Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

strftime %v capitalized month abbreviation #18

Closed
wants to merge 1 commit into from
Closed

strftime %v capitalized month abbreviation #18

wants to merge 1 commit into from

Conversation

tinco
Copy link

@tinco tinco commented May 9, 2011

@shyouhei
Copy link
Member

It seems OK to me. I'm waiting confirmation from the library maintainer.

@nurse
Copy link
Member

nurse commented May 24, 2011

This patch is rejected by maintainer.

@nurse nurse closed this May 24, 2011
matzbot pushed a commit that referenced this pull request Jan 2, 2018
@shyouhei
fix SEGV touching uninitialized memory
6f0a45f 
This function can be called from rb_data_typed_object_zalloc().
No assumption can be made about object internals.

(lldb) run
Process 22135 launched: './miniruby' (x86_64)
Process 22135 stopped
* thread #1: tid = 0x14a3af, 0x000000010008ac8a miniruby`vm_block_type(block=0x0000000000000000) + 12 at vm_core.h:1364, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x18)
    frame #0: 0x000000010008ac8a miniruby`vm_block_type(block=0x0000000000000000) + 12 at vm_core.h:1364
   1361         break;
   1362     }
   1363 #endif
-> 1364     return block->type;
   1365 }
   1366
   1367 static inline void
(lldb) bt
* thread #1: tid = 0x14a3af, 0x000000010008ac8a miniruby`vm_block_type(block=0x0000000000000000) + 12 at vm_core.h:1364, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x18)
  * frame #0: 0x000000010008ac8a miniruby`vm_block_type(block=0x0000000000000000) + 12 at vm_core.h:1364
    frame #1: 0x000000010008acdb miniruby`vm_block_iseq(block=0x0000000000000000) + 24 at vm_core.h:1399
    frame #2: 0x000000010008acc1 miniruby`vm_proc_iseq(procval=4310866360) + 32 at vm_core.h:1387
    frame #3: 0x000000010009cbed miniruby`rb_raw_obj_info(buff="0x0000000100f299b8 [0    ] proc (Proc)", buff_size=256, obj=4310866360) + 1513 at gc.c:9349
    frame #4: 0x000000010009cf01 miniruby`obj_info(obj=4310866360) + 98 at gc.c:9428
    frame #5: 0x000000010008ca1b miniruby`newobj_init(klass=4311027960, flags=12, v1=4298186080, v2=1, v3=0, wb_protected=32, objspace=0x00000001007cf280, obj=4310866360) + 338 at gc.c:1887
    frame #6: 0x000000010008cce5 miniruby`newobj_of(klass=4311027960, flags=12, v1=4298186080, v2=1, v3=0, wb_protected=32) + 171 at gc.c:1970
    frame #7: 0x000000010008d01d miniruby`rb_data_typed_object_wrap(klass=4311027960, datap=0x0000000000000000, type=0x0000000100311d60) + 133 at gc.c:2062
    frame #8: 0x000000010008d04e miniruby`rb_data_typed_object_zalloc(klass=4311027960, size=40, type=0x0000000100311d60) + 42 at gc.c:2073
    frame #9: 0x000000010011b459 miniruby`rb_proc_alloc(klass=4311027960) + 36 at proc.c:113
    frame #10: 0x0000000100204d8e miniruby`vm_proc_create_from_captured(klass=4311027960, captured=0x00000001025003f8, block_type=block_type_iseq, is_from_method='\0', is_lambda='\x01') + 44 at vm.c:814
    frame #11: 0x00000001002050d8 miniruby`rb_vm_make_proc_lambda(ec=0x00000001007cf548, captured=0x00000001025003f8, klass=4311027960, is_lambda='\x01') + 134 at vm.c:892
    frame #12: 0x000000010011c0d2 miniruby`proc_new(klass=4311027960, is_lambda='\x01') + 445 at proc.c:752
    frame #13: 0x000000010011c154 miniruby`rb_block_lambda + 27 at proc.c:808
    frame #14: 0x00000001001ee7e3 miniruby`call_cfunc_0(func=(miniruby`rb_block_lambda at proc.c:807), recv=4310991600, argc=0, argv=0x0000000102400480) + 41 at vm_insnhelper.c:1729
    frame #15: 0x00000001001ef2c3 miniruby`vm_call_cfunc_with_frame(ec=0x00000001007cf548, reg_cfp=0x00000001025003e0, calling=0x00007fff5fbfd4d0, ci=0x0000000102537be0, cc=0x000000010253e0f0) + 386 at vm_insnhelper.c:1918
    frame #16: 0x00000001001ef412 miniruby`vm_call_cfunc(ec=0x00000001007cf548, reg_cfp=0x00000001025003e0, calling=0x00007fff5fbfd4d0, ci=0x0000000102537be0, cc=0x000000010253e0f0) + 149 at vm_insnhelper.c:1934
    frame #17: 0x00000001001f0655 miniruby`vm_call_method_each_type(ec=0x00000001007cf548, cfp=0x00000001025003e0, calling=0x00007fff5fbfd4d0, ci=0x0000000102537be0, cc=0x000000010253e0f0) + 239 at vm_insnhelper.c:2232
    frame #18: 0x00000001001f0ce0 miniruby`vm_call_method(ec=0x00000001007cf548, cfp=0x00000001025003e0, calling=0x00007fff5fbfd4d0, ci=0x0000000102537be0, cc=0x000000010253e0f0) + 117 at vm_insnhelper.c:2355
    frame #19: 0x00000001001f0eb6 miniruby`vm_call_general(ec=0x00000001007cf548, reg_cfp=0x00000001025003e0, calling=0x00007fff5fbfd4d0, ci=0x0000000102537be0, cc=0x000000010253e0f0) + 59 at vm_insnhelper.c:2398
    frame #20: 0x00000001001f6e61 miniruby`vm_exec_core(ec=0x00000001007cf548, initial=0) + 7480 at insns.def:850
    frame #21: 0x0000000100207995 miniruby`vm_exec(ec=0x00000001007cf548) + 230 at vm.c:1771
    frame #22: 0x0000000100208647 miniruby`rb_iseq_eval_main(iseq=0x0000000100f29fd0) + 52 at vm.c:2019
    frame #23: 0x000000010007b750 miniruby`ruby_exec_internal(n=0x0000000100f29fd0) + 297 at eval.c:246
    frame #24: 0x000000010007b876 miniruby`ruby_exec_node(n=0x0000000100f29fd0) + 36 at eval.c:310
    frame #25: 0x000000010007b849 miniruby`ruby_run_node(n=0x0000000100f29fd0) + 62 at eval.c:302
    frame #26: 0x0000000100000c05 miniruby`main(argc=2, argv=0x00007fff5fbfdbf0) + 113 at main.c:42
    frame #27: 0x00007fff88eda5ad libdyld.dylib`start + 1
(lldb)

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@61565 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
matzbot pushed a commit that referenced this pull request Jan 2, 2018
@shyouhei
fix SEGV touching uninitialized local variable
8941d4b 
This imemo_name is used uninitialized because the switch
above does not cover all possible imemo types.

(lldb) run
Process 26068 launched: './miniruby' (x86_64)
Process 26068 stopped
* thread #1: tid = 0x14ba96, 0x00007fff8a402132 libsystem_c.dylib`strlen + 18, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0xfffffffffffffff0)
    frame #0: 0x00007fff8a402132 libsystem_c.dylib`strlen + 18
libsystem_c.dylib`strlen:
->  0x7fff8a402132 <+18>: pcmpeqb (%rdi), %xmm0
    0x7fff8a402136 <+22>: pmovmskb %xmm0, %esi
    0x7fff8a40213a <+26>: andq   $0xf, %rcx
    0x7fff8a40213e <+30>: orq    $-0x1, %rax
(lldb) bt
* thread #1: tid = 0x14ba96, 0x00007fff8a402132 libsystem_c.dylib`strlen + 18, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0xfffffffffffffff0)
  * frame #0: 0x00007fff8a402132 libsystem_c.dylib`strlen + 18
    frame #1: 0x00000001001f1531 miniruby`BSD_vfprintf(fp=0x00007fff5fbfc9e0, fmt0="%s %s", ap=0x00007fff5fbfcbf0) + 5873 at vsnprintf.c:1026
    frame #2: 0x00000001001ef213 miniruby`ruby_do_vsnprintf(str="0x0000000100f46450 [0    ] T_IMEMO", n=256, fmt="%s %s", ap=0x00007fff5fbfcbf0) + 131 at sprintf.c:1285
    frame #3: 0x00000001001ef3ea miniruby`ruby_snprintf(str="0x0000000100f46450 [0    ] T_IMEMO", n=256, fmt="%s %s") + 426 at sprintf.c:1300
    frame #4: 0x00000001000bdc61 miniruby`rb_raw_obj_info(buff="0x0000000100f46450 [0    ] T_IMEMO", buff_size=256, obj=4310983760) + 2353 at gc.c:9376
    frame #5: 0x00000001000b7bff miniruby`obj_info(obj=4310983760) + 95 at gc.c:9428
    frame #6: 0x00000001000c1658 miniruby`newobj_init(klass=0, flags=36890, v1=0, v2=4303040512, v3=4310983800, wb_protected=1, objspace=0x00000001007ee280, obj=4310983760) + 424 at gc.c:1887
    frame #7: 0x00000001000b4469 miniruby`newobj_of(klass=0, flags=36890, v1=0, v2=4303040512, v3=4310983800, wb_protected=1) + 217 at gc.c:1970
    frame #8: 0x00000001000b45eb miniruby`rb_imemo_new(type=imemo_ast, v1=0, v2=4303040512, v3=4310983800, v0=0) + 75 at gc.c:2017
    frame #9: 0x000000010011daed miniruby`rb_ast_new + 61 at node.c:1146
    frame #10: 0x0000000100160e15 miniruby`rb_parser_compile_file_path(vparser=4310984400, fname=4310984960, file=4310984080, start=1) + 53 at parse.y:5776
    frame #11: 0x00000001001e18ea miniruby`load_file_internal(argp_v=140734799795024) + 1834 at ruby.c:1907
    frame #12: 0x00000001000a1bb5 miniruby`rb_ensure(b_proc=(miniruby`load_file_internal at ruby.c:1795), data1=140734799795024, e_proc=(miniruby`restore_load_file at ruby.c:2007), data2=140734799795024) + 245 at eval.c:1037
    frame #13: 0x00000001001df4a4 miniruby`load_file(parser=4310984400, fname=4310984960, f=4310984080, script=1, opt=0x00007fff5fbfda28) + 100 at ruby.c:2026
    frame #14: 0x00000001001e084e miniruby`process_options(argc=0, argv=0x00007fff5fbfdc00, opt=0x00007fff5fbfda28) + 3454 at ruby.c:1682
    frame #15: 0x00000001001dfaae miniruby`ruby_process_options(argc=2, argv=0x00007fff5fbfdbf0) + 238 at ruby.c:2257
    frame #16: 0x000000010009ff43 miniruby`ruby_options(argc=2, argv=0x00007fff5fbfdbf0) + 211 at eval.c:105
    frame #17: 0x0000000100000989 miniruby`main(argc=2, argv=0x00007fff5fbfdbf0) + 105 at main.c:42
    frame #18: 0x00007fff88eda5ad libdyld.dylib`start + 1
(lldb) up 4
frame #4: 0x00000001000bdc61 miniruby`rb_raw_obj_info(buff="0x0000000100f46450 [0    ] T_IMEMO", buff_size=256, obj=4310983760) + 2353 at gc.c:9376
   9373 #undef IMEMO_NAME
   9374               default: UNREACHABLE;
   9375             }
-> 9376             snprintf(buff, buff_size, "%s %s", buff, imemo_name);
   9377
   9378             switch (imemo_type(obj)) {
   9379               case imemo_ment: {
(lldb) p imemo_name
(const char *) $0 = 0xffffffffffffffff
(lldb) p imemo_type(obj)
(imemo_type) $1 = imemo_ast
(lldb)

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@61566 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
matzbot pushed a commit that referenced this pull request Jan 2, 2018
@shyouhei
fix SEGV inspecting already freed objects
d2bee86 
obj_info() assumes the given object is alive.  Passing freed
objects to it results in SEGV.

(lldb) run
Process 29718 launched: './miniruby' (x86_64)
Process 29718 stopped
* thread #1: tid = 0x3082c5, 0x00000001000bfaab miniruby`pathobj_path(pathobj=4478683640) + 70 at vm_core.h:269, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x0)
    frame #0: 0x00000001000bfaab miniruby`pathobj_path(pathobj=4478683640) + 70 at vm_core.h:269
   266      }
   267      else {
   268          VM_ASSERT(RB_TYPE_P(pathobj, T_ARRAY));
-> 269          return RARRAY_AREF(pathobj, PATHOBJ_PATH);
   270      }
   271  }
   272
(lldb) bt
* thread #1: tid = 0x3082c5, 0x00000001000bfaab miniruby`pathobj_path(pathobj=4478683640) + 70 at vm_core.h:269, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x0)
  * frame #0: 0x00000001000bfaab miniruby`pathobj_path(pathobj=4478683640) + 70 at vm_core.h:269
    frame #1: 0x00000001000c25ff miniruby`rb_iseq_path(iseq=0x000000010af34a20) + 32 at iseq.c:723
    frame #2: 0x000000010009db09 miniruby`rb_raw_iseq_info(buff="0x000000010af34a20 [1    ] T_IMEMO iseq", buff_size=256, iseq=0x000000010af34a20) + 69 at gc.c:9274
    frame #3: 0x000000010009e45a miniruby`rb_raw_obj_info(buff="0x000000010af34a20 [1    ] T_IMEMO iseq", buff_size=256, obj=4478683680) + 2191 at gc.c:9397
    frame #4: 0x000000010009e4d5 miniruby`obj_info(obj=4478683680) + 98 at gc.c:9429
    frame #5: 0x0000000100091ae3 miniruby`gc_page_sweep(objspace=0x00000001007d3280, heap=0x00000001007d32a0, sweep_page=0x000000010ae07bc0) + 622 at gc.c:3529
    frame #6: 0x000000010009206a miniruby`gc_sweep_step(objspace=0x00000001007d3280, heap=0x00000001007d32a0) + 188 at gc.c:3705
    frame #7: 0x0000000100092254 miniruby`gc_sweep_continue(objspace=0x00000001007d3280, heap=0x00000001007d32a0) + 133 at gc.c:3772
    frame #8: 0x000000010008d7f9 miniruby`heap_prepare(objspace=0x00000001007d3280, heap=0x00000001007d32a0) + 48 at gc.c:1746
    frame #9: 0x000000010008d8a1 miniruby`heap_get_freeobj_from_next_freepage(objspace=0x00000001007d3280, heap=0x00000001007d32a0) + 37 at gc.c:1769
    frame #10: 0x000000010008d98d miniruby`heap_get_freeobj(objspace=0x00000001007d3280, heap=0x00000001007d32a0) + 83 at gc.c:1803
    frame #11: 0x000000010008dcb0 miniruby`newobj_slowpath(klass=4334386280, flags=5, v1=0, v2=0, v3=0, objspace=0x00000001007d3280, wb_protected=1) + 220 at gc.c:1930
    frame #12: 0x000000010008dd6c miniruby`newobj_slowpath_wb_protected(klass=4334386280, flags=5, v1=0, v2=0, v3=0, objspace=0x00000001007d3280) + 76 at gc.c:1942
    frame #13: 0x000000010008dea1 miniruby`newobj_of(klass=4334386280, flags=5, v1=0, v2=0, v3=0, wb_protected=1) + 221 at gc.c:1974
    frame #14: 0x000000010008df39 miniruby`rb_wb_protected_newobj_of(klass=4334386280, flags=5) + 54 at gc.c:1990
    frame #15: 0x0000000100195f7c miniruby`str_alloc(klass=4334386280) + 29 at string.c:692
    frame #16: 0x0000000100195fe9 miniruby`str_new0(klass=4334386280, ptr="gitm", len=4, termlen=1) + 73 at string.c:714
    frame #17: 0x000000010019633e miniruby`rb_enc_str_new(ptr="gitm", len=4, enc=0x00000001025d50a0) + 81 at string.c:766
    frame #18: 0x000000010010a80a miniruby`parser_str_new(p="gitm", n=4, enc=0x00000001025d50a0, func=66, enc0=0x00000001025d50a0) + 50 at parse.y:5817
    frame #19: 0x000000010010ce1a miniruby`parser_parse_string(parser=0x00000001042ac5c0, quote=0x000000010460c028) + 795 at parse.y:6675
    frame #20: 0x00000001001120bd miniruby`parser_yylex(parser=0x00000001042ac5c0) + 159 at parse.y:8281
    frame #21: 0x0000000100115068 miniruby`yylex(lval=0x00007fff5fbf9948, yylloc=0x00007fff5fbf9ab0, parser=0x00000001042ac5c0) + 55 at parse.y:8931
    frame #22: 0x00000001000fc79f miniruby`ruby_yyparse(parser=0x00000001042ac5c0) + 1198 at parse.c:5798
    frame #23: 0x0000000100109f5a miniruby`yycompile0(arg=4364879296) + 317 at parse.y:5595
    frame #24: 0x0000000100214ef0 miniruby`rb_suppress_tracing(func=(miniruby`yycompile0 at parse.y:5565), arg=4364879296) + 349 at vm_trace.c:397
    frame #25: 0x000000010010a1df miniruby`yycompile(parser=0x00000001042ac5c0, fname=4443743440, line=1) + 126 at parse.y:5637
    frame #26: 0x000000010010a4c1 miniruby`parser_compile_string(vparser=4443743480, fname=4443743440, s=4443743520, line=1) + 191 at parse.y:5706
    frame #27: 0x000000010010a5b7 miniruby`rb_parser_compile_string_path(vparser=4443743480, f=4443743440, s=4443743520, line=1) + 58 at parse.y:5730
    frame #28: 0x0000000100206025 miniruby`eval_make_iseq(src=4443743520, fname=4443743440, line=1, bind=0x0000000000000000, base_block=0x00007fff5fbfb370) + 266 at vm_eval.c:1274
    frame #29: 0x0000000100206153 miniruby`eval_string_with_cref(self=4334412520, src=4443743520, cref=0x0000000000000000, file=52, line=1) + 197 at vm_eval.c:1307
    frame #30: 0x0000000100206389 miniruby`rb_f_eval(argc=1, argv=0x0000000102400eb8, self=4334412520) + 219 at vm_eval.c:1382
    frame #31: 0x00000001001f247c miniruby`call_cfunc_m1(func=(miniruby`rb_f_eval at vm_eval.c:1364), recv=4334412520, argc=1, argv=0x0000000102400eb8) + 47 at vm_insnhelper.c:1723
    frame #32: 0x00000001001f2f87 miniruby`vm_call_cfunc_with_frame(ec=0x00000001007d3548, reg_cfp=0x0000000102500d80, calling=0x00007fff5fbfbf50, ci=0x000000010263f240, cc=0x0000000100749b50) + 386 at vm_insnhelper.c:1918
    frame #33: 0x00000001001f30d6 miniruby`vm_call_cfunc(ec=0x00000001007d3548, reg_cfp=0x0000000102500d80, calling=0x00007fff5fbfbf50, ci=0x000000010263f240, cc=0x0000000100749b50) + 149 at vm_insnhelper.c:1934
    frame #34: 0x00000001001faf0e miniruby`vm_exec_core(ec=0x00000001007d3548, initial=0) + 8471 at insns.def:915
    frame #35: 0x000000010020b75d miniruby`vm_exec(ec=0x00000001007d3548) + 230 at vm.c:1771
    frame #36: 0x00000001002093f8 miniruby`invoke_block(ec=0x00000001007d3548, iseq=0x000000010252d7f0, self=4334412520, captured=0x0000000102500df8, cref=0x0000000000000000, type=572653569, opt_pc=0) + 224 at vm.c:988
    frame #37: 0x0000000100209766 miniruby`invoke_iseq_block_from_c(ec=0x00000001007d3548, captured=0x0000000102500df8, self=4334412520, argc=0, argv=0x0000000000000000, passed_block_handler=0, cref=0x0000000000000000, is_lambda=0) + 389 at vm.c:1040
    frame #38: 0x0000000100209824 miniruby`invoke_block_from_c_bh(ec=0x00000001007d3548, block_handler=4333768185, argc=0, argv=0x0000000000000000, passed_block_handler=0, cref=0x0000000000000000, is_lambda=0, force_blockarg=0) + 138 at vm.c:1058
    frame #39: 0x00000001002099d0 miniruby`vm_yield(ec=0x00000001007d3548, argc=0, argv=0x0000000000000000) + 69 at vm.c:1103
    frame #40: 0x0000000100205623 miniruby`rb_yield_0(argc=0, argv=0x0000000000000000) + 40 at vm_eval.c:970
    frame #41: 0x0000000100205964 miniruby`loop_i + 19 at vm_eval.c:1049
    frame #42: 0x000000010007db07 miniruby`rb_rescue2(b_proc=(miniruby`loop_i at vm_eval.c:1047), data1=0, r_proc=(miniruby`loop_stop at vm_eval.c:1056), data2=0) + 369 at eval.c:896
    frame #43: 0x0000000100205a2e miniruby`rb_f_loop(self=4334412520) + 121 at vm_eval.c:1100
    frame #44: 0x00000001001f24a7 miniruby`call_cfunc_0(func=(miniruby`rb_f_loop at vm_eval.c:1098), recv=4334412520, argc=0, argv=0x0000000102400e80) + 41 at vm_insnhelper.c:1729
    frame #45: 0x00000001001f2f87 miniruby`vm_call_cfunc_with_frame(ec=0x00000001007d3548, reg_cfp=0x0000000102500de0, calling=0x00007fff5fbfd4d0, ci=0x000000010263bbf0, cc=0x0000000102642118) + 386 at vm_insnhelper.c:1918
    frame #46: 0x00000001001f30d6 miniruby`vm_call_cfunc(ec=0x00000001007d3548, reg_cfp=0x0000000102500de0, calling=0x00007fff5fbfd4d0, ci=0x000000010263bbf0, cc=0x0000000102642118) + 149 at vm_insnhelper.c:1934
    frame #47: 0x00000001001f4319 miniruby`vm_call_method_each_type(ec=0x00000001007d3548, cfp=0x0000000102500de0, calling=0x00007fff5fbfd4d0, ci=0x000000010263bbf0, cc=0x0000000102642118) + 239 at vm_insnhelper.c:2232
    frame #48: 0x00000001001f4a2c miniruby`vm_call_method(ec=0x00000001007d3548, cfp=0x0000000102500de0, calling=0x00007fff5fbfd4d0, ci=0x000000010263bbf0, cc=0x0000000102642118) + 253 at vm_insnhelper.c:2366
    frame #49: 0x00000001001f4b7a miniruby`vm_call_general(ec=0x00000001007d3548, reg_cfp=0x0000000102500de0, calling=0x00007fff5fbfd4d0, ci=0x000000010263bbf0, cc=0x0000000102642118) + 59 at vm_insnhelper.c:2398
    frame #50: 0x00000001001fab2f miniruby`vm_exec_core(ec=0x00000001007d3548, initial=0) + 7480 at insns.def:850
    frame #51: 0x000000010020b75d miniruby`vm_exec(ec=0x00000001007d3548) + 230 at vm.c:1771
    frame #52: 0x000000010020c40f miniruby`rb_iseq_eval_main(iseq=0x000000010252dd90) + 52 at vm.c:2019
    frame #53: 0x000000010007c768 miniruby`ruby_exec_internal(n=0x000000010252dd90) + 297 at eval.c:246
    frame #54: 0x000000010007c88e miniruby`ruby_exec_node(n=0x000000010252dd90) + 36 at eval.c:310
    frame #55: 0x000000010007c861 miniruby`ruby_run_node(n=0x000000010252dd90) + 62 at eval.c:302
    frame #56: 0x000000010000138d miniruby`main(argc=2, argv=0x00007fff5fbfdbf0) + 113 at main.c:42
    frame #57: 0x00007fff88eda5ad libdyld.dylib`start + 1
(lldb) p ((struct RVALUE*)pathobj)->as.basic
(RBasic) $0 = (flags = 0, klass = 4478683600)
(lldb)

