Skip to content

Conversation

jhawthorn
Copy link
Member

@jhawthorn jhawthorn force-pushed the backport-3-2-hash_tombstone_corruption branch from c6344b3 to 0391939 Compare March 5, 2025 22:28
@hsbt
Copy link
Member

hsbt commented Mar 5, 2025

@jhawthorn Thanks, I will fix the current CI failure today.

@XrXr XrXr added the Backport label Mar 5, 2025
[Bug #21170]

st_table reserves -1 as a special hash value to indicate that an entry
has been deleted. So that that's a valid value to be returned from the
hash function, do_hash replaces -1 with 0 so that it is not mistaken for
the sentinel.

Previously, when upgrading an AR table to an ST table,
rb_st_add_direct_with_hash was used which did not perform the same
conversion, this could lead to a hash in a broken state where one if its
entries which was supposed to exist being marked as a tombstone.

The hash could then become further corrupted when the ST table required
resizing as the falsely tombstoned entry would be skipped but it would
be counted in num entries, leading to an uninitialized entry at index
15.

In most cases this will be really rare, unless using a very poorly
implemented custom hash function.

This also adds two debug assertions, one that st_add_direct_with_hash
does not receive the reserved hash value, and a second in
rebuild_table_with, which ensures that after we rebuild/compact a table
it contains the expected number of elements.

Co-authored-by: Alan Wu <alanwu@ruby-lang.org>
@hsbt hsbt force-pushed the backport-3-2-hash_tombstone_corruption branch from 0391939 to 5e69c1a Compare March 6, 2025 00:52
@hsbt hsbt merged commit bb6b3c9 into ruby:ruby_3_2 Mar 6, 2025
74 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants