Heap use-after-free in gc_mark_children

[clayton-shopify]

The following input demonstrates a crash:

class NoMethodError
    def initialize(a,b,c)
        super&0 
        ensure e
    end
end

a

ASAN report:

==25264==ERROR: AddressSanitizer: heap-use-after-free on address 0x62500000b1e8 at pc 0x000105a0a278 bp 0x7fff5a158430 sp 0x7fff5a158428
READ of size 4 at 0x62500000b1e8 thread T0
    #0 0x105a0a277 in gc_mark_children gc.c:655
    #1 0x105a092ff in gc_gray_mark gc.c:896
    #2 0x105a074e6 in incremental_marking_phase gc.c:991
    #3 0x105a06653 in incremental_gc gc.c:1095
    #4 0x105a0264c in incremental_gc_step gc.c:1130
    #5 0x105a0185c in mrb_incremental_gc gc.c:1174
    #6 0x105a011c8 in mrb_obj_alloc gc.c:508
    #7 0x1059c04e1 in mrb_instance_alloc (mruby:x86_64+0x1000404e1)
    #8 0x1059c09b3 in mrb_obj_new (mruby:x86_64+0x1000409b3)
    #9 0x1059e588d in mrb_exc_new_str (mruby:x86_64+0x10006588d)
    #10 0x105b1a034 in argnum_error (mruby:x86_64+0x10019a034)
    #11 0x105afa583 in mrb_vm_exec (mruby:x86_64+0x10017a583)
    #12 0x105ae7acf in mrb_vm_run (mruby:x86_64+0x100167acf)
    #13 0x105adfa1e in mrb_run (mruby:x86_64+0x10015fa1e)
    #14 0x105add3a4 in mrb_funcall_with_block (mruby:x86_64+0x10015d3a4)
    #15 0x105ad9f77 in mrb_funcall_argv (mruby:x86_64+0x100159f77)
    #16 0x1059c0ca5 in mrb_obj_new (mruby:x86_64+0x100040ca5)
    #17 0x1059eedc5 in mrb_no_method_error (mruby:x86_64+0x10006edc5)
    #18 0x105a2b06e in mrb_method_missing (mruby:x86_64+0x1000ab06e)
    #19 0x105af1c04 in mrb_vm_exec (mruby:x86_64+0x100171c04)
    #20 0x105ae7acf in mrb_vm_run (mruby:x86_64+0x100167acf)
    #21 0x105adfa1e in mrb_run (mruby:x86_64+0x10015fa1e)
    #22 0x105b18b9a in ecall (mruby:x86_64+0x100198b9a)
    #23 0x105afcfdc in mrb_vm_exec (mruby:x86_64+0x10017cfdc)
    #24 0x105ae7acf in mrb_vm_run (mruby:x86_64+0x100167acf)
    #25 0x105adfa1e in mrb_run (mruby:x86_64+0x10015fa1e)
    #26 0x105add3a4 in mrb_funcall_with_block (mruby:x86_64+0x10015d3a4)
    #27 0x105ad9f77 in mrb_funcall_argv (mruby:x86_64+0x100159f77)
    #28 0x1059c0ca5 in mrb_obj_new (mruby:x86_64+0x100040ca5)
    #29 0x1059eedc5 in mrb_no_method_error (mruby:x86_64+0x10006edc5)
    #30 0x105a2b06e in mrb_method_missing (mruby:x86_64+0x1000ab06e)
    #31 0x105af1c04 in mrb_vm_exec (mruby:x86_64+0x100171c04)
    #32 0x105ae7acf in mrb_vm_run (mruby:x86_64+0x100167acf)
    #33 0x105adfa1e in mrb_run (mruby:x86_64+0x10015fa1e)
    #34 0x105b18b9a in ecall (mruby:x86_64+0x100198b9a)
    #35 0x105afcfdc in mrb_vm_exec (mruby:x86_64+0x10017cfdc)
    #36 0x105ae7acf in mrb_vm_run (mruby:x86_64+0x100167acf)
    #37 0x105adfa1e in mrb_run (mruby:x86_64+0x10015fa1e)
    #38 0x105add3a4 in mrb_funcall_with_block (mruby:x86_64+0x10015d3a4)
    #39 0x105ad9f77 in mrb_funcall_argv (mruby:x86_64+0x100159f77)
    #40 0x1059c0ca5 in mrb_obj_new (mruby:x86_64+0x100040ca5)
    #41 0x1059eedc5 in mrb_no_method_error (mruby:x86_64+0x10006edc5)
    #42 0x105a2b06e in mrb_method_missing (mruby:x86_64+0x1000ab06e)
    #43 0x105af1c04 in mrb_vm_exec (mruby:x86_64+0x100171c04)
    #44 0x105ae7acf in mrb_vm_run (mruby:x86_64+0x100167acf)
    #45 0x105adfa1e in mrb_run (mruby:x86_64+0x10015fa1e)
    #46 0x105b18b9a in ecall (mruby:x86_64+0x100198b9a)
    #47 0x105afcfdc in mrb_vm_exec (mruby:x86_64+0x10017cfdc)