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@61568 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
matzbot pushed a commit that referenced this pull request Jan 2, 2018
@shyouhei
fix SEGV inspecting uninitialized objects
628dd6c 
obj_info() assumes the given object is alive.  OTOH
gc_writebarrier_incremental is called before or in middle of
object initialization.  Can casue SEGV.

(lldb) run
Process 48188 launched: './miniruby' (x86_64)
Process 48188 stopped
* thread #1: tid = 0x30fd53, 0x00000001000bf7a9 miniruby`rb_array_const_ptr(a=5251291222225483145) + 12 at ruby.h:2072, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=EXC_I386_GPFLT)
    frame #0: 0x00000001000bf7a9 miniruby`rb_array_const_ptr(a=5251291222225483145) + 12 at ruby.h:2072
   2069 static inline const VALUE *
   2070 rb_array_const_ptr(VALUE a)
   2071 {
-> 2072     return FIX_CONST_VALUE_PTR((RBASIC(a)->flags & RARRAY_EMBED_FLAG) ?
   2073         RARRAY(a)->as.ary : RARRAY(a)->as.heap.ptr);
   2074 }
   2075
(lldb) bt
* thread #1: tid = 0x30fd53, 0x00000001000bf7a9 miniruby`rb_array_const_ptr(a=5251291222225483145) + 12 at ruby.h:2072, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=EXC_I386_GPFLT)
  * frame #0: 0x00000001000bf7a9 miniruby`rb_array_const_ptr(a=5251291222225483145) + 12 at ruby.h:2072
    frame #1: 0x00000001000bfaab miniruby`pathobj_path(pathobj=5251291222225483145) + 70 at vm_core.h:269
    frame #2: 0x00000001000c25ff miniruby`rb_iseq_path(iseq=0x00000001025b71a8) + 32 at iseq.c:723
    frame #3: 0x000000010009db09 miniruby`rb_raw_iseq_info(buff="0x00000001025b7158 [0    ] proc (Proc)", buff_size=256, iseq=0x00000001025b71a8) + 69 at gc.c:9274
    frame #4: 0x000000010009e1d5 miniruby`rb_raw_obj_info(buff="0x00000001025b7158 [0    ] proc (Proc)", buff_size=256, obj=4334514520) + 1546 at gc.c:9351
    frame #5: 0x000000010009e4d5 miniruby`obj_info(obj=4334514520) + 98 at gc.c:9429
    frame #6: 0x0000000100096658 miniruby`gc_writebarrier_incremental(a=4334514520, b=4334514600, objspace=0x00000001007d3280) + 61 at gc.c:5963
    frame #7: 0x00000001000968ca miniruby`rb_gc_writebarrier(a=4334514520, b=4334514600) + 127 at gc.c:6009
    frame #8: 0x00000001001eabe0 miniruby`rb_obj_written(a=4334514520, oldv=52, b=4334514600, filename="/Users/urabe.shyouhei/data/src/pedantic/vm.c", line=821) + 72 at ruby.h:1472
    frame #9: 0x00000001001eac2c miniruby`rb_obj_write(a=4334514520, slot=0x000000010259ff10, b=4334514600, filename="/Users/urabe.shyouhei/data/src/pedantic/vm.c", line=821) + 70 at ruby.h:1489
    frame #10: 0x0000000100208b6f miniruby`vm_proc_create_from_captured(klass=4311027960, captured=0x0000000102500338, block_type=block_type_ifunc, is_from_method='\0', is_lambda='\x01') + 137 at vm.c:821
    frame #11: 0x0000000100208e5c miniruby`rb_vm_make_proc_lambda(ec=0x00000001007d3548, captured=0x0000000102500338, klass=4311027960, is_lambda='\x01') + 134 at vm.c:892
    frame #12: 0x000000010011f08e miniruby`proc_new(klass=4311027960, is_lambda='\x01') + 445 at proc.c:752
    frame #13: 0x000000010011f110 miniruby`rb_block_lambda + 27 at proc.c:808
    frame #14: 0x00000001001f24a7 miniruby`call_cfunc_0(func=(miniruby`rb_block_lambda at proc.c:807), recv=4310991600, argc=0, argv=0x0000000000000000) + 41 at vm_insnhelper.c:1729
    frame #15: 0x00000001002033de miniruby`vm_call0_cfunc_with_frame(ec=0x00000001007d3548, calling=0x00007fff5fbfb080, ci=0x00007fff5fbfb070, cc=0x00007fff5fbfb0a0, argv=0x0000000000000000) + 370 at vm_eval.c:85
    frame #16: 0x00000001002034d9 miniruby`vm_call0_cfunc(ec=0x00000001007d3548, calling=0x00007fff5fbfb080, ci=0x00007fff5fbfb070, cc=0x00007fff5fbfb0a0, argv=0x0000000000000000) + 59 at vm_eval.c:100
    frame #17: 0x000000010020368f miniruby`vm_call0_body(ec=0x00000001007d3548, calling=0x00007fff5fbfb080, ci=0x00007fff5fbfb070, cc=0x00007fff5fbfb0a0, argv=0x0000000000000000) + 436 at vm_eval.c:131
    frame #18: 0x000000010020326a miniruby`vm_call0(ec=0x00000001007d3548, recv=4310991600, id=2993, argc=0, argv=0x0000000000000000, me=0x0000000100f48110) + 142 at vm_eval.c:58
    frame #19: 0x0000000100203c60 miniruby`rb_call0(ec=0x00000001007d3548, recv=4310991600, mid=2993, argc=0, argv=0x0000000000000000, scope=CALL_FCALL, self=4334514640) + 166 at vm_eval.c:296
    frame #20: 0x0000000100204827 miniruby`rb_call(recv=4310991600, mid=2993, argc=0, argv=0x0000000000000000, scope=CALL_FCALL) + 84 at vm_eval.c:589
    frame #21: 0x000000010020518b miniruby`rb_funcallv(recv=4310991600, mid=2993, argc=0, argv=0x0000000000000000) + 52 at vm_eval.c:815
    frame #22: 0x000000010012242e miniruby`mlambda(method=0) + 45 at proc.c:2661
    frame #23: 0x0000000100205bac miniruby`rb_iterate0(it_proc=(miniruby`mlambda at proc.c:2660), data1=0, ifunc=0x00000001025b71a8, ec=0x00000001007d3548) + 380 at vm_eval.c:1134
    frame #24: 0x0000000100205d16 miniruby`rb_iterate(it_proc=(miniruby`mlambda at proc.c:2660), data1=0, bl_proc=(miniruby`bmcall at proc.c:2666), data2=4334514640) + 88 at vm_eval.c:1166
    frame #25: 0x00000001001224c7 miniruby`method_to_proc(method=4334514640) + 43 at proc.c:2701
    frame #26: 0x00000001001f24a7 miniruby`call_cfunc_0(func=(miniruby`method_to_proc at proc.c:2688), recv=4334514640, argc=0, argv=0x0000000102400568) + 41 at vm_insnhelper.c:1729
    frame #27: 0x00000001001f2f87 miniruby`vm_call_cfunc_with_frame(ec=0x00000001007d3548, reg_cfp=0x0000000102500350, calling=0x00007fff5fbfc030, ci=0x0000000100f2ec70, cc=0x0000000102735718) + 386 at vm_insnhelper.c:1918
    frame #28: 0x00000001001f30d6 miniruby`vm_call_cfunc(ec=0x00000001007d3548, reg_cfp=0x0000000102500350, calling=0x00007fff5fbfc030, ci=0x0000000100f2ec70, cc=0x0000000102735718) + 149 at vm_insnhelper.c:1934
    frame #29: 0x00000001001f4319 miniruby`vm_call_method_each_type(ec=0x00000001007d3548, cfp=0x0000000102500350, calling=0x00007fff5fbfc030, ci=0x0000000100f2ec70, cc=0x0000000102735718) + 239 at vm_insnhelper.c:2232
    frame #30: 0x00000001001f49a4 miniruby`vm_call_method(ec=0x00000001007d3548, cfp=0x0000000102500350, calling=0x00007fff5fbfc030, ci=0x0000000100f2ec70, cc=0x0000000102735718) + 117 at vm_insnhelper.c:2355
    frame #31: 0x00000001001f4b7a miniruby`vm_call_general(ec=0x00000001007d3548, reg_cfp=0x0000000102500350, calling=0x00007fff5fbfc030, ci=0x0000000100f2ec70, cc=0x0000000102735718) + 59 at vm_insnhelper.c:2398
    frame #32: 0x00000001001faf0e miniruby`vm_exec_core(ec=0x00000001007d3548, initial=0) + 8471 at insns.def:915
    frame #33: 0x000000010020b75d miniruby`vm_exec(ec=0x00000001007d3548) + 230 at vm.c:1771
    frame #34: 0x000000010020c3d1 miniruby`rb_iseq_eval(iseq=0x00000001007f8270) + 52 at vm.c:2008
    frame #35: 0x00000001000caa4a miniruby`rb_load_internal0(ec=0x00000001007d3548, fname=4310799960, wrap=0) + 631 at load.c:611
    frame #36: 0x00000001000cab36 miniruby`rb_load_internal(fname=4310799960, wrap=0) + 46 at load.c:642
    frame #37: 0x00000001000cae1d miniruby`rb_f_load(argc=1, argv=0x00000001024004b8) + 217 at load.c:710
    frame #38: 0x00000001001f247c miniruby`call_cfunc_m1(func=(miniruby`rb_f_load at load.c:695), recv=4311327440, argc=1, argv=0x00000001024004b8) + 47 at vm_insnhelper.c:1723
    frame #39: 0x00000001001f2f87 miniruby`vm_call_cfunc_with_frame(ec=0x00000001007d3548, reg_cfp=0x00000001025003e0, calling=0x00007fff5fbfd3e0, ci=0x0000000102541070, cc=0x0000000100f9e918) + 386 at vm_insnhelper.c:1918
    frame #40: 0x00000001001f30d6 miniruby`vm_call_cfunc(ec=0x00000001007d3548, reg_cfp=0x00000001025003e0, calling=0x00007fff5fbfd3e0, ci=0x0000000102541070, cc=0x0000000100f9e918) + 149 at vm_insnhelper.c:1934
    frame #41: 0x00000001001f4319 miniruby`vm_call_method_each_type(ec=0x00000001007d3548, cfp=0x00000001025003e0, calling=0x00007fff5fbfd3e0, ci=0x0000000102541070, cc=0x0000000100f9e918) + 239 at vm_insnhelper.c:2232
    frame #42: 0x00000001001f4a2c miniruby`vm_call_method(ec=0x00000001007d3548, cfp=0x00000001025003e0, calling=0x00007fff5fbfd3e0, ci=0x0000000102541070, cc=0x0000000100f9e918) + 253 at vm_insnhelper.c:2366
    frame #43: 0x00000001001f4b7a miniruby`vm_call_general(ec=0x00000001007d3548, reg_cfp=0x00000001025003e0, calling=0x00007fff5fbfd3e0, ci=0x0000000102541070, cc=0x0000000100f9e918) + 59 at vm_insnhelper.c:2398
    frame #44: 0x00000001001faf0e miniruby`vm_exec_core(ec=0x00000001007d3548, initial=0) + 8471 at insns.def:915
    frame #45: 0x000000010020b75d miniruby`vm_exec(ec=0x00000001007d3548) + 230 at vm.c:1771
    frame #46: 0x000000010020c40f miniruby`rb_iseq_eval_main(iseq=0x0000000100f21240) + 52 at vm.c:2019
    frame #47: 0x000000010007c774 miniruby`ruby_exec_internal(n=0x0000000100f21240) + 297 at eval.c:246
    frame #48: 0x000000010007c89a miniruby`ruby_exec_node(n=0x0000000100f21240) + 36 at eval.c:310
    frame #49: 0x000000010007c86d miniruby`ruby_run_node(n=0x0000000100f21240) + 62 at eval.c:302
    frame #50: 0x0000000100001399 miniruby`main(argc=9, argv=0x00007fff5fbfdae0) + 113 at main.c:42
    frame #51: 0x00007fff88eda5ad libdyld.dylib`start + 1
(lldb)

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@61569 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
matzbot pushed a commit that referenced this pull request Jan 18, 2018
@shyouhei
fix SEGV touching uninitialized memory
2038999 
This function can be called from rb_data_typed_object_zalloc().
No assumption can be made about object internals.

(lldb) run
Process 22135 launched: './miniruby' (x86_64)
Process 22135 stopped
* thread #1: tid = 0x14a3af, 0x000000010008ac8a miniruby`vm_block_type(block=0x0000000000000000) + 12 at vm_core.h:1364, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x18)
    frame #0: 0x000000010008ac8a miniruby`vm_block_type(block=0x0000000000000000) + 12 at vm_core.h:1364
   1361         break;
   1362     }
   1363 #endif
-> 1364     return block->type;
   1365 }
   1366
   1367 static inline void
(lldb) bt
* thread #1: tid = 0x14a3af, 0x000000010008ac8a miniruby`vm_block_type(block=0x0000000000000000) + 12 at vm_core.h:1364, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x18)
  * frame #0: 0x000000010008ac8a miniruby`vm_block_type(block=0x0000000000000000) + 12 at vm_core.h:1364
    frame #1: 0x000000010008acdb miniruby`vm_block_iseq(block=0x0000000000000000) + 24 at vm_core.h:1399
    frame #2: 0x000000010008acc1 miniruby`vm_proc_iseq(procval=4310866360) + 32 at vm_core.h:1387
    frame #3: 0x000000010009cbed miniruby`rb_raw_obj_info(buff="0x0000000100f299b8 [0    ] proc (Proc)", buff_size=256, obj=4310866360) + 1513 at gc.c:9349
    frame #4: 0x000000010009cf01 miniruby`obj_info(obj=4310866360) + 98 at gc.c:9428
    frame #5: 0x000000010008ca1b miniruby`newobj_init(klass=4311027960, flags=12, v1=4298186080, v2=1, v3=0, wb_protected=32, objspace=0x00000001007cf280, obj=4310866360) + 338 at gc.c:1887
    frame #6: 0x000000010008cce5 miniruby`newobj_of(klass=4311027960, flags=12, v1=4298186080, v2=1, v3=0, wb_protected=32) + 171 at gc.c:1970
    frame #7: 0x000000010008d01d miniruby`rb_data_typed_object_wrap(klass=4311027960, datap=0x0000000000000000, type=0x0000000100311d60) + 133 at gc.c:2062
    frame #8: 0x000000010008d04e miniruby`rb_data_typed_object_zalloc(klass=4311027960, size=40, type=0x0000000100311d60) + 42 at gc.c:2073
    frame #9: 0x000000010011b459 miniruby`rb_proc_alloc(klass=4311027960) + 36 at proc.c:113
    frame #10: 0x0000000100204d8e miniruby`vm_proc_create_from_captured(klass=4311027960, captured=0x00000001025003f8, block_type=block_type_iseq, is_from_method='\0', is_lambda='\x01') + 44 at vm.c:814
    frame #11: 0x00000001002050d8 miniruby`rb_vm_make_proc_lambda(ec=0x00000001007cf548, captured=0x00000001025003f8, klass=4311027960, is_lambda='\x01') + 134 at vm.c:892
    frame #12: 0x000000010011c0d2 miniruby`proc_new(klass=4311027960, is_lambda='\x01') + 445 at proc.c:752
    frame #13: 0x000000010011c154 miniruby`rb_block_lambda + 27 at proc.c:808
    frame #14: 0x00000001001ee7e3 miniruby`call_cfunc_0(func=(miniruby`rb_block_lambda at proc.c:807), recv=4310991600, argc=0, argv=0x0000000102400480) + 41 at vm_insnhelper.c:1729
    frame #15: 0x00000001001ef2c3 miniruby`vm_call_cfunc_with_frame(ec=0x00000001007cf548, reg_cfp=0x00000001025003e0, calling=0x00007fff5fbfd4d0, ci=0x0000000102537be0, cc=0x000000010253e0f0) + 386 at vm_insnhelper.c:1918
    frame #16: 0x00000001001ef412 miniruby`vm_call_cfunc(ec=0x00000001007cf548, reg_cfp=0x00000001025003e0, calling=0x00007fff5fbfd4d0, ci=0x0000000102537be0, cc=0x000000010253e0f0) + 149 at vm_insnhelper.c:1934
    frame #17: 0x00000001001f0655 miniruby`vm_call_method_each_type(ec=0x00000001007cf548, cfp=0x00000001025003e0, calling=0x00007fff5fbfd4d0, ci=0x0000000102537be0, cc=0x000000010253e0f0) + 239 at vm_insnhelper.c:2232
    frame #18: 0x00000001001f0ce0 miniruby`vm_call_method(ec=0x00000001007cf548, cfp=0x00000001025003e0, calling=0x00007fff5fbfd4d0, ci=0x0000000102537be0, cc=0x000000010253e0f0) + 117 at vm_insnhelper.c:2355
    frame #19: 0x00000001001f0eb6 miniruby`vm_call_general(ec=0x00000001007cf548, reg_cfp=0x00000001025003e0, calling=0x00007fff5fbfd4d0, ci=0x0000000102537be0, cc=0x000000010253e0f0) + 59 at vm_insnhelper.c:2398
    frame #20: 0x00000001001f6e61 miniruby`vm_exec_core(ec=0x00000001007cf548, initial=0) + 7480 at insns.def:850
    frame #21: 0x0000000100207995 miniruby`vm_exec(ec=0x00000001007cf548) + 230 at vm.c:1771
    frame #22: 0x0000000100208647 miniruby`rb_iseq_eval_main(iseq=0x0000000100f29fd0) + 52 at vm.c:2019
    frame #23: 0x000000010007b750 miniruby`ruby_exec_internal(n=0x0000000100f29fd0) + 297 at eval.c:246
    frame #24: 0x000000010007b876 miniruby`ruby_exec_node(n=0x0000000100f29fd0) + 36 at eval.c:310
    frame #25: 0x000000010007b849 miniruby`ruby_run_node(n=0x0000000100f29fd0) + 62 at eval.c:302
    frame #26: 0x0000000100000c05 miniruby`main(argc=2, argv=0x00007fff5fbfdbf0) + 113 at main.c:42
    frame #27: 0x00007fff88eda5ad libdyld.dylib`start + 1
(lldb)

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@61565 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
matzbot pushed a commit that referenced this pull request Jan 18, 2018
@shyouhei
fix SEGV touching uninitialized local variable
5498303 
This imemo_name is used uninitialized because the switch
above does not cover all possible imemo types.

