m_instance_buffer;

which requires alignof(max_align_t), i.e. 16 on x86_64. With LTO, GCC 15
inlines the object_rep constructor into push_new_instance() and
initialises m_instance/m_classrep with an aligned 16-byte store:

    movaps %xmm0,0x20(%rax)    ; rax = 0x...558 from lua_newuserdata()

That faults on x86. arm64 also uses LTO in Ubuntu but tolerates the
misaligned store.

The same bug was reported and fixed in the Oberon00 luabind fork:
https://github.com/Oberon00/luabind/issues/42
https://github.com/Oberon00/luabind/pull/50

https://github.com/Oberon00/luabind/commit/49814f6b47ed99e273edc5198a6ebd7fa19e813a

The attached patch is a cherry-pick of that commit. It declares the
buffer with lua_newuserdata()'s alignment. With it, Ubuntu's LTO build
passes tests in both the static and shared builds. We are carrying
it in Ubuntu as 1.1.1-1ubuntu1 (LP: #2170791).

Cheers,
Sebastien