string.find returns random values

Under some circumstances string.find returns random values from memory. I managed to create a short script to reproduce this issue.

Script:

jit.opt.start("hotloop=1")

local iteration = 0
local function test(value)
  iteration = iteration + 1
  --print("a") -- printing fixes wrong behavior
  local pos_c = string.find(value, "c", 1, true)
  --assert(pos_c == 3, "pos=" .. pos_c)
  --pos_c = 3 -- use of constant fixes wrong behavior
  local value2 = string.sub(value, 1, pos_c - 1)
  local pos_b = string.find(value2, "b", 2, true)
  assert(pos_b == 2, "dot1=" .. pos_b)
end

local function test_loop()
  for _ = 1, 20 do
    test("abc")
  end
end

test("abc")

local _, err = pcall(test_loop)
print(iteration)
print(err or "ok")

Results of running this script via luajit program on various environments:

• Docker: openresty/openresty:1.13.6.2-xenial

  4
  test.lua:12: dot1=2442
  

• Docker: openresty/openresty:1.15.8.1rc1-0-bionic

  4
  test.lua:12: dot1=-614
  

• real system: custom build of OpenResty 1.13.6.2

  4
  lua-bug.lua:12: dot1=2442
  

Results are somewhat random when run in OpenResty, but are 100% reproducible when run from commandline. Looks like compilation breaks something.

Start by running the provided reproduction script with the luajit program and compare the reported string.find results with the expected positions. Investigate the JIT compilation path exercised by jit.opt.start("hotloop=1"), then verify that the script completes without the assertion failure across the reported environments.