(lldb) run
Process 26068 launched: './miniruby' (x86_64)
Process 26068 stopped
* thread #1: tid = 0x14ba96, 0x00007fff8a402132 libsystem_c.dylib`strlen + 18, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0xfffffffffffffff0)
    frame #0: 0x00007fff8a402132 libsystem_c.dylib`strlen + 18
libsystem_c.dylib`strlen:
->  0x7fff8a402132 <+18>: pcmpeqb (%rdi), %xmm0
    0x7fff8a402136 <+22>: pmovmskb %xmm0, %esi
    0x7fff8a40213a <+26>: andq   $0xf, %rcx
    0x7fff8a40213e <+30>: orq    $-0x1, %rax
(lldb) bt
* thread #1: tid = 0x14ba96, 0x00007fff8a402132 libsystem_c.dylib`strlen + 18, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0xfffffffffffffff0)
  * frame #0: 0x00007fff8a402132 libsystem_c.dylib`strlen + 18
    frame #1: 0x00000001001f1531 miniruby`BSD_vfprintf(fp=0x00007fff5fbfc9e0, fmt0="%s %s", ap=0x00007fff5fbfcbf0) + 5873 at vsnprintf.c:1026
    frame #2: 0x00000001001ef213 miniruby`ruby_do_vsnprintf(str="0x0000000100f46450 [0    ] T_IMEMO", n=256, fmt="%s %s", ap=0x00007fff5fbfcbf0) + 131 at sprintf.c:1285
    frame #3: 0x00000001001ef3ea miniruby`ruby_snprintf(str="0x0000000100f46450 [0    ] T_IMEMO", n=256, fmt="%s %s") + 426 at sprintf.c:1300
    frame #4: 0x00000001000bdc61 miniruby`rb_raw_obj_info(buff="0x0000000100f46450 [0    ] T_IMEMO", buff_size=256, obj=4310983760) + 2353 at gc.c:9376
    frame #5: 0x00000001000b7bff miniruby`obj_info(obj=4310983760) + 95 at gc.c:9428
    frame #6: 0x00000001000c1658 miniruby`newobj_init(klass=0, flags=36890, v1=0, v2=4303040512, v3=4310983800, wb_protected=1, objspace=0x00000001007ee280, obj=4310983760) + 424 at gc.c:1887
    frame #7: 0x00000001000b4469 miniruby`newobj_of(klass=0, flags=36890, v1=0, v2=4303040512, v3=4310983800, wb_protected=1) + 217 at gc.c:1970
    frame #8: 0x00000001000b45eb miniruby`rb_imemo_new(type=imemo_ast, v1=0, v2=4303040512, v3=4310983800, v0=0) + 75 at gc.c:2017
    frame #9: 0x000000010011daed miniruby`rb_ast_new + 61 at node.c:1146
    frame #10: 0x0000000100160e15 miniruby`rb_parser_compile_file_path(vparser=4310984400, fname=4310984960, file=4310984080, start=1) + 53 at parse.y:5776
    frame #11: 0x00000001001e18ea miniruby`load_file_internal(argp_v=140734799795024) + 1834 at ruby.c:1907
    frame #12: 0x00000001000a1bb5 miniruby`rb_ensure(b_proc=(miniruby`load_file_internal at ruby.c:1795), data1=140734799795024, e_proc=(miniruby`restore_load_file at ruby.c:2007), data2=140734799795024) + 245 at eval.c:1037
    frame #13: 0x00000001001df4a4 miniruby`load_file(parser=4310984400, fname=4310984960, f=4310984080, script=1, opt=0x00007fff5fbfda28) + 100 at ruby.c:2026
    frame #14: 0x00000001001e084e miniruby`process_options(argc=0, argv=0x00007fff5fbfdc00, opt=0x00007fff5fbfda28) + 3454 at ruby.c:1682
    frame #15: 0x00000001001dfaae miniruby`ruby_process_options(argc=2, argv=0x00007fff5fbfdbf0) + 238 at ruby.c:2257
    frame #16: 0x000000010009ff43 miniruby`ruby_options(argc=2, argv=0x00007fff5fbfdbf0) + 211 at eval.c:105
    frame #17: 0x0000000100000989 miniruby`main(argc=2, argv=0x00007fff5fbfdbf0) + 105 at main.c:42
    frame #18: 0x00007fff88eda5ad libdyld.dylib`start + 1
(lldb) up 4
frame #4: 0x00000001000bdc61 miniruby`rb_raw_obj_info(buff="0x0000000100f46450 [0    ] T_IMEMO", buff_size=256, obj=4310983760) + 2353 at gc.c:9376
   9373 #undef IMEMO_NAME
   9374               default: UNREACHABLE;
   9375             }
-> 9376             snprintf(buff, buff_size, "%s %s", buff, imemo_name);
   9377
   9378             switch (imemo_type(obj)) {
   9379               case imemo_ment: {
(lldb) p imemo_name
(const char *) $0 = 0xffffffffffffffff
(lldb) p imemo_type(obj)
(imemo_type) $1 = imemo_ast
(lldb)

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@61566 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
matzbot pushed a commit that referenced this pull request Jan 18, 2018
@shyouhei
fix SEGV inspecting already freed objects
1d4129d 
obj_info() assumes the given object is alive.  Passing freed
objects to it results in SEGV.

(lldb) run
Process 29718 launched: './miniruby' (x86_64)
Process 29718 stopped
* thread #1: tid = 0x3082c5, 0x00000001000bfaab miniruby`pathobj_path(pathobj=4478683640) + 70 at vm_core.h:269, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x0)
    frame #0: 0x00000001000bfaab miniruby`pathobj_path(pathobj=4478683640) + 70 at vm_core.h:269
   266      }
   267      else {
   268          VM_ASSERT(RB_TYPE_P(pathobj, T_ARRAY));
-> 269          return RARRAY_AREF(pathobj, PATHOBJ_PATH);
   270      }
   271  }
   272
(lldb) bt
* thread #1: tid = 0x3082c5, 0x00000001000bfaab miniruby`pathobj_path(pathobj=4478683640) + 70 at vm_core.h:269, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x0)
  * frame #0: 0x00000001000bfaab miniruby`pathobj_path(pathobj=4478683640) + 70 at vm_core.h:269
    frame #1: 0x00000001000c25ff miniruby`rb_iseq_path(iseq=0x000000010af34a20) + 32 at iseq.c:723
    frame #2: 0x000000010009db09 miniruby`rb_raw_iseq_info(buff="0x000000010af34a20 [1    ] T_IMEMO iseq", buff_size=256, iseq=0x000000010af34a20) + 69 at gc.c:9274
    frame #3: 0x000000010009e45a miniruby`rb_raw_obj_info(buff="0x000000010af34a20 [1    ] T_IMEMO iseq", buff_size=256, obj=4478683680) + 2191 at gc.c:9397
    frame #4: 0x000000010009e4d5 miniruby`obj_info(obj=4478683680) + 98 at gc.c:9429
    frame #5: 0x0000000100091ae3 miniruby`gc_page_sweep(objspace=0x00000001007d3280, heap=0x00000001007d32a0, sweep_page=0x000000010ae07bc0) + 622 at gc.c:3529
    frame #6: 0x000000010009206a miniruby`gc_sweep_step(objspace=0x00000001007d3280, heap=0x00000001007d32a0) + 188 at gc.c:3705
    frame #7: 0x0000000100092254 miniruby`gc_sweep_continue(objspace=0x00000001007d3280, heap=0x00000001007d32a0) + 133 at gc.c:3772
    frame #8: 0x000000010008d7f9 miniruby`heap_prepare(objspace=0x00000001007d3280, heap=0x00000001007d32a0) + 48 at gc.c:1746
    frame #9: 0x000000010008d8a1 miniruby`heap_get_freeobj_from_next_freepage(objspace=0x00000001007d3280, heap=0x00000001007d32a0) + 37 at gc.c:1769
    frame #10: 0x000000010008d98d miniruby`heap_get_freeobj(objspace=0x00000001007d3280, heap=0x00000001007d32a0) + 83 at gc.c:1803
    frame #11: 0x000000010008dcb0 miniruby`newobj_slowpath(klass=4334386280, flags=5, v1=0, v2=0, v3=0, objspace=0x00000001007d3280, wb_protected=1) + 220 at gc.c:1930
    frame #12: 0x000000010008dd6c miniruby`newobj_slowpath_wb_protected(klass=4334386280, flags=5, v1=0, v2=0, v3=0, objspace=0x00000001007d3280) + 76 at gc.c:1942
    frame #13: 0x000000010008dea1 miniruby`newobj_of(klass=4334386280, flags=5, v1=0, v2=0, v3=0, wb_protected=1) + 221 at gc.c:1974
    frame #14: 0x000000010008df39 miniruby`rb_wb_protected_newobj_of(klass=4334386280, flags=5) + 54 at gc.c:1990
    frame #15: 0x0000000100195f7c miniruby`str_alloc(klass=4334386280) + 29 at string.c:692
    frame #16: 0x0000000100195fe9 miniruby`str_new0(klass=4334386280, ptr="gitm", len=4, termlen=1) + 73 at string.c:714
    frame #17: 0x000000010019633e miniruby`rb_enc_str_new(ptr="gitm", len=4, enc=0x00000001025d50a0) + 81 at string.c:766
    frame #18: 0x000000010010a80a miniruby`parser_str_new(p="gitm", n=4, enc=0x00000001025d50a0, func=66, enc0=0x00000001025d50a0) + 50 at parse.y:5817
    frame #19: 0x000000010010ce1a miniruby`parser_parse_string(parser=0x00000001042ac5c0, quote=0x000000010460c028) + 795 at parse.y:6675
    frame #20: 0x00000001001120bd miniruby`parser_yylex(parser=0x00000001042ac5c0) + 159 at parse.y:8281
    frame #21: 0x0000000100115068 miniruby`yylex(lval=0x00007fff5fbf9948, yylloc=0x00007fff5fbf9ab0, parser=0x00000001042ac5c0) + 55 at parse.y:8931
    frame #22: 0x00000001000fc79f miniruby`ruby_yyparse(parser=0x00000001042ac5c0) + 1198 at parse.c:5798
    frame #23: 0x0000000100109f5a miniruby`yycompile0(arg=4364879296) + 317 at parse.y:5595
    frame #24: 0x0000000100214ef0 miniruby`rb_suppress_tracing(func=(miniruby`yycompile0 at parse.y:5565), arg=4364879296) + 349 at vm_trace.c:397
    frame #25: 0x000000010010a1df miniruby`yycompile(parser=0x00000001042ac5c0, fname=4443743440, line=1) + 126 at parse.y:5637
    frame #26: 0x000000010010a4c1 miniruby`parser_compile_string(vparser=4443743480, fname=4443743440, s=4443743520, line=1) + 191 at parse.y:5706
    frame #27: 0x000000010010a5b7 miniruby`rb_parser_compile_string_path(vparser=4443743480, f=4443743440, s=4443743520, line=1) + 58 at parse.y:5730
    frame #28: 0x0000000100206025 miniruby`eval_make_iseq(src=4443743520, fname=4443743440, line=1, bind=0x0000000000000000, base_block=0x00007fff5fbfb370) + 266 at vm_eval.c:1274
    frame #29: 0x0000000100206153 miniruby`eval_string_with_cref(self=4334412520, src=4443743520, cref=0x0000000000000000, file=52, line=1) + 197 at vm_eval.c:1307
    frame #30: 0x0000000100206389 miniruby`rb_f_eval(argc=1, argv=0x0000000102400eb8, self=4334412520) + 219 at vm_eval.c:1382
    frame #31: 0x00000001001f247c miniruby`call_cfunc_m1(func=(miniruby`rb_f_eval at vm_eval.c:1364), recv=4334412520, argc=1, argv=0x0000000102400eb8) + 47 at vm_insnhelper.c:1723
    frame #32: 0x00000001001f2f87 miniruby`vm_call_cfunc_with_frame(ec=0x00000001007d3548, reg_cfp=0x0000000102500d80, calling=0x00007fff5fbfbf50, ci=0x000000010263f240, cc=0x0000000100749b50) + 386 at vm_insnhelper.c:1918
    frame #33: 0x00000001001f30d6 miniruby`vm_call_cfunc(ec=0x00000001007d3548, reg_cfp=0x0000000102500d80, calling=0x00007fff5fbfbf50, ci=0x000000010263f240, cc=0x0000000100749b50) + 149 at vm_insnhelper.c:1934
    frame #34: 0x00000001001faf0e miniruby`vm_exec_core(ec=0x00000001007d3548, initial=0) + 8471 at insns.def:915
    frame #35: 0x000000010020b75d miniruby`vm_exec(ec=0x00000001007d3548) + 230 at vm.c:1771
    frame #36: 0x00000001002093f8 miniruby`invoke_block(ec=0x00000001007d3548, iseq=0x000000010252d7f0, self=4334412520, captured=0x0000000102500df8, cref=0x0000000000000000, type=572653569, opt_pc=0) + 224 at vm.c:988
    frame #37: 0x0000000100209766 miniruby`invoke_iseq_block_from_c(ec=0x00000001007d3548, captured=0x0000000102500df8, self=4334412520, argc=0, argv=0x0000000000000000, passed_block_handler=0, cref=0x0000000000000000, is_lambda=0) + 389 at vm.c:1040
    frame #38: 0x0000000100209824 miniruby`invoke_block_from_c_bh(ec=0x00000001007d3548, block_handler=4333768185, argc=0, argv=0x0000000000000000, passed_block_handler=0, cref=0x0000000000000000, is_lambda=0, force_blockarg=0) + 138 at vm.c:1058
    frame #39: 0x00000001002099d0 miniruby`vm_yield(ec=0x00000001007d3548, argc=0, argv=0x0000000000000000) + 69 at vm.c:1103
    frame #40: 0x0000000100205623 miniruby`rb_yield_0(argc=0, argv=0x0000000000000000) + 40 at vm_eval.c:970
    frame #41: 0x0000000100205964 miniruby`loop_i + 19 at vm_eval.c:1049
    frame #42: 0x000000010007db07 miniruby`rb_rescue2(b_proc=(miniruby`loop_i at vm_eval.c:1047), data1=0, r_proc=(miniruby`loop_stop at vm_eval.c:1056), data2=0) + 369 at eval.c:896
    frame #43: 0x0000000100205a2e miniruby`rb_f_loop(self=4334412520) + 121 at vm_eval.c:1100
    frame #44: 0x00000001001f24a7 miniruby`call_cfunc_0(func=(miniruby`rb_f_loop at vm_eval.c:1098), recv=4334412520, argc=0, argv=0x0000000102400e80) + 41 at vm_insnhelper.c:1729
    frame #45: 0x00000001001f2f87 miniruby`vm_call_cfunc_with_frame(ec=0x00000001007d3548, reg_cfp=0x0000000102500de0, calling=0x00007fff5fbfd4d0, ci=0x000000010263bbf0, cc=0x0000000102642118) + 386 at vm_insnhelper.c:1918
    frame #46: 0x00000001001f30d6 miniruby`vm_call_cfunc(ec=0x00000001007d3548, reg_cfp=0x0000000102500de0, calling=0x00007fff5fbfd4d0, ci=0x000000010263bbf0, cc=0x0000000102642118) + 149 at vm_insnhelper.c:1934
    frame #47: 0x00000001001f4319 miniruby`vm_call_method_each_type(ec=0x00000001007d3548, cfp=0x0000000102500de0, calling=0x00007fff5fbfd4d0, ci=0x000000010263bbf0, cc=0x0000000102642118) + 239 at vm_insnhelper.c:2232
    frame #48: 0x00000001001f4a2c miniruby`vm_call_method(ec=0x00000001007d3548, cfp=0x0000000102500de0, calling=0x00007fff5fbfd4d0, ci=0x000000010263bbf0, cc=0x0000000102642118) + 253 at vm_insnhelper.c:2366
    frame #49: 0x00000001001f4b7a miniruby`vm_call_general(ec=0x00000001007d3548, reg_cfp=0x0000000102500de0, calling=0x00007fff5fbfd4d0, ci=0x000000010263bbf0, cc=0x0000000102642118) + 59 at vm_insnhelper.c:2398
    frame #50: 0x00000001001fab2f miniruby`vm_exec_core(ec=0x00000001007d3548, initial=0) + 7480 at insns.def:850
    frame #51: 0x000000010020b75d miniruby`vm_exec(ec=0x00000001007d3548) + 230 at vm.c:1771
    frame #52: 0x000000010020c40f miniruby`rb_iseq_eval_main(iseq=0x000000010252dd90) + 52 at vm.c:2019
    frame #53: 0x000000010007c768 miniruby`ruby_exec_internal(n=0x000000010252dd90) + 297 at eval.c:246
    frame #54: 0x000000010007c88e miniruby`ruby_exec_node(n=0x000000010252dd90) + 36 at eval.c:310
    frame #55: 0x000000010007c861 miniruby`ruby_run_node(n=0x000000010252dd90) + 62 at eval.c:302
    frame #56: 0x000000010000138d miniruby`main(argc=2, argv=0x00007fff5fbfdbf0) + 113 at main.c:42
    frame #57: 0x00007fff88eda5ad libdyld.dylib`start + 1
(lldb) p ((struct RVALUE*)pathobj)->as.basic
(RBasic) $0 = (flags = 0, klass = 4478683600)
(lldb)

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@61568 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
matzbot pushed a commit that referenced this pull request Jan 18, 2018
@shyouhei
fix SEGV inspecting uninitialized objects
5b184f2 
obj_info() assumes the given object is alive.  OTOH
gc_writebarrier_incremental is called before or in middle of
object initialization.  Can casue SEGV.