    #48 0x105ae7acf in mrb_vm_run (mruby:x86_64+0x100167acf)
    #49 0x105adfa1e in mrb_run (mruby:x86_64+0x10015fa1e)
    #50 0x105add3a4 in mrb_funcall_with_block (mruby:x86_64+0x10015d3a4)
    #51 0x105ad9f77 in mrb_funcall_argv (mruby:x86_64+0x100159f77)
    #52 0x1059c0ca5 in mrb_obj_new (mruby:x86_64+0x100040ca5)
    #53 0x1059eedc5 in mrb_no_method_error (mruby:x86_64+0x10006edc5)
    #54 0x105a2b06e in mrb_method_missing (mruby:x86_64+0x1000ab06e)
    #55 0x105af1c04 in mrb_vm_exec (mruby:x86_64+0x100171c04)
    #56 0x105ae7acf in mrb_vm_run (mruby:x86_64+0x100167acf)
    #57 0x105adfa1e in mrb_run (mruby:x86_64+0x10015fa1e)
    #58 0x105b18b9a in ecall (mruby:x86_64+0x100198b9a)
    #59 0x105afcfdc in mrb_vm_exec (mruby:x86_64+0x10017cfdc)
    #60 0x105ae7acf in mrb_vm_run (mruby:x86_64+0x100167acf)
    #61 0x105adfa1e in mrb_run (mruby:x86_64+0x10015fa1e)
    #62 0x105add3a4 in mrb_funcall_with_block (mruby:x86_64+0x10015d3a4)
    #63 0x105ad9f77 in mrb_funcall_argv (mruby:x86_64+0x100159f77)
    #64 0x1059c0ca5 in mrb_obj_new (mruby:x86_64+0x100040ca5)
    #65 0x1059eedc5 in mrb_no_method_error (mruby:x86_64+0x10006edc5)
    #66 0x105a2b06e in mrb_method_missing (mruby:x86_64+0x1000ab06e)
    #67 0x105af1c04 in mrb_vm_exec (mruby:x86_64+0x100171c04)
    #68 0x105ae7acf in mrb_vm_run (mruby:x86_64+0x100167acf)
    #69 0x105adfa1e in mrb_run (mruby:x86_64+0x10015fa1e)
    #70 0x105b18b9a in ecall (mruby:x86_64+0x100198b9a)
    #71 0x105afcfdc in mrb_vm_exec (mruby:x86_64+0x10017cfdc)
    #72 0x105ae7acf in mrb_vm_run (mruby:x86_64+0x100167acf)
    #73 0x105adfa1e in mrb_run (mruby:x86_64+0x10015fa1e)
    #74 0x105add3a4 in mrb_funcall_with_block (mruby:x86_64+0x10015d3a4)
    #75 0x105ad9f77 in mrb_funcall_argv (mruby:x86_64+0x100159f77)
    #76 0x1059c0ca5 in mrb_obj_new (mruby:x86_64+0x100040ca5)
    #77 0x1059eedc5 in mrb_no_method_error (mruby:x86_64+0x10006edc5)
    #78 0x105a2b06e in mrb_method_missing (mruby:x86_64+0x1000ab06e)
    #79 0x105af1c04 in mrb_vm_exec (mruby:x86_64+0x100171c04)
    #80 0x105ae7acf in mrb_vm_run (mruby:x86_64+0x100167acf)
    #81 0x105adfa1e in mrb_run (mruby:x86_64+0x10015fa1e)
    #82 0x105b18b9a in ecall (mruby:x86_64+0x100198b9a)
    #83 0x105afcfdc in mrb_vm_exec (mruby:x86_64+0x10017cfdc)
    #84 0x105ae7acf in mrb_vm_run (mruby:x86_64+0x100167acf)
    #85 0x105adfa1e in mrb_run (mruby:x86_64+0x10015fa1e)
    #86 0x105add3a4 in mrb_funcall_with_block (mruby:x86_64+0x10015d3a4)
    #87 0x105ad9f77 in mrb_funcall_argv (mruby:x86_64+0x100159f77)
    #88 0x1059c0ca5 in mrb_obj_new (mruby:x86_64+0x100040ca5)
    #89 0x1059eedc5 in mrb_no_method_error (mruby:x86_64+0x10006edc5)
    #90 0x105a2b06e in mrb_method_missing (mruby:x86_64+0x1000ab06e)
    #91 0x105af1c04 in mrb_vm_exec (mruby:x86_64+0x100171c04)
    #92 0x105ae7acf in mrb_vm_run (mruby:x86_64+0x100167acf)
    #93 0x105adfa1e in mrb_run (mruby:x86_64+0x10015fa1e)
    #94 0x105b18b9a in ecall (mruby:x86_64+0x100198b9a)
    #95 0x105afcfdc in mrb_vm_exec (mruby:x86_64+0x10017cfdc)
    #96 0x105ae7acf in mrb_vm_run (mruby:x86_64+0x100167acf)
    #97 0x105adfa1e in mrb_run (mruby:x86_64+0x10015fa1e)
    #98 0x105add3a4 in mrb_funcall_with_block (mruby:x86_64+0x10015d3a4)
    #99 0x105ad9f77 in mrb_funcall_argv (mruby:x86_64+0x100159f77)
    #100 0x1059c0ca5 in mrb_obj_new (mruby:x86_64+0x100040ca5)
