From c9cc9bcb419bed158dd6baf2f5a98fa1b616b8c7 Mon Sep 17 00:00:00 2001
From: JianFeeeee <root@qq.com>
Date: Tue, 25 Aug 2026 12:01:10 +0800
Subject: [PATCH] =?UTF-8?q?fix:=20=E4=BF=AE=E5=A4=8D=20unload=5Flib/clean?=
 =?UTF-8?q?=20=E7=9A=84=20lua=5Fremove=20=E6=A0=88=E7=B4=A2=E5=BC=95?=
 =?UTF-8?q?=E8=B6=8A=E7=95=8C(=E8=87=AA=20LuaJIT=20=E5=88=86=E6=94=AF?=
 =?UTF-8?q?=E5=9B=9E=E7=A7=BB)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 lib/lua_runner.cpp | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/lib/lua_runner.cpp b/lib/lua_runner.cpp
index cef63a5..fe5f5c7 100755
--- a/lib/lua_runner.cpp
+++ b/lib/lua_runner.cpp
@@ -141,7 +141,7 @@ int Lua_runner::unload_lib(const char *name)
     {
         return -1;
     }
-    lua_remove(this->L,this->pkgs[sig].ref);
+    lua_remove(this->L,this->pkgs[sig].ref - 1);  // ref = gettop+1, 故用 ref-1 定位实际栈位置
     for(int j = sig+1;j<this->pkg_cont;j++)
     {
         this->pkgs[j-1] = this->pkgs[j];//保持数据结构
@@ -167,10 +167,8 @@ int Lua_runner::clean()//进行新一轮调用前一定要先clean清除上个
     
     luaL_dostring(this->L, clean_globals_code);//清空全局变量
     luaL_dostring(this->L, "package.loaded = {}");//清空当前引用的包
-    for(int i = 0 ;i<this->pkg_cont;i++)
-    {
-        lua_remove(this->L,this->pkgs[i].ref);
-    }
+    // 注: 原先此处有逐个 lua_remove(pkgs[i].ref) 的循环，但 ref=gettop+1 恒越界且多次移除后索引偏移，
+    // 实为死代码；末尾 lua_settop(L,0) 已完整清栈（LuaJIT 下越界 remove 会损坏内存导致崩溃，故删除）
     this->pkg_cont = 0;
     // 清理预加载函数
     for(int i = 0; i < this->func_cont; i++)