(lldb) run
Process 48188 launched: './miniruby' (x86_64)
Process 48188 stopped
* thread #1: tid = 0x30fd53, 0x00000001000bf7a9 miniruby`rb_array_const_ptr(a=5251291222225483145) + 12 at ruby.h:2072, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=EXC_I386_GPFLT)
    frame #0: 0x00000001000bf7a9 miniruby`rb_array_const_ptr(a=5251291222225483145) + 12 at ruby.h:2072
   2069 static inline const VALUE *
   2070 rb_array_const_ptr(VALUE a)
   2071 {
-> 2072     return FIX_CONST_VALUE_PTR((RBASIC(a)->flags & RARRAY_EMBED_FLAG) ?
   2073         RARRAY(a)->as.ary : RARRAY(a)->as.heap.ptr);
   2074 }
   2075
(lldb) bt
* thread #1: tid = 0x30fd53, 0x00000001000bf7a9 miniruby`rb_array_const_ptr(a=5251291222225483145) + 12 at ruby.h:2072, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=EXC_I386_GPFLT)
  * frame #0: 0x00000001000bf7a9 miniruby`rb_array_const_ptr(a=5251291222225483145) + 12 at ruby.h:2072
    frame #1: 0x00000001000bfaab miniruby`pathobj_path(pathobj=5251291222225483145) + 70 at vm_core.h:269
    frame #2: 0x00000001000c25ff miniruby`rb_iseq_path(iseq=0x00000001025b71a8) + 32 at iseq.c:723
    frame #3: 0x000000010009db09 miniruby`rb_raw_iseq_info(buff="0x00000001025b7158 [0    ] proc (Proc)", buff_size=256, iseq=0x00000001025b71a8) + 69 at gc.c:9274
    frame #4: 0x000000010009e1d5 miniruby`rb_raw_obj_info(buff="0x00000001025b7158 [0    ] proc (Proc)", buff_size=256, obj=4334514520) + 1546 at gc.c:9351
    frame #5: 0x000000010009e4d5 miniruby`obj_info(obj=4334514520) + 98 at gc.c:9429
    frame #6: 0x0000000100096658 miniruby`gc_writebarrier_incremental(a=4334514520, b=4334514600, objspace=0x00000001007d3280) + 61 at gc.c:5963
    frame #7: 0x00000001000968ca miniruby`rb_gc_writebarrier(a=4334514520, b=4334514600) + 127 at gc.c:6009
    frame #8: 0x00000001001eabe0 miniruby`rb_obj_written(a=4334514520, oldv=52, b=4334514600, filename="/Users/urabe.shyouhei/data/src/pedantic/vm.c", line=821) + 72 at ruby.h:1472
    frame #9: 0x00000001001eac2c miniruby`rb_obj_write(a=4334514520, slot=0x000000010259ff10, b=4334514600, filename="/Users/urabe.shyouhei/data/src/pedantic/vm.c", line=821) + 70 at ruby.h:1489
    frame #10: 0x0000000100208b6f miniruby`vm_proc_create_from_captured(klass=4311027960, captured=0x0000000102500338, block_type=block_type_ifunc, is_from_method='\0', is_lambda='\x01') + 137 at vm.c:821
    frame #11: 0x0000000100208e5c miniruby`rb_vm_make_proc_lambda(ec=0x00000001007d3548, captured=0x0000000102500338, klass=4311027960, is_lambda='\x01') + 134 at vm.c:892
    frame #12: 0x000000010011f08e miniruby`proc_new(klass=4311027960, is_lambda='\x01') + 445 at proc.c:752
    frame #13: 0x000000010011f110 miniruby`rb_block_lambda + 27 at proc.c:808
    frame #14: 0x00000001001f24a7 miniruby`call_cfunc_0(func=(miniruby`rb_block_lambda at proc.c:807), recv=4310991600, argc=0, argv=0x0000000000000000) + 41 at vm_insnhelper.c:1729
    frame #15: 0x00000001002033de miniruby`vm_call0_cfunc_with_frame(ec=0x00000001007d3548, calling=0x00007fff5fbfb080, ci=0x00007fff5fbfb070, cc=0x00007fff5fbfb0a0, argv=0x0000000000000000) + 370 at vm_eval.c:85
    frame #16: 0x00000001002034d9 miniruby`vm_call0_cfunc(ec=0x00000001007d3548, calling=0x00007fff5fbfb080, ci=0x00007fff5fbfb070, cc=0x00007fff5fbfb0a0, argv=0x0000000000000000) + 59 at vm_eval.c:100
    frame #17: 0x000000010020368f miniruby`vm_call0_body(ec=0x00000001007d3548, calling=0x00007fff5fbfb080, ci=0x00007fff5fbfb070, cc=0x00007fff5fbfb0a0, argv=0x0000000000000000) + 436 at vm_eval.c:131
    frame #18: 0x000000010020326a miniruby`vm_call0(ec=0x00000001007d3548, recv=4310991600, id=2993, argc=0, argv=0x0000000000000000, me=0x0000000100f48110) + 142 at vm_eval.c:58
    frame #19: 0x0000000100203c60 miniruby`rb_call0(ec=0x00000001007d3548, recv=4310991600, mid=2993, argc=0, argv=0x0000000000000000, scope=CALL_FCALL, self=4334514640) + 166 at vm_eval.c:296
    frame #20: 0x0000000100204827 miniruby`rb_call(recv=4310991600, mid=2993, argc=0, argv=0x0000000000000000, scope=CALL_FCALL) + 84 at vm_eval.c:589
    frame #21: 0x000000010020518b miniruby`rb_funcallv(recv=4310991600, mid=2993, argc=0, argv=0x0000000000000000) + 52 at vm_eval.c:815
    frame #22: 0x000000010012242e miniruby`mlambda(method=0) + 45 at proc.c:2661
    frame #23: 0x0000000100205bac miniruby`rb_iterate0(it_proc=(miniruby`mlambda at proc.c:2660), data1=0, ifunc=0x00000001025b71a8, ec=0x00000001007d3548) + 380 at vm_eval.c:1134
    frame #24: 0x0000000100205d16 miniruby`rb_iterate(it_proc=(miniruby`mlambda at proc.c:2660), data1=0, bl_proc=(miniruby`bmcall at proc.c:2666), data2=4334514640) + 88 at vm_eval.c:1166
    frame #25: 0x00000001001224c7 miniruby`method_to_proc(method=4334514640) + 43 at proc.c:2701
    frame #26: 0x00000001001f24a7 miniruby`call_cfunc_0(func=(miniruby`method_to_proc at proc.c:2688), recv=4334514640, argc=0, argv=0x0000000102400568) + 41 at vm_insnhelper.c:1729
    frame #27: 0x00000001001f2f87 miniruby`vm_call_cfunc_with_frame(ec=0x00000001007d3548, reg_cfp=0x0000000102500350, calling=0x00007fff5fbfc030, ci=0x0000000100f2ec70, cc=0x0000000102735718) + 386 at vm_insnhelper.c:1918
    frame #28: 0x00000001001f30d6 miniruby`vm_call_cfunc(ec=0x00000001007d3548, reg_cfp=0x0000000102500350, calling=0x00007fff5fbfc030, ci=0x0000000100f2ec70, cc=0x0000000102735718) + 149 at vm_insnhelper.c:1934
    frame #29: 0x00000001001f4319 miniruby`vm_call_method_each_type(ec=0x00000001007d3548, cfp=0x0000000102500350, calling=0x00007fff5fbfc030, ci=0x0000000100f2ec70, cc=0x0000000102735718) + 239 at vm_insnhelper.c:2232
    frame #30: 0x00000001001f49a4 miniruby`vm_call_method(ec=0x00000001007d3548, cfp=0x0000000102500350, calling=0x00007fff5fbfc030, ci=0x0000000100f2ec70, cc=0x0000000102735718) + 117 at vm_insnhelper.c:2355
    frame #31: 0x00000001001f4b7a miniruby`vm_call_general(ec=0x00000001007d3548, reg_cfp=0x0000000102500350, calling=0x00007fff5fbfc030, ci=0x0000000100f2ec70, cc=0x0000000102735718) + 59 at vm_insnhelper.c:2398
    frame #32: 0x00000001001faf0e miniruby`vm_exec_core(ec=0x00000001007d3548, initial=0) + 8471 at insns.def:915
    frame #33: 0x000000010020b75d miniruby`vm_exec(ec=0x00000001007d3548) + 230 at vm.c:1771
    frame #34: 0x000000010020c3d1 miniruby`rb_iseq_eval(iseq=0x00000001007f8270) + 52 at vm.c:2008
    frame #35: 0x00000001000caa4a miniruby`rb_load_internal0(ec=0x00000001007d3548, fname=4310799960, wrap=0) + 631 at load.c:611
    frame #36: 0x00000001000cab36 miniruby`rb_load_internal(fname=4310799960, wrap=0) + 46 at load.c:642
    frame #37: 0x00000001000cae1d miniruby`rb_f_load(argc=1, argv=0x00000001024004b8) + 217 at load.c:710
    frame #38: 0x00000001001f247c miniruby`call_cfunc_m1(func=(miniruby`rb_f_load at load.c:695), recv=4311327440, argc=1, argv=0x00000001024004b8) + 47 at vm_insnhelper.c:1723
    frame #39: 0x00000001001f2f87 miniruby`vm_call_cfunc_with_frame(ec=0x00000001007d3548, reg_cfp=0x00000001025003e0, calling=0x00007fff5fbfd3e0, ci=0x0000000102541070, cc=0x0000000100f9e918) + 386 at vm_insnhelper.c:1918
    frame #40: 0x00000001001f30d6 miniruby`vm_call_cfunc(ec=0x00000001007d3548, reg_cfp=0x00000001025003e0, calling=0x00007fff5fbfd3e0, ci=0x0000000102541070, cc=0x0000000100f9e918) + 149 at vm_insnhelper.c:1934
    frame #41: 0x00000001001f4319 miniruby`vm_call_method_each_type(ec=0x00000001007d3548, cfp=0x00000001025003e0, calling=0x00007fff5fbfd3e0, ci=0x0000000102541070, cc=0x0000000100f9e918) + 239 at vm_insnhelper.c:2232
    frame #42: 0x00000001001f4a2c miniruby`vm_call_method(ec=0x00000001007d3548, cfp=0x00000001025003e0, calling=0x00007fff5fbfd3e0, ci=0x0000000102541070, cc=0x0000000100f9e918) + 253 at vm_insnhelper.c:2366
    frame #43: 0x00000001001f4b7a miniruby`vm_call_general(ec=0x00000001007d3548, reg_cfp=0x00000001025003e0, calling=0x00007fff5fbfd3e0, ci=0x0000000102541070, cc=0x0000000100f9e918) + 59 at vm_insnhelper.c:2398
    frame #44: 0x00000001001faf0e miniruby`vm_exec_core(ec=0x00000001007d3548, initial=0) + 8471 at insns.def:915
    frame #45: 0x000000010020b75d miniruby`vm_exec(ec=0x00000001007d3548) + 230 at vm.c:1771
    frame #46: 0x000000010020c40f miniruby`rb_iseq_eval_main(iseq=0x0000000100f21240) + 52 at vm.c:2019
    frame #47: 0x000000010007c774 miniruby`ruby_exec_internal(n=0x0000000100f21240) + 297 at eval.c:246
    frame #48: 0x000000010007c89a miniruby`ruby_exec_node(n=0x0000000100f21240) + 36 at eval.c:310
    frame #49: 0x000000010007c86d miniruby`ruby_run_node(n=0x0000000100f21240) + 62 at eval.c:302
    frame #50: 0x0000000100001399 miniruby`main(argc=9, argv=0x00007fff5fbfdae0) + 113 at main.c:42
    frame #51: 0x00007fff88eda5ad libdyld.dylib`start + 1
(lldb)

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@61569 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
matzbot pushed a commit that referenced this pull request Jan 24, 2018
@nurse
merge revision(s) 61562,61563,61566,61568,61569: [Backport #14269]
9ceb9e3 
	fix SEGV touching uninitialized memory

	This function can be called from boot_defclass().
	No assumption can be made about object internals.

	(lldb) run
	Process 2386 launched: './miniruby' (x86_64)
	Process 2386 stopped
	* thread #1: tid = 0x13f3b6, 0x00000001001e0b26 miniruby`rb_class_path_cached(klass=4311373720) + 20 at variable.c:321, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x8)
	    frame #0: 0x00000001001e0b26 miniruby`rb_class_path_cached(klass=4311373720) + 20 at variable.c:321
	   318  VALUE
	   319  rb_class_path_cached(VALUE klass)
	   320  {
	-> 321      st_table *ivtbl = RCLASS_IV_TBL(klass);
	   322      st_data_t n;
	   323
	   324      if (!ivtbl) return Qnil;
	(lldb) bt
	* thread #1: tid = 0x13f3b6, 0x00000001001e0b26 miniruby`rb_class_path_cached(klass=4311373720) + 20 at variable.c:321, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x8)
	  * frame #0: 0x00000001001e0b26 miniruby`rb_class_path_cached(klass=4311373720) + 20 at variable.c:321
	    frame #1: 0x000000010009cbd0 miniruby`rb_raw_obj_info(buff="0x0000000100fa5798 [2    ] T_CLASS", buff_size=256, obj=4311373720) + 1393 at gc.c:9341
	    frame #2: 0x000000010009cf16 miniruby`obj_info(obj=4311373720) + 98 at gc.c:9423
	    frame #3: 0x000000010008ca87 miniruby`newobj_init(klass=0, flags=66, v1=0, v2=0, v3=0, wb_protected=1, objspace=0x00000001007cf280, obj=4311373720) + 338 at gc.c:1887
	    frame #4: 0x000000010008cd51 miniruby`newobj_of(klass=0, flags=66, v1=0, v2=0, v3=0, wb_protected=1) + 171 at gc.c:1970
	    frame #5: 0x000000010008ce1b miniruby`rb_wb_protected_newobj_of(klass=0, flags=66) + 54 at gc.c:1990
	    frame #6: 0x0000000100027563 miniruby`class_alloc(flags=2, klass=0) + 46 at class.c:165
	    frame #7: 0x000000010002761a miniruby`rb_class_boot(super=0) + 35 at class.c:203
	    frame #8: 0x0000000100028612 miniruby`boot_defclass(name="BasicObject", super=0) + 28 at class.c:537
	    frame #9: 0x000000010002868b miniruby`Init_class_hierarchy + 26 at class.c:548
	    frame #10: 0x00000001000efe69 miniruby`InitVM_Object + 9 at object.c:3892
	    frame #11: 0x00000001000f138e miniruby`Init_Object + 57 at object.c:4122
	    frame #12: 0x00000001000a59bd miniruby`rb_call_inits + 29 at inits.c:23
	    frame #13: 0x000000010007af30 miniruby`ruby_setup + 229 at eval.c:61
	    frame #14: 0x000000010007af7e miniruby`ruby_init + 13 at eval.c:78
	    frame #15: 0x0000000100000c58 miniruby`main(argc=2, argv=0x00007fff5fbfdbf0) + 88 at main.c:41
	    frame #16: 0x00007fff88eda5ad libdyld.dylib`start + 1
	(lldb)

	fix SEGV touching uninitialized memory

	This function can be called from InitVM_Object().
	No assumption can be made about object internals.

	(lldb) run
	Process 10675 launched: './miniruby' (x86_64)
	Process 10675 stopped
	* thread #1: tid = 0x14252c, 0x00000001000bdda9 miniruby`rb_raw_obj_info(buff="0x0000000100fc1588 [0    ] T_IMEMO ment", buff_size=256, obj=4311487880) + 2489 at gc.c:9383, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x0)
	    frame #0: 0x00000001000bdda9 miniruby`rb_raw_obj_info(buff="0x0000000100fc1588 [0    ] T_IMEMO ment", buff_size=256, obj=4311487880) + 2489 at gc.c:9383
	   9380                 const rb_method_entry_t *me = &RANY(obj)->as.imemo.ment;
	   9381                 snprintf(buff, buff_size, "%s (called_id: %s, type: %s, alias: %d, owner: %s, defined_class: %s)", buff,
	   9382                          rb_id2name(me->called_id),
	-> 9383                          method_type_name(me->def->type),
	   9384                          me->def->alias_count,
	   9385                          obj_info(me->owner),
	   9386                          obj_info(me->defined_class));
	(lldb) p *me
	(rb_method_entry_t) $0 = {
	  flags = 24602
	  defined_class = 4311488400
	  def = 0x0000000000000000
	  called_id = 3057
	  owner = 4311488400
	}
	(lldb) bt
	* thread #1: tid = 0x14252c, 0x00000001000bdda9 miniruby`rb_raw_obj_info(buff="0x0000000100fc1588 [0    ] T_IMEMO ment", buff_size=256, obj=4311487880) + 2489 at gc.c:9383, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x0)
	  * frame #0: 0x00000001000bdda9 miniruby`rb_raw_obj_info(buff="0x0000000100fc1588 [0    ] T_IMEMO ment", buff_size=256, obj=4311487880) + 2489 at gc.c:9383
	    frame #1: 0x00000001000b7cbf miniruby`obj_info(obj=4311487880) + 95 at gc.c:9423
	    frame #2: 0x00000001000c16a8 miniruby`newobj_init(klass=4311488400, flags=24602, v1=0, v2=3057, v3=4311488400, wb_protected=1, objspace=0x00000001007ee280, obj=4311487880) + 424 at gc.c:1887
	    frame #3: 0x00000001000b4529 miniruby`newobj_of(klass=4311488400, flags=24602, v1=0, v2=3057, v3=4311488400, wb_protected=1) + 217 at gc.c:1970
	    frame #4: 0x00000001000b46ab miniruby`rb_imemo_new(type=imemo_ment, v1=0, v2=3057, v3=4311488400, v0=4311488400) + 75 at gc.c:2017
	    frame #5: 0x00000001002773b4 miniruby`rb_method_entry_alloc(called_id=3057, owner=4311488400, defined_class=4311488400, def=0x0000000000000000) + 52 at vm_method.c:368
	    frame #6: 0x0000000100277307 miniruby`rb_method_entry_create(called_id=3057, klass=4311488400, visi=METHOD_VISI_PRIVATE, def=0x0000000000000000) + 71 at vm_method.c:389
	    frame #7: 0x00000001002784c7 miniruby`rb_method_entry_make(klass=4311488400, mid=3057, defined_class=4311488400, visi=METHOD_VISI_PRIVATE, type=VM_METHOD_TYPE_CFUNC, def=0x0000000000000000, original_id=3057, opts=0x00007fff5fbfd9e8) + 1207 at vm_method.c:594
	    frame #8: 0x00000001002770f9 miniruby`rb_add_method(klass=4311488400, mid=3057, type=VM_METHOD_TYPE_CFUNC, opts=0x00007fff5fbfd9e8, visi=METHOD_VISI_PRIVATE) + 73 at vm_method.c:650
	    frame #9: 0x000000010027708a miniruby`rb_add_method_cfunc(klass=4311488400, mid=3057, func=(miniruby`rb_obj_dummy at object.c:1125), argc=0, visi=METHOD_VISI_PRIVATE) + 138 at vm_method.c:137
	    frame #10: 0x00000001000391e4 miniruby`rb_define_private_method(klass=4311488400, name="initialize", func=(miniruby`rb_obj_dummy at object.c:1125), argc=0) + 68 at class.c:1529
	    frame #11: 0x000000010013f5bf miniruby`InitVM_Object + 47 at object.c:3905
	    frame #12: 0x0000000100142ffd miniruby`Init_Object + 61 at object.c:4122
	    frame #13: 0x00000001000d4edd miniruby`rb_call_inits + 29 at inits.c:23
	    frame #14: 0x000000010009fe66 miniruby`ruby_setup + 198 at eval.c:61
	    frame #15: 0x000000010009febd miniruby`ruby_init + 13 at eval.c:78
	    frame #16: 0x0000000100000a4d miniruby`main(argc=2, argv=0x00007fff5fbfdbf0) + 93 at main.c:41
	    frame #17: 0x00007fff88eda5ad libdyld.dylib`start + 1
	(lldb)

	fix SEGV touching uninitialized local variable

	This imemo_name is used uninitialized because the switch
	above does not cover all possible imemo types.

