Fix stack underflow in thread event callbacks

Introduce a new guard to reject resuming/resetting active thread from within it's own
callback. Before it was possible to mutate the thread stack and making xmove to move
more values than remain on the thread stack.

Author: khvzak

src/state.rs

@@ -889,6 +889,9 @@ impl Lua {
     /// Only one callback can be registered at a time. Calling this again replaces the previous
     /// callback and its triggers.
     ///
+    /// If the callback returns an error, it's propagated out of the operation that triggered the
+    /// event. For a [`ThreadEvent::Yield`], the yielded values are discarded.
+    ///
     /// # Example
     ///
     /// Subscribe only to yield events:
@@ -949,17 +952,18 @@ impl Lua {
         }
 
         let extra = ExtraData::get(child);
-        if !(*extra).thread_triggers.on_create {
+        if !(*extra).thread_triggers.on_create || !(*extra).thread_event_state.is_null() {
             return;
         }
         let callback = match &(*extra).thread_event_callback {
-            Some(cb) if XRc::strong_count(cb) == 1 => cb.clone(),
+            Some(cb) => cb.clone(),
             _ => return,
         };
         ffi::lua_pushthread(child);
         ffi::lua_xmove(child, (*extra).ref_thread, 1);
         let thread = Thread((*extra).raw_lua().pop_ref_thread(), child);
         callback_error_ext(parent, extra, false, move |extra, _| {
+            let _guard = crate::thread::ThreadEventGuard::new((*extra).raw_lua(), child);
             callback((*extra).lua(), ThreadEvent::Create(thread))
         })
     }

src/state/extra.rs

@@ -87,6 +87,7 @@ pub(crate) struct ExtraData {
     pub(super) interrupt_callback: Option<crate::types::InterruptCallback>,
     pub(super) thread_triggers: ThreadTriggers,
     pub(super) thread_event_callback: Option<ThreadEventCallback>,
+    pub(super) thread_event_state: *mut ffi::lua_State,
 
     #[cfg(feature = "luau")]
     pub(crate) running_gc: bool,
@@ -192,6 +193,7 @@ impl ExtraData {
             interrupt_callback: None,
             thread_triggers: ThreadTriggers::default(),
             thread_event_callback: None,
+            thread_event_state: ptr::null_mut(),
             #[cfg(feature = "luau")]
             sandboxed: false,
             #[cfg(feature = "luau")]

src/state/raw.rs

@@ -659,12 +659,10 @@ impl RawLua {
 
         // Exec creation callback for non-Luau (Luau handles this via `userthread_proc`)
         #[cfg(not(feature = "luau"))]
-        if self.thread_event_triggers().on_create {
+        if self.thread_event_triggers().on_create && self.thread_event_state().is_null() {
             let extra = self.extra.get();
-            if let Some(ref cb) = (*extra).thread_event_callback
-                && XRc::strong_count(cb) == 1
-            {
-                let cb = cb.clone();
+            if let Some(cb) = (*extra).thread_event_callback.clone() {
+                let _guard = crate::thread::ThreadEventGuard::new(self, thread_state);
                 cb((*extra).lua(), crate::thread::ThreadEvent::Create(thread.clone()))?;
             }
         }
@@ -732,6 +730,16 @@ impl RawLua {
         (*self.extra.get()).thread_event_callback.clone()
     }
 
+    #[inline(always)]
+    pub(crate) unsafe fn thread_event_state(&self) -> *mut ffi::lua_State {
+        (*self.extra.get()).thread_event_state
+    }
+
+    #[inline(always)]
+    pub(crate) unsafe fn set_thread_event_state(&self, state: *mut ffi::lua_State) {
+        (*self.extra.get()).thread_event_state = state;
+    }
+
     /// Pushes a primitive type value onto the Lua stack.
     pub(crate) unsafe fn push_primitive_type<T: LuaType>(&self) -> bool {
         match T::TYPE_ID {