    #101 0x1059eedc5 in mrb_no_method_error (mruby:x86_64+0x10006edc5)
    #102 0x105a2b06e in mrb_method_missing (mruby:x86_64+0x1000ab06e)
    #103 0x105af1c04 in mrb_vm_exec (mruby:x86_64+0x100171c04)
    #104 0x105ae7acf in mrb_vm_run (mruby:x86_64+0x100167acf)
    #105 0x105adfa1e in mrb_run (mruby:x86_64+0x10015fa1e)
    #106 0x105b18b9a in ecall (mruby:x86_64+0x100198b9a)
    #107 0x105afcfdc in mrb_vm_exec (mruby:x86_64+0x10017cfdc)
    #108 0x105ae7acf in mrb_vm_run (mruby:x86_64+0x100167acf)
    #109 0x105adfa1e in mrb_run (mruby:x86_64+0x10015fa1e)
    #110 0x105add3a4 in mrb_funcall_with_block (mruby:x86_64+0x10015d3a4)
    #111 0x105ad9f77 in mrb_funcall_argv (mruby:x86_64+0x100159f77)
    #112 0x1059c0ca5 in mrb_obj_new (mruby:x86_64+0x100040ca5)
    #113 0x1059eedc5 in mrb_no_method_error (mruby:x86_64+0x10006edc5)
    #114 0x105a2b06e in mrb_method_missing (mruby:x86_64+0x1000ab06e)
    #115 0x105af1c04 in mrb_vm_exec (mruby:x86_64+0x100171c04)
    #116 0x105ae7acf in mrb_vm_run (mruby:x86_64+0x100167acf)
    #117 0x105adfa1e in mrb_run (mruby:x86_64+0x10015fa1e)
    #118 0x105b18b9a in ecall (mruby:x86_64+0x100198b9a)
    #119 0x105afcfdc in mrb_vm_exec (mruby:x86_64+0x10017cfdc)
    #120 0x105ae7acf in mrb_vm_run (mruby:x86_64+0x100167acf)
    #121 0x105adfa1e in mrb_run (mruby:x86_64+0x10015fa1e)
    #122 0x105add3a4 in mrb_funcall_with_block (mruby:x86_64+0x10015d3a4)
    #123 0x105ad9f77 in mrb_funcall_argv (mruby:x86_64+0x100159f77)
    #124 0x1059c0ca5 in mrb_obj_new (mruby:x86_64+0x100040ca5)
    #125 0x1059eedc5 in mrb_no_method_error (mruby:x86_64+0x10006edc5)
    #126 0x105a2b06e in mrb_method_missing (mruby:x86_64+0x1000ab06e)
    #127 0x105af1c04 in mrb_vm_exec (mruby:x86_64+0x100171c04)
    #128 0x105ae7acf in mrb_vm_run (mruby:x86_64+0x100167acf)
    #129 0x105adfa1e in mrb_run (mruby:x86_64+0x10015fa1e)
    #130 0x105b18b9a in ecall (mruby:x86_64+0x100198b9a)
    #131 0x105afcfdc in mrb_vm_exec (mruby:x86_64+0x10017cfdc)
    #132 0x105ae7acf in mrb_vm_run (mruby:x86_64+0x100167acf)
    #133 0x105adfa1e in mrb_run (mruby:x86_64+0x10015fa1e)
    #134 0x105add3a4 in mrb_funcall_with_block (mruby:x86_64+0x10015d3a4)
    #135 0x105ad9f77 in mrb_funcall_argv (mruby:x86_64+0x100159f77)
    #136 0x1059c0ca5 in mrb_obj_new (mruby:x86_64+0x100040ca5)
    #137 0x1059eedc5 in mrb_no_method_error (mruby:x86_64+0x10006edc5)
    #138 0x105a2b06e in mrb_method_missing (mruby:x86_64+0x1000ab06e)
    #139 0x105af1c04 in mrb_vm_exec (mruby:x86_64+0x100171c04)
    #140 0x105ae7acf in mrb_vm_run (mruby:x86_64+0x100167acf)
    #141 0x105adfa1e in mrb_run (mruby:x86_64+0x10015fa1e)
    #142 0x105b18b9a in ecall (mruby:x86_64+0x100198b9a)
    #143 0x105afcfdc in mrb_vm_exec (mruby:x86_64+0x10017cfdc)
    #144 0x105ae7acf in mrb_vm_run (mruby:x86_64+0x100167acf)
    #145 0x105adfa1e in mrb_run (mruby:x86_64+0x10015fa1e)
    #146 0x105add3a4 in mrb_funcall_with_block (mruby:x86_64+0x10015d3a4)
    #147 0x105ad9f77 in mrb_funcall_argv (mruby:x86_64+0x100159f77)
    #148 0x1059c0ca5 in mrb_obj_new (mruby:x86_64+0x100040ca5)
    #149 0x1059eedc5 in mrb_no_method_error (mruby:x86_64+0x10006edc5)
    #150 0x105a2b06e in mrb_method_missing (mruby:x86_64+0x1000ab06e)
    #151 0x105af1c04 in mrb_vm_exec (mruby:x86_64+0x100171c04)
    #152 0x105ae7acf in mrb_vm_run (mruby:x86_64+0x100167acf)