	(lldb) run
	Process 26068 launched: './miniruby' (x86_64)
	Process 26068 stopped
	* thread #1: tid = 0x14ba96, 0x00007fff8a402132 libsystem_c.dylib`strlen + 18, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0xfffffffffffffff0)
	    frame #0: 0x00007fff8a402132 libsystem_c.dylib`strlen + 18
	libsystem_c.dylib`strlen:
	->  0x7fff8a402132 <+18>: pcmpeqb (%rdi), %xmm0
	    0x7fff8a402136 <+22>: pmovmskb %xmm0, %esi
	    0x7fff8a40213a <+26>: andq   $0xf, %rcx
	    0x7fff8a40213e <+30>: orq    $-0x1, %rax
	(lldb) bt
	* thread #1: tid = 0x14ba96, 0x00007fff8a402132 libsystem_c.dylib`strlen + 18, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0xfffffffffffffff0)
	  * frame #0: 0x00007fff8a402132 libsystem_c.dylib`strlen + 18
	    frame #1: 0x00000001001f1531 miniruby`BSD_vfprintf(fp=0x00007fff5fbfc9e0, fmt0="%s %s", ap=0x00007fff5fbfcbf0) + 5873 at vsnprintf.c:1026
	    frame #2: 0x00000001001ef213 miniruby`ruby_do_vsnprintf(str="0x0000000100f46450 [0    ] T_IMEMO", n=256, fmt="%s %s", ap=0x00007fff5fbfcbf0) + 131 at sprintf.c:1285
	    frame #3: 0x00000001001ef3ea miniruby`ruby_snprintf(str="0x0000000100f46450 [0    ] T_IMEMO", n=256, fmt="%s %s") + 426 at sprintf.c:1300
	    frame #4: 0x00000001000bdc61 miniruby`rb_raw_obj_info(buff="0x0000000100f46450 [0    ] T_IMEMO", buff_size=256, obj=4310983760) + 2353 at gc.c:9376
	    frame #5: 0x00000001000b7bff miniruby`obj_info(obj=4310983760) + 95 at gc.c:9428
	    frame #6: 0x00000001000c1658 miniruby`newobj_init(klass=0, flags=36890, v1=0, v2=4303040512, v3=4310983800, wb_protected=1, objspace=0x00000001007ee280, obj=4310983760) + 424 at gc.c:1887
	    frame #7: 0x00000001000b4469 miniruby`newobj_of(klass=0, flags=36890, v1=0, v2=4303040512, v3=4310983800, wb_protected=1) + 217 at gc.c:1970
	    frame #8: 0x00000001000b45eb miniruby`rb_imemo_new(type=imemo_ast, v1=0, v2=4303040512, v3=4310983800, v0=0) + 75 at gc.c:2017
	    frame #9: 0x000000010011daed miniruby`rb_ast_new + 61 at node.c:1146
	    frame #10: 0x0000000100160e15 miniruby`rb_parser_compile_file_path(vparser=4310984400, fname=4310984960, file=4310984080, start=1) + 53 at parse.y:5776
	    frame #11: 0x00000001001e18ea miniruby`load_file_internal(argp_v=140734799795024) + 1834 at ruby.c:1907
	    frame #12: 0x00000001000a1bb5 miniruby`rb_ensure(b_proc=(miniruby`load_file_internal at ruby.c:1795), data1=140734799795024, e_proc=(miniruby`restore_load_file at ruby.c:2007), data2=140734799795024) + 245 at eval.c:1037
	    frame #13: 0x00000001001df4a4 miniruby`load_file(parser=4310984400, fname=4310984960, f=4310984080, script=1, opt=0x00007fff5fbfda28) + 100 at ruby.c:2026
	    frame #14: 0x00000001001e084e miniruby`process_options(argc=0, argv=0x00007fff5fbfdc00, opt=0x00007fff5fbfda28) + 3454 at ruby.c:1682
	    frame #15: 0x00000001001dfaae miniruby`ruby_process_options(argc=2, argv=0x00007fff5fbfdbf0) + 238 at ruby.c:2257
	    frame #16: 0x000000010009ff43 miniruby`ruby_options(argc=2, argv=0x00007fff5fbfdbf0) + 211 at eval.c:105
	    frame #17: 0x0000000100000989 miniruby`main(argc=2, argv=0x00007fff5fbfdbf0) + 105 at main.c:42
	    frame #18: 0x00007fff88eda5ad libdyld.dylib`start + 1
	(lldb) up 4
	frame #4: 0x00000001000bdc61 miniruby`rb_raw_obj_info(buff="0x0000000100f46450 [0    ] T_IMEMO", buff_size=256, obj=4310983760) + 2353 at gc.c:9376
	   9373 #undef IMEMO_NAME
	   9374               default: UNREACHABLE;
	   9375             }
	-> 9376             snprintf(buff, buff_size, "%s %s", buff, imemo_name);
	   9377
	   9378             switch (imemo_type(obj)) {
	   9379               case imemo_ment: {
	(lldb) p imemo_name
	(const char *) $0 = 0xffffffffffffffff
	(lldb) p imemo_type(obj)
	(imemo_type) $1 = imemo_ast
	(lldb)

	fix SEGV inspecting already freed objects

	obj_info() assumes the given object is alive.  Passing freed
	objects to it results in SEGV.

	(lldb) run
	Process 29718 launched: './miniruby' (x86_64)
	Process 29718 stopped
	* thread #1: tid = 0x3082c5, 0x00000001000bfaab miniruby`pathobj_path(pathobj=4478683640) + 70 at vm_core.h:269, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x0)
	    frame #0: 0x00000001000bfaab miniruby`pathobj_path(pathobj=4478683640) + 70 at vm_core.h:269
	   266      }
	   267      else {
	   268          VM_ASSERT(RB_TYPE_P(pathobj, T_ARRAY));
	-> 269          return RARRAY_AREF(pathobj, PATHOBJ_PATH);
	   270      }
	   271  }
	   272
	(lldb) bt
	* thread #1: tid = 0x3082c5, 0x00000001000bfaab miniruby`pathobj_path(pathobj=4478683640) + 70 at vm_core.h:269, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x0)
	  * frame #0: 0x00000001000bfaab miniruby`pathobj_path(pathobj=4478683640) + 70 at vm_core.h:269
	    frame #1: 0x00000001000c25ff miniruby`rb_iseq_path(iseq=0x000000010af34a20) + 32 at iseq.c:723
	    frame #2: 0x000000010009db09 miniruby`rb_raw_iseq_info(buff="0x000000010af34a20 [1    ] T_IMEMO iseq", buff_size=256, iseq=0x000000010af34a20) + 69 at gc.c:9274
	    frame #3: 0x000000010009e45a miniruby`rb_raw_obj_info(buff="0x000000010af34a20 [1    ] T_IMEMO iseq", buff_size=256, obj=4478683680) + 2191 at gc.c:9397
	    frame #4: 0x000000010009e4d5 miniruby`obj_info(obj=4478683680) + 98 at gc.c:9429
	    frame #5: 0x0000000100091ae3 miniruby`gc_page_sweep(objspace=0x00000001007d3280, heap=0x00000001007d32a0, sweep_page=0x000000010ae07bc0) + 622 at gc.c:3529
	    frame #6: 0x000000010009206a miniruby`gc_sweep_step(objspace=0x00000001007d3280, heap=0x00000001007d32a0) + 188 at gc.c:3705
	    frame #7: 0x0000000100092254 miniruby`gc_sweep_continue(objspace=0x00000001007d3280, heap=0x00000001007d32a0) + 133 at gc.c:3772
	    frame #8: 0x000000010008d7f9 miniruby`heap_prepare(objspace=0x00000001007d3280, heap=0x00000001007d32a0) + 48 at gc.c:1746
	    frame #9: 0x000000010008d8a1 miniruby`heap_get_freeobj_from_next_freepage(objspace=0x00000001007d3280, heap=0x00000001007d32a0) + 37 at gc.c:1769
	    frame #10: 0x000000010008d98d miniruby`heap_get_freeobj(objspace=0x00000001007d3280, heap=0x00000001007d32a0) + 83 at gc.c:1803
	    frame #11: 0x000000010008dcb0 miniruby`newobj_slowpath(klass=4334386280, flags=5, v1=0, v2=0, v3=0, objspace=0x00000001007d3280, wb_protected=1) + 220 at gc.c:1930
	    frame #12: 0x000000010008dd6c miniruby`newobj_slowpath_wb_protected(klass=4334386280, flags=5, v1=0, v2=0, v3=0, objspace=0x00000001007d3280) + 76 at gc.c:1942
	    frame #13: 0x000000010008dea1 miniruby`newobj_of(klass=4334386280, flags=5, v1=0, v2=0, v3=0, wb_protected=1) + 221 at gc.c:1974
	    frame #14: 0x000000010008df39 miniruby`rb_wb_protected_newobj_of(klass=4334386280, flags=5) + 54 at gc.c:1990
	    frame #15: 0x0000000100195f7c miniruby`str_alloc(klass=4334386280) + 29 at string.c:692
	    frame #16: 0x0000000100195fe9 miniruby`str_new0(klass=4334386280, ptr="gitm", len=4, termlen=1) + 73 at string.c:714
	    frame #17: 0x000000010019633e miniruby`rb_enc_str_new(ptr="gitm", len=4, enc=0x00000001025d50a0) + 81 at string.c:766
	    frame #18: 0x000000010010a80a miniruby`parser_str_new(p="gitm", n=4, enc=0x00000001025d50a0, func=66, enc0=0x00000001025d50a0) + 50 at parse.y:5817
	    frame #19: 0x000000010010ce1a miniruby`parser_parse_string(parser=0x00000001042ac5c0, quote=0x000000010460c028) + 795 at parse.y:6675
	    frame #20: 0x00000001001120bd miniruby`parser_yylex(parser=0x00000001042ac5c0) + 159 at parse.y:8281
	    frame #21: 0x0000000100115068 miniruby`yylex(lval=0x00007fff5fbf9948, yylloc=0x00007fff5fbf9ab0, parser=0x00000001042ac5c0) + 55 at parse.y:8931
	    frame #22: 0x00000001000fc79f miniruby`ruby_yyparse(parser=0x00000001042ac5c0) + 1198 at parse.c:5798
	    frame #23: 0x0000000100109f5a miniruby`yycompile0(arg=4364879296) + 317 at parse.y:5595
	    frame #24: 0x0000000100214ef0 miniruby`rb_suppress_tracing(func=(miniruby`yycompile0 at parse.y:5565), arg=4364879296) + 349 at vm_trace.c:397
	    frame #25: 0x000000010010a1df miniruby`yycompile(parser=0x00000001042ac5c0, fname=4443743440, line=1) + 126 at parse.y:5637
	    frame #26: 0x000000010010a4c1 miniruby`parser_compile_string(vparser=4443743480, fname=4443743440, s=4443743520, line=1) + 191 at parse.y:5706
	    frame #27: 0x000000010010a5b7 miniruby`rb_parser_compile_string_path(vparser=4443743480, f=4443743440, s=4443743520, line=1) + 58 at parse.y:5730
	    frame #28: 0x0000000100206025 miniruby`eval_make_iseq(src=4443743520, fname=4443743440, line=1, bind=0x0000000000000000, base_block=0x00007fff5fbfb370) + 266 at vm_eval.c:1274
	    frame #29: 0x0000000100206153 miniruby`eval_string_with_cref(self=4334412520, src=4443743520, cref=0x0000000000000000, file=52, line=1) + 197 at vm_eval.c:1307
	    frame #30: 0x0000000100206389 miniruby`rb_f_eval(argc=1, argv=0x0000000102400eb8, self=4334412520) + 219 at vm_eval.c:1382
	    frame #31: 0x00000001001f247c miniruby`call_cfunc_m1(func=(miniruby`rb_f_eval at vm_eval.c:1364), recv=4334412520, argc=1, argv=0x0000000102400eb8) + 47 at vm_insnhelper.c:1723
	    frame #32: 0x00000001001f2f87 miniruby`vm_call_cfunc_with_frame(ec=0x00000001007d3548, reg_cfp=0x0000000102500d80, calling=0x00007fff5fbfbf50, ci=0x000000010263f240, cc=0x0000000100749b50) + 386 at vm_insnhelper.c:1918
	    frame #33: 0x00000001001f30d6 miniruby`vm_call_cfunc(ec=0x00000001007d3548, reg_cfp=0x0000000102500d80, calling=0x00007fff5fbfbf50, ci=0x000000010263f240, cc=0x0000000100749b50) + 149 at vm_insnhelper.c:1934
	    frame #34: 0x00000001001faf0e miniruby`vm_exec_core(ec=0x00000001007d3548, initial=0) + 8471 at insns.def:915
	    frame #35: 0x000000010020b75d miniruby`vm_exec(ec=0x00000001007d3548) + 230 at vm.c:1771
	    frame #36: 0x00000001002093f8 miniruby`invoke_block(ec=0x00000001007d3548, iseq=0x000000010252d7f0, self=4334412520, captured=0x0000000102500df8, cref=0x0000000000000000, type=572653569, opt_pc=0) + 224 at vm.c:988
	    frame #37: 0x0000000100209766 miniruby`invoke_iseq_block_from_c(ec=0x00000001007d3548, captured=0x0000000102500df8, self=4334412520, argc=0, argv=0x0000000000000000, passed_block_handler=0, cref=0x0000000000000000, is_lambda=0) + 389 at vm.c:1040
	    frame #38: 0x0000000100209824 miniruby`invoke_block_from_c_bh(ec=0x00000001007d3548, block_handler=4333768185, argc=0, argv=0x0000000000000000, passed_block_handler=0, cref=0x0000000000000000, is_lambda=0, force_blockarg=0) + 138 at vm.c:1058
	    frame #39: 0x00000001002099d0 miniruby`vm_yield(ec=0x00000001007d3548, argc=0, argv=0x0000000000000000) + 69 at vm.c:1103
	    frame #40: 0x0000000100205623 miniruby`rb_yield_0(argc=0, argv=0x0000000000000000) + 40 at vm_eval.c:970
	    frame #41: 0x0000000100205964 miniruby`loop_i + 19 at vm_eval.c:1049
	    frame #42: 0x000000010007db07 miniruby`rb_rescue2(b_proc=(miniruby`loop_i at vm_eval.c:1047), data1=0, r_proc=(miniruby`loop_stop at vm_eval.c:1056), data2=0) + 369 at eval.c:896
	    frame #43: 0x0000000100205a2e miniruby`rb_f_loop(self=4334412520) + 121 at vm_eval.c:1100
	    frame #44: 0x00000001001f24a7 miniruby`call_cfunc_0(func=(miniruby`rb_f_loop at vm_eval.c:1098), recv=4334412520, argc=0, argv=0x0000000102400e80) + 41 at vm_insnhelper.c:1729
	    frame #45: 0x00000001001f2f87 miniruby`vm_call_cfunc_with_frame(ec=0x00000001007d3548, reg_cfp=0x0000000102500de0, calling=0x00007fff5fbfd4d0, ci=0x000000010263bbf0, cc=0x0000000102642118) + 386 at vm_insnhelper.c:1918
	    frame #46: 0x00000001001f30d6 miniruby`vm_call_cfunc(ec=0x00000001007d3548, reg_cfp=0x0000000102500de0, calling=0x00007fff5fbfd4d0, ci=0x000000010263bbf0, cc=0x0000000102642118) + 149 at vm_insnhelper.c:1934
	    frame #47: 0x00000001001f4319 miniruby`vm_call_method_each_type(ec=0x00000001007d3548, cfp=0x0000000102500de0, calling=0x00007fff5fbfd4d0, ci=0x000000010263bbf0, cc=0x0000000102642118) + 239 at vm_insnhelper.c:2232
	    frame #48: 0x00000001001f4a2c miniruby`vm_call_method(ec=0x00000001007d3548, cfp=0x0000000102500de0, calling=0x00007fff5fbfd4d0, ci=0x000000010263bbf0, cc=0x0000000102642118) + 253 at vm_insnhelper.c:2366
	    frame #49: 0x00000001001f4b7a miniruby`vm_call_general(ec=0x00000001007d3548, reg_cfp=0x0000000102500de0, calling=0x00007fff5fbfd4d0, ci=0x000000010263bbf0, cc=0x0000000102642118) + 59 at vm_insnhelper.c:2398
	    frame #50: 0x00000001001fab2f miniruby`vm_exec_core(ec=0x00000001007d3548, initial=0) + 7480 at insns.def:850
	    frame #51: 0x000000010020b75d miniruby`vm_exec(ec=0x00000001007d3548) + 230 at vm.c:1771
	    frame #52: 0x000000010020c40f miniruby`rb_iseq_eval_main(iseq=0x000000010252dd90) + 52 at vm.c:2019
	    frame #53: 0x000000010007c768 miniruby`ruby_exec_internal(n=0x000000010252dd90) + 297 at eval.c:246
	    frame #54: 0x000000010007c88e miniruby`ruby_exec_node(n=0x000000010252dd90) + 36 at eval.c:310
	    frame #55: 0x000000010007c861 miniruby`ruby_run_node(n=0x000000010252dd90) + 62 at eval.c:302
	    frame #56: 0x000000010000138d miniruby`main(argc=2, argv=0x00007fff5fbfdbf0) + 113 at main.c:42
	    frame #57: 0x00007fff88eda5ad libdyld.dylib`start + 1
	(lldb) p ((struct RVALUE*)pathobj)->as.basic
	(RBasic) $0 = (flags = 0, klass = 4478683600)
	(lldb)

	fix SEGV inspecting uninitialized objects

	obj_info() assumes the given object is alive.  OTOH
	gc_writebarrier_incremental is called before or in middle of
	object initialization.  Can casue SEGV.

