luaV_concat: 'total' should not be used inside the loop

If there's a table in the concat sequence, we ended up with a toconcat
array with undefined slots.

2 files changed, 48 insertions, 4 deletions

diff --git a/src/lvm.js b/src/lvm.js
index d86b783..542dd61 100644
--- a/src/lvm.js
+++ b/src/lvm.js
@@ -973,14 +973,13 @@ const luaV_concat = function(L, total) {
             delete L.stack[top - 1];
         } else {
             /* at least two non-empty string values; get as many as possible */
-            let toconcat = new Array(total);
-            toconcat[total-1] = L.stack[top-1].svalue();
+            let concatenated = L.stack[top-1].svalue();
             delete L.stack[top - 1];
             for (n = 1; n < total && tostring(L, top - n - 1); n++) {
-                toconcat[total-n-1] = L.stack[top - n - 1].svalue();
+                concatenated = L.stack[top - n - 1].svalue().concat(concatenated);
                 delete L.stack[top - n - 1];
             }
-            let ts = lstring.luaS_bless(L, Array.prototype.concat.apply([], toconcat));
+            let ts = lstring.luaS_bless(L, concatenated);
             L.stack[top - n] = new lobject.TValue(CT.LUA_TLNGSTR, ts);
         }
         total -= n - 1; /* got 'n' strings to create 1 new */
diff --git a/tests/test-suite/events.js b/tests/test-suite/events.js
index 8aa7aa7..04b4b1a 100644
--- a/tests/test-suite/events.js
+++ b/tests/test-suite/events.js
@@ -428,3 +428,48 @@ test("[test-suite] events: __eq between userdata", function (t) {
     }, "Lua program ran without error");
 
 });
+
+
+test("[test-suite] events: concat", function (t) {
+    let luaCode = `
+        t = {}
+
+        t.__concat = function (a,b,c)
+          assert(c == nil)
+          if type(a) == 'table' then a = a.val end
+          if type(b) == 'table' then b = b.val end
+          if A then return a..b
+          else
+            return setmetatable({val=a..b}, t)
+          end
+        end
+
+        c = {val="c"}; setmetatable(c, t)
+        d = {val="d"}; setmetatable(d, t)
+
+        A = true
+        assert(c..d == 'cd')
+        assert(0 .."a".."b"..c..d.."e".."f"..(5+3).."g" == "0abcdef8g")
+    `, L;
+    
+    t.plan(2);
+
+    t.doesNotThrow(function () {
+
+        L = lauxlib.luaL_newstate();
+
+        lualib.luaL_openlibs(L);
+
+        ltests.luaopen_tests(L);
+
+        lauxlib.luaL_loadstring(L, lua.to_luastring(luaCode));
+
+    }, "Lua program loaded without error");
+
+    t.doesNotThrow(function () {
+
+        lua.lua_call(L, 0, -1);
+
+    }, "Lua program ran without error");
+
+});