    #153 0x105adfa1e in mrb_run (mruby:x86_64+0x10015fa1e)
    #154 0x105b18b9a in ecall (mruby:x86_64+0x100198b9a)
    #155 0x105afcfdc in mrb_vm_exec (mruby:x86_64+0x10017cfdc)
    #156 0x105ae7acf in mrb_vm_run (mruby:x86_64+0x100167acf)
    #157 0x105adfa1e in mrb_run (mruby:x86_64+0x10015fa1e)
    #158 0x105add3a4 in mrb_funcall_with_block (mruby:x86_64+0x10015d3a4)
    #159 0x105ad9f77 in mrb_funcall_argv (mruby:x86_64+0x100159f77)
    #160 0x1059c0ca5 in mrb_obj_new (mruby:x86_64+0x100040ca5)
    #161 0x1059eedc5 in mrb_no_method_error (mruby:x86_64+0x10006edc5)
    #162 0x105a2b06e in mrb_method_missing (mruby:x86_64+0x1000ab06e)
    #163 0x105af1c04 in mrb_vm_exec (mruby:x86_64+0x100171c04)
    #164 0x105ae7acf in mrb_vm_run (mruby:x86_64+0x100167acf)
    #165 0x105adfa1e in mrb_run (mruby:x86_64+0x10015fa1e)
    #166 0x105b18b9a in ecall (mruby:x86_64+0x100198b9a)
    #167 0x105afcfdc in mrb_vm_exec (mruby:x86_64+0x10017cfdc)
    #168 0x105ae7acf in mrb_vm_run (mruby:x86_64+0x100167acf)
    #169 0x105adfa1e in mrb_run (mruby:x86_64+0x10015fa1e)
    #170 0x105add3a4 in mrb_funcall_with_block (mruby:x86_64+0x10015d3a4)
    #171 0x105ad9f77 in mrb_funcall_argv (mruby:x86_64+0x100159f77)
    #172 0x1059c0ca5 in mrb_obj_new (mruby:x86_64+0x100040ca5)
    #173 0x1059eedc5 in mrb_no_method_error (mruby:x86_64+0x10006edc5)
    #174 0x105a2b06e in mrb_method_missing (mruby:x86_64+0x1000ab06e)
    #175 0x105af1c04 in mrb_vm_exec (mruby:x86_64+0x100171c04)
    #176 0x105ae7acf in mrb_vm_run (mruby:x86_64+0x100167acf)
    #177 0x105adfa1e in mrb_run (mruby:x86_64+0x10015fa1e)
    #178 0x105b18b9a in ecall (mruby:x86_64+0x100198b9a)
    #179 0x105afcfdc in mrb_vm_exec (mruby:x86_64+0x10017cfdc)
    #180 0x105ae7acf in mrb_vm_run (mruby:x86_64+0x100167acf)
    #181 0x105adfa1e in mrb_run (mruby:x86_64+0x10015fa1e)
    #182 0x105add3a4 in mrb_funcall_with_block (mruby:x86_64+0x10015d3a4)
    #183 0x105ad9f77 in mrb_funcall_argv (mruby:x86_64+0x100159f77)
    #184 0x1059c0ca5 in mrb_obj_new (mruby:x86_64+0x100040ca5)
    #185 0x1059eedc5 in mrb_no_method_error (mruby:x86_64+0x10006edc5)
    #186 0x105a2b06e in mrb_method_missing (mruby:x86_64+0x1000ab06e)
    #187 0x105af1c04 in mrb_vm_exec (mruby:x86_64+0x100171c04)
    #188 0x105ae7acf in mrb_vm_run (mruby:x86_64+0x100167acf)
    #189 0x105adfa1e in mrb_run (mruby:x86_64+0x10015fa1e)
    #190 0x105b18b9a in ecall (mruby:x86_64+0x100198b9a)
    #191 0x105afcfdc in mrb_vm_exec (mruby:x86_64+0x10017cfdc)
    #192 0x105ae7acf in mrb_vm_run (mruby:x86_64+0x100167acf)
    #193 0x105adfa1e in mrb_run (mruby:x86_64+0x10015fa1e)
    #194 0x105add3a4 in mrb_funcall_with_block (mruby:x86_64+0x10015d3a4)
    #195 0x105ad9f77 in mrb_funcall_argv (mruby:x86_64+0x100159f77)
    #196 0x1059c0ca5 in mrb_obj_new (mruby:x86_64+0x100040ca5)
    #197 0x1059eedc5 in mrb_no_method_error (mruby:x86_64+0x10006edc5)
    #198 0x105a2b06e in mrb_method_missing (mruby:x86_64+0x1000ab06e)
    #199 0x105af1c04 in mrb_vm_exec (mruby:x86_64+0x100171c04)
    #200 0x105ae7acf in mrb_vm_run (mruby:x86_64+0x100167acf)
    #201 0x105b1b759 in mrb_top_run (mruby:x86_64+0x10019b759)
    #202 0x105becb95 in mrb_load_exec (mruby:x86_64+0x10026cb95)
    #203 0x105bed4e5 in mrb_load_file_cxt (mruby:x86_64+0x10026d4e5)
    #204 0x105982be6 in main mruby.c:227
    #205 0x7fffbbbba234 in start (libdyld.dylib:x86_64+0x5234)