	(lldb) run
	Process 48188 launched: './miniruby' (x86_64)
	Process 48188 stopped
	* thread #1: tid = 0x30fd53, 0x00000001000bf7a9 miniruby`rb_array_const_ptr(a=5251291222225483145) + 12 at ruby.h:2072, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=EXC_I386_GPFLT)
	    frame #0: 0x00000001000bf7a9 miniruby`rb_array_const_ptr(a=5251291222225483145) + 12 at ruby.h:2072
	   2069 static inline const VALUE *
	   2070 rb_array_const_ptr(VALUE a)
	   2071 {
	-> 2072     return FIX_CONST_VALUE_PTR((RBASIC(a)->flags & RARRAY_EMBED_FLAG) ?
	   2073         RARRAY(a)->as.ary : RARRAY(a)->as.heap.ptr);
	   2074 }
	   2075
	(lldb) bt
	* thread #1: tid = 0x30fd53, 0x00000001000bf7a9 miniruby`rb_array_const_ptr(a=5251291222225483145) + 12 at ruby.h:2072, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=EXC_I386_GPFLT)
	  * frame #0: 0x00000001000bf7a9 miniruby`rb_array_const_ptr(a=5251291222225483145) + 12 at ruby.h:2072
	    frame #1: 0x00000001000bfaab miniruby`pathobj_path(pathobj=5251291222225483145) + 70 at vm_core.h:269
	    frame #2: 0x00000001000c25ff miniruby`rb_iseq_path(iseq=0x00000001025b71a8) + 32 at iseq.c:723
	    frame #3: 0x000000010009db09 miniruby`rb_raw_iseq_info(buff="0x00000001025b7158 [0    ] proc (Proc)", buff_size=256, iseq=0x00000001025b71a8) + 69 at gc.c:9274
	    frame #4: 0x000000010009e1d5 miniruby`rb_raw_obj_info(buff="0x00000001025b7158 [0    ] proc (Proc)", buff_size=256, obj=4334514520) + 1546 at gc.c:9351
	    frame #5: 0x000000010009e4d5 miniruby`obj_info(obj=4334514520) + 98 at gc.c:9429
	    frame #6: 0x0000000100096658 miniruby`gc_writebarrier_incremental(a=4334514520, b=4334514600, objspace=0x00000001007d3280) + 61 at gc.c:5963
	    frame #7: 0x00000001000968ca miniruby`rb_gc_writebarrier(a=4334514520, b=4334514600) + 127 at gc.c:6009
	    frame #8: 0x00000001001eabe0 miniruby`rb_obj_written(a=4334514520, oldv=52, b=4334514600, filename="/Users/urabe.shyouhei/data/src/pedantic/vm.c", line=821) + 72 at ruby.h:1472
	    frame #9: 0x00000001001eac2c miniruby`rb_obj_write(a=4334514520, slot=0x000000010259ff10, b=4334514600, filename="/Users/urabe.shyouhei/data/src/pedantic/vm.c", line=821) + 70 at ruby.h:1489
	    frame #10: 0x0000000100208b6f miniruby`vm_proc_create_from_captured(klass=4311027960, captured=0x0000000102500338, block_type=block_type_ifunc, is_from_method='\0', is_lambda='\x01') + 137 at vm.c:821
	    frame #11: 0x0000000100208e5c miniruby`rb_vm_make_proc_lambda(ec=0x00000001007d3548, captured=0x0000000102500338, klass=4311027960, is_lambda='\x01') + 134 at vm.c:892
	    frame #12: 0x000000010011f08e miniruby`proc_new(klass=4311027960, is_lambda='\x01') + 445 at proc.c:752
	    frame #13: 0x000000010011f110 miniruby`rb_block_lambda + 27 at proc.c:808
	    frame #14: 0x00000001001f24a7 miniruby`call_cfunc_0(func=(miniruby`rb_block_lambda at proc.c:807), recv=4310991600, argc=0, argv=0x0000000000000000) + 41 at vm_insnhelper.c:1729
	    frame #15: 0x00000001002033de miniruby`vm_call0_cfunc_with_frame(ec=0x00000001007d3548, calling=0x00007fff5fbfb080, ci=0x00007fff5fbfb070, cc=0x00007fff5fbfb0a0, argv=0x0000000000000000) + 370 at vm_eval.c:85
	    frame #16: 0x00000001002034d9 miniruby`vm_call0_cfunc(ec=0x00000001007d3548, calling=0x00007fff5fbfb080, ci=0x00007fff5fbfb070, cc=0x00007fff5fbfb0a0, argv=0x0000000000000000) + 59 at vm_eval.c:100
	    frame #17: 0x000000010020368f miniruby`vm_call0_body(ec=0x00000001007d3548, calling=0x00007fff5fbfb080, ci=0x00007fff5fbfb070, cc=0x00007fff5fbfb0a0, argv=0x0000000000000000) + 436 at vm_eval.c:131
	    frame #18: 0x000000010020326a miniruby`vm_call0(ec=0x00000001007d3548, recv=4310991600, id=2993, argc=0, argv=0x0000000000000000, me=0x0000000100f48110) + 142 at vm_eval.c:58
	    frame #19: 0x0000000100203c60 miniruby`rb_call0(ec=0x00000001007d3548, recv=4310991600, mid=2993, argc=0, argv=0x0000000000000000, scope=CALL_FCALL, self=4334514640) + 166 at vm_eval.c:296
	    frame #20: 0x0000000100204827 miniruby`rb_call(recv=4310991600, mid=2993, argc=0, argv=0x0000000000000000, scope=CALL_FCALL) + 84 at vm_eval.c:589
	    frame #21: 0x000000010020518b miniruby`rb_funcallv(recv=4310991600, mid=2993, argc=0, argv=0x0000000000000000) + 52 at vm_eval.c:815
	    frame #22: 0x000000010012242e miniruby`mlambda(method=0) + 45 at proc.c:2661
	    frame #23: 0x0000000100205bac miniruby`rb_iterate0(it_proc=(miniruby`mlambda at proc.c:2660), data1=0, ifunc=0x00000001025b71a8, ec=0x00000001007d3548) + 380 at vm_eval.c:1134
	    frame #24: 0x0000000100205d16 miniruby`rb_iterate(it_proc=(miniruby`mlambda at proc.c:2660), data1=0, bl_proc=(miniruby`bmcall at proc.c:2666), data2=4334514640) + 88 at vm_eval.c:1166
	    frame #25: 0x00000001001224c7 miniruby`method_to_proc(method=4334514640) + 43 at proc.c:2701
	    frame #26: 0x00000001001f24a7 miniruby`call_cfunc_0(func=(miniruby`method_to_proc at proc.c:2688), recv=4334514640, argc=0, argv=0x0000000102400568) + 41 at vm_insnhelper.c:1729
	    frame #27: 0x00000001001f2f87 miniruby`vm_call_cfunc_with_frame(ec=0x00000001007d3548, reg_cfp=0x0000000102500350, calling=0x00007fff5fbfc030, ci=0x0000000100f2ec70, cc=0x0000000102735718) + 386 at vm_insnhelper.c:1918
	    frame #28: 0x00000001001f30d6 miniruby`vm_call_cfunc(ec=0x00000001007d3548, reg_cfp=0x0000000102500350, calling=0x00007fff5fbfc030, ci=0x0000000100f2ec70, cc=0x0000000102735718) + 149 at vm_insnhelper.c:1934
	    frame #29: 0x00000001001f4319 miniruby`vm_call_method_each_type(ec=0x00000001007d3548, cfp=0x0000000102500350, calling=0x00007fff5fbfc030, ci=0x0000000100f2ec70, cc=0x0000000102735718) + 239 at vm_insnhelper.c:2232
	    frame #30: 0x00000001001f49a4 miniruby`vm_call_method(ec=0x00000001007d3548, cfp=0x0000000102500350, calling=0x00007fff5fbfc030, ci=0x0000000100f2ec70, cc=0x0000000102735718) + 117 at vm_insnhelper.c:2355
	    frame #31: 0x00000001001f4b7a miniruby`vm_call_general(ec=0x00000001007d3548, reg_cfp=0x0000000102500350, calling=0x00007fff5fbfc030, ci=0x0000000100f2ec70, cc=0x0000000102735718) + 59 at vm_insnhelper.c:2398
	    frame #32: 0x00000001001faf0e miniruby`vm_exec_core(ec=0x00000001007d3548, initial=0) + 8471 at insns.def:915
	    frame #33: 0x000000010020b75d miniruby`vm_exec(ec=0x00000001007d3548) + 230 at vm.c:1771
	    frame #34: 0x000000010020c3d1 miniruby`rb_iseq_eval(iseq=0x00000001007f8270) + 52 at vm.c:2008
	    frame #35: 0x00000001000caa4a miniruby`rb_load_internal0(ec=0x00000001007d3548, fname=4310799960, wrap=0) + 631 at load.c:611
	    frame #36: 0x00000001000cab36 miniruby`rb_load_internal(fname=4310799960, wrap=0) + 46 at load.c:642
	    frame #37: 0x00000001000cae1d miniruby`rb_f_load(argc=1, argv=0x00000001024004b8) + 217 at load.c:710
	    frame #38: 0x00000001001f247c miniruby`call_cfunc_m1(func=(miniruby`rb_f_load at load.c:695), recv=4311327440, argc=1, argv=0x00000001024004b8) + 47 at vm_insnhelper.c:1723
	    frame #39: 0x00000001001f2f87 miniruby`vm_call_cfunc_with_frame(ec=0x00000001007d3548, reg_cfp=0x00000001025003e0, calling=0x00007fff5fbfd3e0, ci=0x0000000102541070, cc=0x0000000100f9e918) + 386 at vm_insnhelper.c:1918
	    frame #40: 0x00000001001f30d6 miniruby`vm_call_cfunc(ec=0x00000001007d3548, reg_cfp=0x00000001025003e0, calling=0x00007fff5fbfd3e0, ci=0x0000000102541070, cc=0x0000000100f9e918) + 149 at vm_insnhelper.c:1934
	    frame #41: 0x00000001001f4319 miniruby`vm_call_method_each_type(ec=0x00000001007d3548, cfp=0x00000001025003e0, calling=0x00007fff5fbfd3e0, ci=0x0000000102541070, cc=0x0000000100f9e918) + 239 at vm_insnhelper.c:2232
	    frame #42: 0x00000001001f4a2c miniruby`vm_call_method(ec=0x00000001007d3548, cfp=0x00000001025003e0, calling=0x00007fff5fbfd3e0, ci=0x0000000102541070, cc=0x0000000100f9e918) + 253 at vm_insnhelper.c:2366
	    frame #43: 0x00000001001f4b7a miniruby`vm_call_general(ec=0x00000001007d3548, reg_cfp=0x00000001025003e0, calling=0x00007fff5fbfd3e0, ci=0x0000000102541070, cc=0x0000000100f9e918) + 59 at vm_insnhelper.c:2398
	    frame #44: 0x00000001001faf0e miniruby`vm_exec_core(ec=0x00000001007d3548, initial=0) + 8471 at insns.def:915
	    frame #45: 0x000000010020b75d miniruby`vm_exec(ec=0x00000001007d3548) + 230 at vm.c:1771
	    frame #46: 0x000000010020c40f miniruby`rb_iseq_eval_main(iseq=0x0000000100f21240) + 52 at vm.c:2019
	    frame #47: 0x000000010007c774 miniruby`ruby_exec_internal(n=0x0000000100f21240) + 297 at eval.c:246
	    frame #48: 0x000000010007c89a miniruby`ruby_exec_node(n=0x0000000100f21240) + 36 at eval.c:310
	    frame #49: 0x000000010007c86d miniruby`ruby_run_node(n=0x0000000100f21240) + 62 at eval.c:302
	    frame #50: 0x0000000100001399 miniruby`main(argc=9, argv=0x00007fff5fbfdae0) + 113 at main.c:42
	    frame #51: 0x00007fff88eda5ad libdyld.dylib`start + 1
	(lldb)

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@62023 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
matzbot pushed a commit that referenced this pull request Jan 29, 2018
@nurse
merge revision(s) 61564,61565,61571: [Backport #14270]
54a3b8e 
	fix SEGV touching uninitialized memory

	This function can be called from Init_VM().
	No assumption can be made about object internals.

	(lldb) run
	Process 15734 launched: './miniruby' (x86_64)
	Process 15734 stopped
	* thread #1: tid = 0x1441d4, 0x00000001000bdfcb miniruby`rb_raw_iseq_info(buff="0x0000000100f61f48 [0    ] T_IMEMO iseq", buff_size=256, iseq=0x0000000100f61f48) + 27 at gc.c:9273, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x50)
	    frame #0: 0x00000001000bdfcb miniruby`rb_raw_iseq_info(buff="0x0000000100f61f48 [0    ] T_IMEMO iseq", buff_size=256, iseq=0x0000000100f61f48) + 27 at gc.c:9273
	   9270 static void
	   9271 rb_raw_iseq_info(char *buff, const int buff_size, const rb_iseq_t *iseq)
	   9272 {
	-> 9273     if (iseq->body->location.label) {
	   9274         VALUE path = rb_iseq_path(iseq);
	   9275         snprintf(buff, buff_size, "%s %s@%s:%d", buff,
	   9276                  RSTRING_PTR(iseq->body->location.label),
	(lldb) p *iseq
	(rb_iseq_t) $0 = {
	  flags = 28698
	  reserved1 = 0
	  body = 0x0000000000000000
	  aux = {
	    compile_data = 0x0000000000000000
	    loader = (obj = 0, index = 0)
	    trace_events = 0
	  }
	}
	(lldb) bt
	* thread #1: tid = 0x1441d4, 0x00000001000bdfcb miniruby`rb_raw_iseq_info(buff="0x0000000100f61f48 [0    ] T_IMEMO iseq", buff_size=256, iseq=0x0000000100f61f48) + 27 at gc.c:9273, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x50)
	  * frame #0: 0x00000001000bdfcb miniruby`rb_raw_iseq_info(buff="0x0000000100f61f48 [0    ] T_IMEMO iseq", buff_size=256, iseq=0x0000000100f61f48) + 27 at gc.c:9273
	    frame #1: 0x00000001000bde72 miniruby`rb_raw_obj_info(buff="0x0000000100f61f48 [0    ] T_IMEMO iseq", buff_size=256, obj=4311097160) + 2786 at gc.c:9396
	    frame #2: 0x00000001000b7c5f miniruby`obj_info(obj=4311097160) + 95 at gc.c:9428
	    frame #3: 0x00000001000c16a8 miniruby`newobj_init(klass=0, flags=28698, v1=0, v2=0, v3=0, wb_protected=1, objspace=0x00000001007ee280, obj=4311097160) + 424 at gc.c:1887
	    frame #4: 0x00000001000b44c9 miniruby`newobj_of(klass=0, flags=28698, v1=0, v2=0, v3=0, wb_protected=1) + 217 at gc.c:1970
	    frame #5: 0x00000001000b464b miniruby`rb_imemo_new(type=imemo_iseq, v1=0, v2=0, v3=0, v0=0) + 75 at gc.c:2017
	    frame #6: 0x00000001000fd914 miniruby`iseq_imemo_alloc + 36 at iseq.h:156
	    frame #7: 0x00000001000f6e1d miniruby`iseq_alloc + 13 at iseq.c:211
	    frame #8: 0x00000001000f6bf8 miniruby`rb_iseq_new_with_opt(node=0x0000000000000000, name=4311097200, path=4311097200, realpath=8, first_lineno=1, parent=0x0000000000000000, type=ISEQ_TYPE_TOP, option=0x0000000100335c30) + 56 at iseq.c:519
	    frame #9: 0x00000001000f6bb6 miniruby`rb_iseq_new(node=0x0000000000000000, name=4311097200, path=4311097200, realpath=8, parent=0x0000000000000000, type=ISEQ_TYPE_TOP) + 86 at iseq.c:480
	    frame #10: 0x0000000100284bb0 miniruby`Init_VM + 1040 at vm.c:3022
	    frame #11: 0x00000001000d4f7d miniruby`rb_call_inits + 189 at inits.c:55
	    frame #12: 0x000000010009fe06 miniruby`ruby_setup + 198 at eval.c:61
	    frame #13: 0x000000010009fe5d miniruby`ruby_init + 13 at eval.c:78
	    frame #14: 0x00000001000009ed miniruby`main(argc=2, argv=0x00007fff5fbfdbf0) + 93 at main.c:41
	    frame #15: 0x00007fff88eda5ad libdyld.dylib`start + 1
	(lldb)

	fix SEGV touching uninitialized memory

	This function can be called from rb_data_typed_object_zalloc().
	No assumption can be made about object internals.

	(lldb) run
	Process 22135 launched: './miniruby' (x86_64)
	Process 22135 stopped
	* thread #1: tid = 0x14a3af, 0x000000010008ac8a miniruby`vm_block_type(block=0x0000000000000000) + 12 at vm_core.h:1364, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x18)
	    frame #0: 0x000000010008ac8a miniruby`vm_block_type(block=0x0000000000000000) + 12 at vm_core.h:1364
	   1361         break;
	   1362     }
	   1363 #endif
	-> 1364     return block->type;
	   1365 }
	   1366
	   1367 static inline void
	(lldb) bt
	* thread #1: tid = 0x14a3af, 0x000000010008ac8a miniruby`vm_block_type(block=0x0000000000000000) + 12 at vm_core.h:1364, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x18)
	  * frame #0: 0x000000010008ac8a miniruby`vm_block_type(block=0x0000000000000000) + 12 at vm_core.h:1364
	    frame #1: 0x000000010008acdb miniruby`vm_block_iseq(block=0x0000000000000000) + 24 at vm_core.h:1399
	    frame #2: 0x000000010008acc1 miniruby`vm_proc_iseq(procval=4310866360) + 32 at vm_core.h:1387
	    frame #3: 0x000000010009cbed miniruby`rb_raw_obj_info(buff="0x0000000100f299b8 [0    ] proc (Proc)", buff_size=256, obj=4310866360) + 1513 at gc.c:9349
	    frame #4: 0x000000010009cf01 miniruby`obj_info(obj=4310866360) + 98 at gc.c:9428
	    frame #5: 0x000000010008ca1b miniruby`newobj_init(klass=4311027960, flags=12, v1=4298186080, v2=1, v3=0, wb_protected=32, objspace=0x00000001007cf280, obj=4310866360) + 338 at gc.c:1887
	    frame #6: 0x000000010008cce5 miniruby`newobj_of(klass=4311027960, flags=12, v1=4298186080, v2=1, v3=0, wb_protected=32) + 171 at gc.c:1970
	    frame #7: 0x000000010008d01d miniruby`rb_data_typed_object_wrap(klass=4311027960, datap=0x0000000000000000, type=0x0000000100311d60) + 133 at gc.c:2062
	    frame #8: 0x000000010008d04e miniruby`rb_data_typed_object_zalloc(klass=4311027960, size=40, type=0x0000000100311d60) + 42 at gc.c:2073
	    frame #9: 0x000000010011b459 miniruby`rb_proc_alloc(klass=4311027960) + 36 at proc.c:113
	    frame #10: 0x0000000100204d8e miniruby`vm_proc_create_from_captured(klass=4311027960, captured=0x00000001025003f8, block_type=block_type_iseq, is_from_method='\0', is_lambda='\x01') + 44 at vm.c:814
	    frame #11: 0x00000001002050d8 miniruby`rb_vm_make_proc_lambda(ec=0x00000001007cf548, captured=0x00000001025003f8, klass=4311027960, is_lambda='\x01') + 134 at vm.c:892
	    frame #12: 0x000000010011c0d2 miniruby`proc_new(klass=4311027960, is_lambda='\x01') + 445 at proc.c:752
	    frame #13: 0x000000010011c154 miniruby`rb_block_lambda + 27 at proc.c:808
	    frame #14: 0x00000001001ee7e3 miniruby`call_cfunc_0(func=(miniruby`rb_block_lambda at proc.c:807), recv=4310991600, argc=0, argv=0x0000000102400480) + 41 at vm_insnhelper.c:1729
	    frame #15: 0x00000001001ef2c3 miniruby`vm_call_cfunc_with_frame(ec=0x00000001007cf548, reg_cfp=0x00000001025003e0, calling=0x00007fff5fbfd4d0, ci=0x0000000102537be0, cc=0x000000010253e0f0) + 386 at vm_insnhelper.c:1918
	    frame #16: 0x00000001001ef412 miniruby`vm_call_cfunc(ec=0x00000001007cf548, reg_cfp=0x00000001025003e0, calling=0x00007fff5fbfd4d0, ci=0x0000000102537be0, cc=0x000000010253e0f0) + 149 at vm_insnhelper.c:1934
	    frame #17: 0x00000001001f0655 miniruby`vm_call_method_each_type(ec=0x00000001007cf548, cfp=0x00000001025003e0, calling=0x00007fff5fbfd4d0, ci=0x0000000102537be0, cc=0x000000010253e0f0) + 239 at vm_insnhelper.c:2232
	    frame #18: 0x00000001001f0ce0 miniruby`vm_call_method(ec=0x00000001007cf548, cfp=0x00000001025003e0, calling=0x00007fff5fbfd4d0, ci=0x0000000102537be0, cc=0x000000010253e0f0) + 117 at vm_insnhelper.c:2355
	    frame #19: 0x00000001001f0eb6 miniruby`vm_call_general(ec=0x00000001007cf548, reg_cfp=0x00000001025003e0, calling=0x00007fff5fbfd4d0, ci=0x0000000102537be0, cc=0x000000010253e0f0) + 59 at vm_insnhelper.c:2398
	    frame #20: 0x00000001001f6e61 miniruby`vm_exec_core(ec=0x00000001007cf548, initial=0) + 7480 at insns.def:850
	    frame #21: 0x0000000100207995 miniruby`vm_exec(ec=0x00000001007cf548) + 230 at vm.c:1771
	    frame #22: 0x0000000100208647 miniruby`rb_iseq_eval_main(iseq=0x0000000100f29fd0) + 52 at vm.c:2019
	    frame #23: 0x000000010007b750 miniruby`ruby_exec_internal(n=0x0000000100f29fd0) + 297 at eval.c:246
	    frame #24: 0x000000010007b876 miniruby`ruby_exec_node(n=0x0000000100f29fd0) + 36 at eval.c:310
	    frame #25: 0x000000010007b849 miniruby`ruby_run_node(n=0x0000000100f29fd0) + 62 at eval.c:302
	    frame #26: 0x0000000100000c05 miniruby`main(argc=2, argv=0x00007fff5fbfdbf0) + 113 at main.c:42
	    frame #27: 0x00007fff88eda5ad libdyld.dylib`start + 1
	(lldb)

	check an existence of block.

	* gc.c (rb_raw_obj_info): check block before using it.

	* vm_core.h (vm_block_iseq): r61565 introduced NULL check but this
	  check is only needed by `rb_raw_obj_info()` and it is called at GC
	  debug mode. Above fix for `rb_raw_obj_info()` solves this problem and
	  NULL check should not be needed any more.


git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@62095 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
matzbot pushed a commit that referenced this pull request Feb 16, 2018
@k0kubun
mjit.c: fix deadlock on class serial increment
e3e8af9 
This is reported by @hasimo. Fixing a case like this:

 #0  __lll_lock_wait () at ../sysdeps/unix/sysv/linux/x86_64/lowlevellock.S:135
 #1  0x00007fc7bd824dbd in __GI___pthread_mutex_lock (mutex=mutex@entry=0x55946d294440 <mjit_engine_mutex>) at ../nptl/pthread_mutex_lock.c:80               4
 #2  0x000055946cec54d9 in rb_native_mutex_lock (lock=lock@entry=0x55946d294440 <mjit_engine_mutex>) at thread_pthread.c:211
 #3  0x000055946cde10ca in CRITICAL_SECTION_START (msg=0x55946cfb5423 "mjit_gc_start_hook", level=4) at mjit.c:392
 #4  mjit_gc_start_hook () at mjit.c:412
 #5  0x000055946cda0dfe in gc_enter (event=0x55946cfaf91e "gc_rest", objspace=0x55946da51760) at gc.c:6623
 #6  gc_rest (objspace=objspace@entry=0x55946da51760) at gc.c:6515
 #7  0x000055946cd9f1cf in gc_rest (objspace=0x55946da51760) at gc.c:7841
 #8  objspace_malloc_increase (objspace=objspace@entry=0x55946da51760, new_size=<optimized out>, old_size=old_size@entry=0, type=type@entry=MEMOP_TYPE_MALLOC, mem=0x7fc7a4439010) at gc.c:7842
 #9  0x000055946cda1706 in objspace_malloc_fixup (size=<optimized out>, mem=0x7fc7a4439010, objspace=0x55946da51760) at gc.c:7910
 #10 objspace_xmalloc0 (objspace=0x55946da51760, size=<optimized out>, size@entry=3145728) at gc.c:7939
 #11 0x000055946cda3620 in ruby_xmalloc0 (size=3145728) at gc.c:8006
 #12 ruby_xmalloc (size=size@entry=3145728) at gc.c:8015
 #13 0x000055946ce93f4c in st_init_table_with_size (type=0x55946d28da30 <objhash>, size=<optimized out>) at st.c:602
 #14 0x000055946ce94287 in rebuild_table (tab=tab@entry=0x55946db669f0) at st.c:777
 #15 0x000055946ce963f7 in rebuild_table_if_necessary (tab=0x55946db669f0) at st.c:1139
 #16 st_add_direct_with_hash (hash=8577035585096733536, value=20, key=808451, tab=0x55946db669f0) at st.c:1207
 #17 st_update (tab=0x55946db669f0, key=key@entry=808451, func=<optimized out>, arg=140726472841392) at st.c:1512
 #18 0x000055946cda9e27 in tbl_update (optional_arg=<optimized out>, func=<optimized out>, key=<optimized out>, hash=<optimized out>) at hash.c:561
 #19 rb_hash_aset (hash=94095983218480, key=key@entry=808451, val=val@entry=20) at hash.c:1654
 #20 0x000055946cde243a in mjit_add_class_serial (class_serial=class_serial@entry=404225) at mjit.c:1414                    3
 #21 0x000055946cefcfab in rb_next_class_serial () at vm.c:321
 #22 0x000055946cf48324 in class_alloc (klass=<optimized out>, flags=28) at class.c:178
 #23 rb_include_class_new (module=module@entry=94096115733840, super=0) at class.c:820
 #24 0x000055946cf487ac in include_modules_at (klass=klass@entry=94096135960920, c=<optimized out>, module=<optimized out>, module@entry=94096115734160, search_super=search_super@entry=1) at class.c:913
 #25 0x000055946cf48ac8 in rb_include_module (klass=94096135960920, module=module@entry=94096115734160) at class.c:870
 #26 0x000055946cd84993 in rb_mod_append_features (module=94096115734160, include=<optimized out>) at eval.c:1178
 #27 0x000055946cf06829 in vm_call0_cfunc_with_frame (ci=0x7ffd6f6c9a20, cc=0x7ffd6f6c9ba0, argv=0x7ffd6f6c9ba0, calling=0x7ffd6f6c9a30, ec=0x55946da519c8) at vm_eval.c:87
 #28 vm_call0_cfunc (argv=0x7ffd6f6c9ba0, cc=0x7ffd6f6c9ba0, ci=0x7ffd6f6c9a20, calling=0x7ffd6f6c9a30, ec=0x55946da519c8) at vm_eval.c:102
 #29 vm_call0_body (ec=ec@entry=0x55946da519c8, calling=calling@entry=0x7ffd6f6c9ae0, ci=ci@entry=0x7ffd6f6c9ad0, cc=cc@entry=0x7ffd6f6c9b00, argv=argv@entry=0x7ffd6f6c9ba0) at vm_eval.c:133
 #30 0x000055946cf074b2 in vm_call0 (me=<optimized out>, argv=0x7ffd6f6c9ba0, argc=1, id=4849, recv=94096115734160, ec=0x55946da519c8) at vm_eval.c:60
 #31 rb_call0 (ec=0x55946da519c8, recv=94096115734160, mid=4849, mid@entry=94096135960920, argc=argc@entry=1, argv=argv@entry=0x7ffd6f6c9ba0, scope=scope@entry=CALL_FCALL, self=94096135960920) at vm_eval.c:302
 #32 0x000055946cf07b9b in rb_call (scope=CALL_FCALL, argv=0x7ffd6f6c9ba0, argc=1, mid=94096135960920, recv=<optimized out>) at vm_eval.c:595
 #33 rb_funcallv (recv=<optimized out>, mid=mid@entry=4849, argc=argc@entry=1, argv=argv@entry=0x7ffd6f6c9ba0) at vm_eval.c:825
 #34 0x000055946cd848a7 in rb_mod_include (argc=0, argv=0x7fc7bdb4fce8, module=94096135960920) at eval.c:1203
 #35 0x000055946cefb61f in vm_call_cfunc_with_frame (ci=0x5594710c06b0, cc=<optimized out>, calling=<optimized out>, reg_cfp=0x7fc7bdc4df00, ec=0x55946da519c8) at vm_insnhelper.c:1928
 #36 vm_call_cfunc (ec=0x55946da519c8, reg_cfp=0x7fc7bdc4df00, calling=<optimized out>, ci=0x5594710c06b0, cc=<optimized out>) at vm_insnhelper.c:1944
 #37 0x000055946cf0b5c2 in vm_exec_core (ec=ec@entry=0x55946da519c8, initial=initial@entry=0) at /tmp/ruby-build.20180216151216.13740/ruby-trunk/insns.def:779
 #38 0x000055946cf02f4c in vm_exec (ec=ec@entry=0x55946da519c8) at vm.c:1804
 #39 0x000055946cf035fc in invoke_block (captured=0x7ffd6f6ca0a0, opt_pc=<optimized out>, type=<optimized out>, cref=0x559476c23930, self=94096135960920, iseq=0x559471335ee0, ec=0x55946da519c8) at vm.c:1005
 #40 invoke_iseq_block_from_c (ec=0x55946da519c8, captured=0x7ffd6f6ca0a0, self=94096135960920, argc=<optimized out>, argv=<optimized out>, passed_block_handler=0, cref=0x559476c23930, is_lambda=0) at vm.c:1057
 #41 0x000055946cf04520 in invoke_block_from_c_bh (ec=ec@entry=0x55946da519c8, block_handler=<optimized out>, argc=argc@entry=1, argv=argv@entry=0x7ffd6f6ca108, cref=<optimized out>, is_lambda=<optimized out>, is_lambda@entry=0, force_blockarg=0, passed_block_handler=0) at vm.c:1075
 #42 0x000055946cf04958 in vm_yield_with_cref (is_lambda=0, cref=<optimized out>, argv=0x7ffd6f6ca108, argc=1, ec=0x55946da519c8) at vm.c:1112
 #43 yield_under (under=94096135960920, self=<optimized out>, argc=argc@entry=1, argv=argv@entry=0x7ffd6f6ca108) at vm_eval.c:1572
 #44 0x000055946cf04b12 in rb_mod_module_exec (argc=argc@entry=1, argv=argv@entry=0x7ffd6f6ca108, mod=<optimized out>) at vm_eval.c:1770
 #45 0x000055946ce00fc6 in rb_mod_initialize (module=94096135960920) at object.c:1978
 #46 0x000055946cf06829 in vm_call0_cfunc_with_frame (ci=0x7ffd6f6ca130, cc=0x7fc7bdb4fc98, argv=0x7fc7bdb4fc98, calling=0x7ffd6f6ca140, ec=0x55946da519c8) at vm_eval.c:87
 #47 vm_call0_cfunc (argv=0x7fc7bdb4fc98, cc=0x7fc7bdb4fc98, ci=0x7ffd6f6ca130, calling=0x7ffd6f6ca140, ec=0x55946da519c8) at vm_eval.c:102
 #48 vm_call0_body (ec=ec@entry=0x55946da519c8, calling=calling@entry=0x7ffd6f6ca1f0, ci=ci@entry=0x7ffd6f6ca1e0, cc=cc@entry=0x7ffd6f6ca210, argv=argv@entry=0x7fc7bdb4fc98) at vm_eval.c:133
 #49 0x000055946cf074b2 in vm_call0 (me=<optimized out>, argv=0x7fc7bdb4fc98, argc=0, id=3057, recv=94096135960920, ec=0x55946da519c8) at vm_eval.c:60
 #50 rb_call0 (ec=0x55946da519c8, recv=recv@entry=94096135960920, mid=mid@entry=3057, argc=argc@entry=3057, argv=argv@entry=0x0, scope=scope@entry=CALL_FCALL, self=94095983466120) at vm_eval.c:302
 #51 0x000055946cf07b9b in rb_call (scope=CALL_FCALL, argv=0x0, argc=3057, mid=3057, recv=94096135960920) at vm_eval.c:595
 #52 rb_funcallv (recv=recv@entry=94096135960920, mid=mid@entry=3057, argc=argc@entry=0, argv=argv@entry=0x7fc7bdb4fc98) at vm_eval.c:825
 #53 0x000055946cd89673 in rb_obj_call_init (obj=obj@entry=94096135960920, argc=argc@entry=0, argv=argv@entry=0x7fc7bdb4fc98) at eval.c:1590
 #54 0x000055946ce048a1 in rb_class_s_new (argc=0, argv=0x7fc7bdb4fc98, klass=<optimized out>) at object.c:2153
 #55 0x000055946cefb61f in vm_call_cfunc_with_frame (ci=0x559471339c80, cc=<optimized out>, calling=<optimized out>, reg_cfp=0x7fc7bdc4dfa8, ec=0x55946da519c8) at vm_insnhelper.c:1928
 #56 vm_call_cfunc (ec=0x55946da519c8, reg_cfp=0x7fc7bdc4dfa8, calling=<optimized out>, ci=0x559471339c80, cc=<optimized out>) at vm_insnhelper.c:1944
 #57 0x000055946cf0cb05 in vm_exec_core (ec=ec@entry=0x55946da519c8, initial=initial@entry=0) at /tmp/ruby-build.20180216151216.13740/ruby-trunk/insns.def:716
 #58 0x000055946cf02f4c in vm_exec (ec=ec@entry=0x55946da519c8) at vm.c:1804
 #59 0x000055946cf03274 in invoke_bmethod (ec=ec@entry=0x55946da519c8, iseq=iseq@entry=0x55946f15cbc0, self=self@entry=94096115734640, me=me@entry=0x559475664e28, type=type@entry=572653825, opt_pc=0, captured=0x55947158e8a0) at vm.c:1026
 #60 0x000055946cf03534 in invoke_iseq_block_from_c (ec=0x55946da519c8, captured=0x55947158e8a0, self=94096115734640, argc=<optimized out>, argv=<optimized out>, passed_block_handler=0, cref=0x0, is_lambda=1) at vm.c:1060
 #61 0x000055946cf036ce in invoke_block_from_c_proc (ec=<optimized out>, proc=<optimized out>, self=<optimized out>, argc=1, argv=<optimized out>, passed_block_handler=<optimized out>, is_lambda=<optimized out>) at vm.c:1150
 #62 0x000055946cf03811 in vm_invoke_bmethod (block_handler=<optimized out>, argv=<optimized out>, argc=1, self=<optimized out>, proc=<optimized out>, ec=0x55946da519c8) at vm.c:1175
 #63 vm_call_bmethod_body (ci=<optimized out>, cc=0x55946f625960, argv=<optimized out>, calling=0x7ffd6f6ca9b0, ec=0x55946da519c8) at vm_insnhelper.c:1971
 #64 vm_call_bmethod (ec=0x55946da519c8, cfp=0x7fc7bdc4e0c0, calling=0x7ffd6f6ca9b0, ci=<optimized out>, cc=0x55946f625960) at vm_insnhelper.c:1988
 #65 0x000055946cf03ea3 in vm_call_method (ec=0x55946da519c8, cfp=0x7fc7bdc4e0c0, calling=<optimized out>, ci=<optimized out>, cc=<optimized out>) at vm_insnhelper.c:2417
 #66 0x000055946cf0e63e in vm_exec_core (ec=ec@entry=0x55946da519c8, initial=initial@entry=0) at /tmp/ruby-build.20180216151216.13740/ruby-trunk/insns.def:797
 #67 0x000055946cf02f4c in vm_exec (ec=ec@entry=0x55946da519c8) at vm.c:1804
 #68 0x000055946cf06767 in vm_call0_body (ec=ec@entry=0x55946da519c8, calling=calling@entry=0x7ffd6f6cad00, ci=ci@entry=0x7ffd6f6cacf0, cc=cc@entry=0x7ffd6f6cad20, argv=argv@entry=0x7ffd6f6cadb0) at vm_eval.c:129
 #69 0x000055946cf074b2 in vm_call0 (me=<optimized out>, argv=0x7ffd6f6cadb0, argc=1, id=3681, recv=94096115734640, ec=0x55946da519c8) at vm_eval.c:60
 #70 rb_call0 (ec=0x55946da519c8, recv=recv@entry=94096115734640, mid=3681, argc=argc@entry=1, argv=argv@entry=0x7ffd6f6cad90, scope=scope@entry=CALL_FCALL, self=94095983452880) at vm_eval.c:302
 #71 0x000055946cf07b9b in rb_call (scope=CALL_FCALL, argv=0x7ffd6f6cad90, argc=1, mid=<optimized out>, recv=94096115734640) at vm_eval.c:595
 #72 rb_funcallv (recv=recv@entry=94096115734640, mid=<optimized out>, argc=argc@entry=1, argv=argv@entry=0x7ffd6f6cadb0) at vm_eval.c:825
 #73 0x000055946cf477d2 in rb_class_inherited (super=super@entry=94096115734640, klass=klass@entry=94096135961440) at class.c:625
 #74 0x000055946cf0f796 in vm_declare_class (super=<optimized out>, cbase=94096094868200, flags=<optimized out>, id=847387) at vm_insnhelper.c:3134
 #75 vm_define_class (super=<optimized out>, cbase=<optimized out>, flags=<optimized out>, id=847387) at vm_insnhelper.c:3167
 #76 vm_find_or_create_class_by_id (super=<optimized out>, cbase=<optimized out>, flags=<optimized out>, id=847387) at vm_insnhelper.c:3196
 #77 vm_exec_core (ec=ec@entry=0x55946da519c8, initial=initial@entry=0) at /tmp/ruby-build.20180216151216.13740/ruby-trunk/insns.def:685
 #78 0x000055946cf02f4c in vm_exec (ec=0x55946da519c8) at vm.c:1804
 #79 0x000055946cf118d1 in rb_iseq_eval (iseq=iseq@entry=0x559471f1b548) at vm.c:2046
 #80 0x000055946cdd2164 in rb_load_internal0 (ec=ec@entry=0x55946da519c8, fname=fname@entry=94096135872160, wrap=wrap@entry=0) at load.c:611
 #81 0x000055946cdd41f1 in rb_require_internal (fname=94096135872400, fname@entry=94096135872440, safe=0) at load.c:992
 #82 0x000055946cdd4493 in rb_require_safe (safe=<optimized out>, fname=94096135872440) at load.c:1038
 #83 rb_f_require (obj=<optimized out>, fname=94096135872440) at load.c:820
 #84 0x000055946cefb61f in vm_call_cfunc_with_frame (ci=0x5594708700a0, cc=<optimized out>, calling=<optimized out>, reg_cfp=0x7fc7bdc4e168, ec=0x55946da519c8) at vm_insnhelper.c:1928
 #85 vm_call_cfunc (ec=0x55946da519c8, reg_cfp=0x7fc7bdc4e168, calling=<optimized out>, ci=0x5594708700a0, cc=<optimized out>) at vm_insnhelper.c:1944
 #86 0x000055946cf03ea3 in vm_call_method (ec=0x55946da519c8, cfp=0x7fc7bdc4e168, calling=<optimized out>, ci=<optimized out>, cc=<optimized out>) at vm_insnhelper.c:2417
 #87 0x000055946cf0e63e in vm_exec_core (ec=ec@entry=0x55946da519c8, initial=initial@entry=0) at /tmp/ruby-build.20180216151216.13740/ruby-trunk/insns.def:797
 #88 0x000055946cf02f4c in vm_exec (ec=ec@entry=0x55946da519c8) at vm.c:1804
 #89 0x000055946cf035fc in invoke_block (captured=0x7fc7bdc4e490, opt_pc=<optimized out>, type=<optimized out>, cref=0x0, self=94096096426480, iseq=0x55946e49f0b8, ec=0x55946da519c8) at vm.c:1005
 #90 invoke_iseq_block_from_c (ec=0x55946da519c8, captured=0x7fc7bdc4e490, self=94096096426480, argc=<optimized out>, argv=<optimized out>, passed_block_handler=0, cref=0x0, is_lambda=0) at vm.c:1057
 #91 0x000055946cf04699 in invoke_block_from_c_bh (argc=<optimized out>, passed_block_handler=<optimized out>, cref=<optimized out>, is_lambda=<optimized out>, force_blockarg=<optimized out>, argv=<optimized out>, block_handler=<optimized out>, ec=<optimized out>) at vm.c:1075
 #92 vm_yield (argc=1, argv=0x7ffd6f6cb938, ec=<optimized out>) at vm.c:1120
 #93 rb_yield_0 (argv=0x7ffd6f6cb938, argc=1) at vm_eval.c:980
 #94 rb_yield_1 (val=94096130169040) at vm_eval.c:986
 #95 rb_yield (val=<optimized out>) at vm_eval.c:996
 #96 0x000055946cf2113d in rb_ary_each (ary=94096076222560) at array.c:1820