0x62500000b1e8 is located 4328 bytes inside of 9824-byte region [0x62500000a100,0x62500000c760)
freed by thread T0 here:
    #0 0x105d96520 in wrap_realloc (libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x56520)
    #1 0x105a7b8e5 in mrb_default_allocf (mruby:x86_64+0x1000fb8e5)
    #2 0x1059fc8e8 in mrb_realloc_simple gc.c:202
    #3 0x1059fcfce in mrb_realloc gc.c:216
    #4 0x105abb75f in sym_intern (mruby:x86_64+0x10013b75f)
    #5 0x105abbb19 in mrb_intern_static (mruby:x86_64+0x10013bb19)
    #6 0x105a40157 in read_irep_record_1 (mruby:x86_64+0x1000c0157)
    #7 0x105a3e1d4 in read_irep_record (mruby:x86_64+0x1000be1d4)
    #8 0x105a3e2bc in read_irep_record (mruby:x86_64+0x1000be2bc)
    #9 0x105a3d2e8 in read_section_irep (mruby:x86_64+0x1000bd2e8)
    #10 0x105a3a68b in read_irep (mruby:x86_64+0x1000ba68b)
    #11 0x105a3a2c4 in mrb_read_irep (mruby:x86_64+0x1000ba2c4)
    #12 0x105a3ab64 in mrb_load_irep_cxt (mruby:x86_64+0x1000bab64)
    #13 0x105a3bdaf in mrb_load_irep (mruby:x86_64+0x1000bbdaf)
    #14 0x105b8388f in GENERATED_TMP_mrb_mruby_object_ext_gem_init (mruby:x86_64+0x10020388f)
    #15 0x105c0c5d2 in mrb_init_mrbgems (mruby:x86_64+0x10028c5d2)
    #16 0x105a7ba71 in mrb_open_allocf (mruby:x86_64+0x1000fba71)
    #17 0x105a7ba17 in mrb_open (mruby:x86_64+0x1000fba17)
    #18 0x105981af8 in main mruby.c:171
    #19 0x7fffbbbba234 in start (libdyld.dylib:x86_64+0x5234)

previously allocated by thread T0 here:
    #0 0x105d96520 in wrap_realloc (libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x56520)
    #1 0x105a7b8e5 in mrb_default_allocf (mruby:x86_64+0x1000fb8e5)
    #2 0x1059fc8e8 in mrb_realloc_simple gc.c:202
    #3 0x1059fcfce in mrb_realloc gc.c:216
    #4 0x105abb75f in sym_intern (mruby:x86_64+0x10013b75f)
    #5 0x105abbb19 in mrb_intern_static (mruby:x86_64+0x10013bb19)
    #6 0x105b5a1c4 in mrb_mruby_string_ext_gem_init (mruby:x86_64+0x1001da1c4)
    #7 0x105b6694f in GENERATED_TMP_mrb_mruby_string_ext_gem_init (mruby:x86_64+0x1001e694f)
    #8 0x105c0c58a in mrb_init_mrbgems (mruby:x86_64+0x10028c58a)
    #9 0x105a7ba71 in mrb_open_allocf (mruby:x86_64+0x1000fba71)
    #10 0x105a7ba17 in mrb_open (mruby:x86_64+0x1000fba17)
    #11 0x105981af8 in main mruby.c:171
    #12 0x7fffbbbba234 in start (libdyld.dylib:x86_64+0x5234)

SUMMARY: AddressSanitizer: heap-use-after-free gc.c:655 in gc_mark_children
Shadow bytes around the buggy address:
  0x1c4a000015e0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x1c4a000015f0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x1c4a00001600: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x1c4a00001610: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x1c4a00001620: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x1c4a00001630: fd fd fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd
  0x1c4a00001640: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x1c4a00001650: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x1c4a00001660: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x1c4a00001670: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x1c4a00001680: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==25264==ABORTING
Abort trap: 6

This issue was reported by Dinko Galetic & Denis Kasak (https://hackerone.com/dgaletic).

[clayton-shopify]

Just like #3549 (comment), this started crashing after e26e118 and was (mostly) fixed by cef523c, but now it overflows the C stack. Prior to e26e118 it exited cleanly with "stack level too deep".

[matz]

I have a different idea to fix the issue (deferring backtrace creation until error-printing). I'm working on it.

[clayton-shopify]

@matz I did a bisect and stack overflows started happening in 88cd807. The stack traces contain mrb_format so I suspect that commit is the cause.