 #97 0x000055946cefb61f in vm_call_cfunc_with_frame (ci=0x55946ed0d090, cc=<optimized out>, calling=<optimized out>, reg_cfp=0x7fc7bdc4e478, ec=0x55946da519c8) at vm_insnhelper.c:1928
 #98 vm_call_cfunc (ec=0x55946da519c8, reg_cfp=0x7fc7bdc4e478, calling=<optimized out>, ci=0x55946ed0d090, cc=<optimized out>) at vm_insnhelper.c:1944
 #99 0x000055946cf0cb05 in vm_exec_core (ec=ec@entry=0x55946da519c8, initial=initial@entry=0) at /tmp/ruby-build.20180216151216.13740/ruby-trunk/insns.def:716
 #100 0x000055946cf02f4c in vm_exec (ec=ec@entry=0x55946da519c8) at vm.c:1804
 #101 0x000055946cf035fc in invoke_block (captured=0x7fc7bdc4e500, opt_pc=<optimized out>, type=<optimized out>, cref=0x0, self=94096096426480, iseq=0x55946e49f298, ec=0x55946da519c8) at vm.c:1005
 #102 invoke_iseq_block_from_c (ec=0x55946da519c8, captured=0x7fc7bdc4e500, self=94096096426480, argc=<optimized out>, argv=<optimized out>, passed_block_handler=0, cref=0x0, is_lambda=0) at vm.c:1057
 #103 0x000055946cf04699 in invoke_block_from_c_bh (argc=<optimized out>, passed_block_handler=<optimized out>, cref=<optimized out>, is_lambda=<optimized out>, force_blockarg=<optimized out>, argv=<optimized out>, block_handler=<optimized out>, ec=<optimized out>) at vm.c:1075
 #104 vm_yield (argc=1, argv=0x7ffd6f6cbdf8, ec=<optimized out>) at vm.c:1120
 #105 rb_yield_0 (argv=0x7ffd6f6cbdf8, argc=1) at vm_eval.c:980
 #106 rb_yield_1 (val=94096095502480) at vm_eval.c:986
 #107 rb_yield (val=<optimized out>) at vm_eval.c:996
 #108 0x000055946cf2113d in rb_ary_each (ary=94096095328480) at array.c:1820
 #109 0x000055946cefb61f in vm_call_cfunc_with_frame (ci=0x55946e8552a0, cc=<optimized out>, calling=<optimized out>, reg_cfp=0x7fc7bdc4e4e8, ec=0x55946da519c8) at vm_insnhelper.c:1928
 #110 vm_call_cfunc (ec=0x55946da519c8, reg_cfp=0x7fc7bdc4e4e8, calling=<optimized out>, ci=0x55946e8552a0, cc=<optimized out>) at vm_insnhelper.c:1944
 #111 0x000055946cf0cb05 in vm_exec_core (ec=ec@entry=0x55946da519c8, initial=initial@entry=0) at /tmp/ruby-build.20180216151216.13740/ruby-trunk/insns.def:716
 #112 0x000055946cf02f4c in vm_exec (ec=ec@entry=0x55946da519c8) at vm.c:1804
 #113 0x000055946cf06767 in vm_call0_body (ec=ec@entry=0x55946da519c8, calling=calling@entry=0x7ffd6f6cc2d0, ci=ci@entry=0x7ffd6f6cc2c0, cc=cc@entry=0x7ffd6f6cc2f0, argv=argv@entry=0x7ffd6f6cc390) at vm_eval.c:129
 #114 0x000055946cf074b2 in vm_call0 (me=<optimized out>, argv=0x7ffd6f6cc390, argc=0, id=135807, recv=94096096186440, ec=0x55946da519c8) at vm_eval.c:60
 #115 rb_call0 (ec=0x55946da519c8, recv=94096096186440, mid=135807, argc=<optimized out>, argv=argv@entry=0x8, scope=scope@entry=CALL_PUBLIC, self=94095993048320) at vm_eval.c:302
 #116 0x000055946cf0a31a in rb_call (scope=CALL_PUBLIC, argv=0x8, argc=<optimized out>, mid=<optimized out>, recv=<optimized out>) at vm_eval.c:595
 #117 rb_funcall_with_block (recv=<optimized out>, mid=<optimized out>, argc=argc@entry=0, argv=argv@entry=0x7ffd6f6cc390, passed_procval=passed_procval@entry=8) at vm_eval.c:857
 #118 0x000055946ceb319c in rb_sym_proc_call (mid=<optimized out>, argc=argc@entry=1, argv=argv@entry=0x7ffd6f6cc388, passed_proc=passed_proc@entry=8) at string.c:10480
 #119 0x000055946cf0477c in vm_yield_with_symbol (block_handler=0, argv=0x7ffd6f6cc388, argc=1, symbol=<optimized out>, ec=<optimized out>) at vm_insnhelper.c:2573
 #120 invoke_block_from_c_bh (argc=<optimized out>, passed_block_handler=<optimized out>, cref=<optimized out>, is_lambda=<optimized out>, force_blockarg=<optimized out>, argv=<optimized out>, block_handler=<optimized out>, ec=<optimized out>) at vm.c:1084
 #121 vm_yield (argc=1, argv=0x7ffd6f6cc388, ec=<optimized out>) at vm.c:1120
 #122 rb_yield_0 (argv=0x7ffd6f6cc388, argc=1) at vm_eval.c:980
 #123 rb_yield_1 (val=94096096186440) at vm_eval.c:986
 #124 rb_yield (val=<optimized out>) at vm_eval.c:996
 #125 0x000055946cf2113d in rb_ary_each (ary=94095993048320) at array.c:1820
 #126 0x000055946cefb61f in vm_call_cfunc_with_frame (ci=0x5594744d8280, cc=<optimized out>, calling=<optimized out>, reg_cfp=0x7fc7bdc4e590, ec=0x55946da519c8) at vm_insnhelper.c:1928
 #127 vm_call_cfunc (ec=0x55946da519c8, reg_cfp=0x7fc7bdc4e590, calling=<optimized out>, ci=0x5594744d8280, cc=<optimized out>) at vm_insnhelper.c:1944
 #128 0x000055946cf03ea3 in vm_call_method (ec=0x55946da519c8, cfp=0x7fc7bdc4e590, calling=<optimized out>, ci=<optimized out>, cc=<optimized out>) at vm_insnhelper.c:2417
 #129 0x000055946cf0cb05 in vm_exec_core (ec=ec@entry=0x55946da519c8, initial=initial@entry=0) at /tmp/ruby-build.20180216151216.13740/ruby-trunk/insns.def:716
 #130 0x000055946cf02f4c in vm_exec (ec=ec@entry=0x55946da519c8) at vm.c:1804
 #131 0x000055946cf035fc in invoke_block (captured=0x7ffd6f6cc8e0, opt_pc=<optimized out>, type=<optimized out>, cref=0x559474604128, self=94096096426480, iseq=0x5594745027e8, ec=0x55946da519c8) at vm.c:1005
 #132 invoke_iseq_block_from_c (ec=0x55946da519c8, captured=0x7ffd6f6cc8e0, self=94096096426480, argc=<optimized out>, argv=<optimized out>, passed_block_handler=0, cref=0x559474604128, is_lambda=0) at vm.c:1057
 #133 0x000055946cf04520 in invoke_block_from_c_bh (ec=ec@entry=0x55946da519c8, block_handler=<optimized out>, argc=argc@entry=1, argv=argv@entry=0x7fc7bdb4f7f8, cref=<optimized out>, is_lambda=<optimized out>, is_lambda@entry=0, force_blockarg=0, passed_block_handler=0) at vm.c:1075
 #134 0x000055946cf04958 in vm_yield_with_cref (is_lambda=0, cref=<optimized out>, argv=0x7fc7bdb4f7f8, argc=1, ec=0x55946da519c8) at vm.c:1112
 #135 yield_under (under=94096093646040, self=<optimized out>, argc=1, argv=0x7fc7bdb4f7f8) at vm_eval.c:1572
 #136 0x000055946cefb61f in vm_call_cfunc_with_frame (ci=0x55946e5cd230, cc=<optimized out>, calling=<optimized out>, reg_cfp=0x7fc7bdc4e600, ec=0x55946da519c8) at vm_insnhelper.c:1928
 #137 vm_call_cfunc (ec=0x55946da519c8, reg_cfp=0x7fc7bdc4e600, calling=<optimized out>, ci=0x55946e5cd230, cc=<optimized out>) at vm_insnhelper.c:1944
 #138 0x000055946cf0cb05 in vm_exec_core (ec=ec@entry=0x55946da519c8, initial=initial@entry=0) at /tmp/ruby-build.20180216151216.13740/ruby-trunk/insns.def:716
 #139 0x000055946cf02f4c in vm_exec (ec=ec@entry=0x55946da519c8) at vm.c:1804
 #140 0x000055946cf035fc in invoke_block (captured=0x5594744c4fb0, opt_pc=<optimized out>, type=<optimized out>, cref=0x0, self=94095990659320, iseq=0x55946e192aa0, ec=0x55946da519c8) at vm.c:1005
 #141 invoke_iseq_block_from_c (ec=0x55946da519c8, captured=0x5594744c4fb0, self=94095990659320, argc=<optimized out>, argv=<optimized out>, passed_block_handler=0, cref=0x0, is_lambda=0) at vm.c:1057
 #142 0x000055946cf04699 in invoke_block_from_c_bh (argc=<optimized out>, passed_block_handler=<optimized out>, cref=<optimized out>, is_lambda=<optimized out>, force_blockarg=<optimized out>, argv=<optimized out>, block_handler=<optimized out>, ec=<optimized out>) at vm.c:1075
 #143 vm_yield (argc=1, argv=0x7ffd6f6ccdc8, ec=<optimized out>) at vm.c:1120
 #144 rb_yield_0 (argv=0x7ffd6f6ccdc8, argc=1) at vm_eval.c:980
 #145 rb_yield_1 (val=94096094867920) at vm_eval.c:986
 #146 rb_yield (val=<optimized out>) at vm_eval.c:996
 #147 0x000055946cf2113d in rb_ary_each (ary=94096094867160) at array.c:1820
 #148 0x000055946cf06829 in vm_call0_cfunc_with_frame (ci=0x7ffd6f6cce00, cc=0x7ffd6f6cce70, argv=0x7fc7bdb4f6b8, calling=0x7ffd6f6cce50, ec=0x55946da519c8) at vm_eval.c:87
 #149 vm_call0_cfunc (argv=0x7fc7bdb4f6b8, cc=0x7ffd6f6cce70, ci=0x7ffd6f6cce00, calling=0x7ffd6f6cce50, ec=0x55946da519c8) at vm_eval.c:102
 #150 vm_call0_body (ec=0x55946da519c8, calling=calling@entry=0x7ffd6f6ccec0, ci=ci@entry=0x7ffd6f6cceb0, cc=cc@entry=0x7ffd6f6ccee0, argv=0x7fc7bdb4f6b8) at vm_eval.c:133
 #151 0x000055946cf06c50 in vm_call0 (me=<optimized out>, argv=<optimized out>, argc=<optimized out>, id=<optimized out>, recv=<optimized out>, ec=<optimized out>) at vm_eval.c:60
 #152 rb_vm_call (ec=<optimized out>, recv=<optimized out>, id=<optimized out>, argc=<optimized out>, argv=<optimized out>, me=<optimized out>) at vm_eval.c:209
 #153 0x000055946cefb61f in vm_call_cfunc_with_frame (ci=0x55946dba2780, cc=<optimized out>, calling=<optimized out>, reg_cfp=0x7fc7bdc4e7c0, ec=0x55946da519c8) at vm_insnhelper.c:1928
 #154 vm_call_cfunc (ec=0x55946da519c8, reg_cfp=0x7fc7bdc4e7c0, calling=<optimized out>, ci=0x55946dba2780, cc=<optimized out>) at vm_insnhelper.c:1944
 #155 0x000055946cf03ea3 in vm_call_method (ec=0x55946da519c8, cfp=0x7fc7bdc4e7c0, calling=<optimized out>, ci=<optimized out>, cc=<optimized out>) at vm_insnhelper.c:2417
 #156 0x000055946cf0cb05 in vm_exec_core (ec=ec@entry=0x55946da519c8, initial=initial@entry=0) at /tmp/ruby-build.20180216151216.13740/ruby-trunk/insns.def:716
 #157 0x000055946cf02f4c in vm_exec (ec=0x55946da519c8) at vm.c:1804
 #158 0x000055946cf118d1 in rb_iseq_eval (iseq=iseq@entry=0x55946dfed3a8) at vm.c:2046
 #159 0x000055946cdd2164 in rb_load_internal0 (ec=ec@entry=0x55946da519c8, fname=fname@entry=94095988939080, wrap=wrap@entry=0) at load.c:611
 #160 0x000055946cdd41f1 in rb_require_internal (fname=94095988939160, fname@entry=94095988939200, safe=0) at load.c:992
 #161 0x000055946cdd4493 in rb_require_safe (safe=<optimized out>, fname=94095988939200) at load.c:1038
 #162 rb_f_require (obj=<optimized out>, fname=94095988939200) at load.c:820
 #163 0x000055946cefb61f in vm_call_cfunc_with_frame (ci=0x55946dffa920, cc=<optimized out>, calling=<optimized out>, reg_cfp=0x7fc7bdc4e948, ec=0x55946da519c8) at vm_insnhelper.c:1928
 #164 vm_call_cfunc (ec=0x55946da519c8, reg_cfp=0x7fc7bdc4e948, calling=<optimized out>, ci=0x55946dffa920, cc=<optimized out>) at vm_insnhelper.c:1944
 #165 0x000055946cf03ea3 in vm_call_method (ec=0x55946da519c8, cfp=0x7fc7bdc4e948, calling=<optimized out>, ci=<optimized out>, cc=<optimized out>) at vm_insnhelper.c:2417
 #166 0x000055946cf0b5c2 in vm_exec_core (ec=ec@entry=0x55946da519c8, initial=initial@entry=0) at /tmp/ruby-build.20180216151216.13740/ruby-trunk/insns.def:779
 #167 0x000055946cf02f4c in vm_exec (ec=0x55946da519c8) at vm.c:1804
 #168 0x000055946cf118d1 in rb_iseq_eval (iseq=iseq@entry=0x55946dfee438) at vm.c:2046
 #169 0x000055946cdd2164 in rb_load_internal0 (ec=ec@entry=0x55946da519c8, fname=fname@entry=94095993039280, wrap=wrap@entry=0) at load.c:611
 #170 0x000055946cdd41f1 in rb_require_internal (fname=fname@entry=94095993043840, safe=0) at load.c:992
 #171 0x000055946cdd4493 in rb_require_safe (safe=<optimized out>, fname=94095993043840) at load.c:1038
 #172 rb_f_require (obj=<optimized out>, fname=94095993043840) at load.c:820
 #173 0x000055946cefb61f in vm_call_cfunc_with_frame (ci=0x55946ea12160, cc=<optimized out>, calling=<optimized out>, reg_cfp=0x7fc7bdc4e9b8, ec=0x55946da519c8) at vm_insnhelper.c:1928
 #174 vm_call_cfunc (ec=0x55946da519c8, reg_cfp=0x7fc7bdc4e9b8, calling=<optimized out>, ci=0x55946ea12160, cc=<optimized out>) at vm_insnhelper.c:1944
 #175 0x000055946cf03ea3 in vm_call_method (ec=0x55946da519c8, cfp=0x7fc7bdc4e9b8, calling=<optimized out>, ci=<optimized out>, cc=<optimized out>) at vm_insnhelper.c:2417
 #176 0x000055946cf0b5c2 in vm_exec_core (ec=ec@entry=0x55946da519c8, initial=initial@entry=0) at /tmp/ruby-build.20180216151216.13740/ruby-trunk/insns.def:779
 #177 0x000055946cf02f4c in vm_exec (ec=0x55946da519c8) at vm.c:1804
 #178 0x000055946cf118d1 in rb_iseq_eval (iseq=iseq@entry=0x55946e3d7c48) at vm.c:2046
 #179 0x000055946cdd2164 in rb_load_internal0 (ec=ec@entry=0x55946da519c8, fname=fname@entry=94095988920840, wrap=<optimized out>) at load.c:611
 #180 0x000055946cdd2850 in rb_load_internal (wrap=0, fname=94095988920840) at load.c:642
 #181 rb_f_load (argc=<optimized out>, argv=<optimized out>) at load.c:710
 #182 0x000055946cefb61f in vm_call_cfunc_with_frame (ci=0x55946e7c96e0, cc=<optimized out>, calling=<optimized out>, reg_cfp=0x7fc7bdc4ea28, ec=0x55946da519c8) at vm_insnhelper.c:1928
 #183 vm_call_cfunc (ec=0x55946da519c8, reg_cfp=0x7fc7bdc4ea28, calling=<optimized out>, ci=0x55946e7c96e0, cc=<optimized out>) at vm_insnhelper.c:1944
 #184 0x000055946cf03ea3 in vm_call_method (ec=0x55946da519c8, cfp=0x7fc7bdc4ea28, calling=<optimized out>, ci=<optimized out>, cc=<optimized out>) at vm_insnhelper.c:2417
 #185 0x000055946cf0b5c2 in vm_exec_core (ec=ec@entry=0x55946da519c8, initial=initial@entry=0) at /tmp/ruby-build.20180216151216.13740/ruby-trunk/insns.def:779
 #186 0x000055946cf02f4c in vm_exec (ec=ec@entry=0x55946da519c8) at vm.c:1804
 #187 0x000055946cf035fc in invoke_block (captured=0x7fc7bdc4eae8, opt_pc=<optimized out>, type=<optimized out>, cref=0x0, self=94095998891400, iseq=0x55946e4dae10, ec=0x55946da519c8) at vm.c:1005
 #188 invoke_iseq_block_from_c (ec=0x55946da519c8, captured=0x7fc7bdc4eae8, self=94095998891400, argc=<optimized out>, argv=<optimized out>, passed_block_handler=0, cref=0x0, is_lambda=0) at vm.c:1057
 #189 0x000055946cf04699 in invoke_block_from_c_bh (argc=<optimized out>, passed_block_handler=<optimized out>, cref=<optimized out>, is_lambda=<optimized out>, force_blockarg=<optimized out>, argv=<optimized out>, block_handler=<optimized out>, ec=<optimized out>) at vm.c:1075
 #190 vm_yield (argc=1, argv=0x7ffd6f6ce8e8, ec=<optimized out>) at vm.c:1120
 #191 rb_yield_0 (argv=0x7ffd6f6ce8e8, argc=1) at vm_eval.c:980
 #192 rb_yield_1 (val=94095988924840) at vm_eval.c:986
 #193 rb_yield (val=<optimized out>) at vm_eval.c:996
 #194 0x000055946cf2113d in rb_ary_each (ary=94095988920960) at array.c:1820
 #195 0x000055946cefb61f in vm_call_cfunc_with_frame (ci=0x55946e421000, cc=<optimized out>, calling=<optimized out>, reg_cfp=0x7fc7bdc4ead0, ec=0x55946da519c8) at vm_insnhelper.c:1928
 #196 vm_call_cfunc (ec=0x55946da519c8, reg_cfp=0x7fc7bdc4ead0, calling=<optimized out>, ci=0x55946e421000, cc=<optimized out>) at vm_insnhelper.c:1944
 #197 0x000055946cf03ea3 in vm_call_method (ec=0x55946da519c8, cfp=0x7fc7bdc4ead0, calling=<optimized out>, ci=<optimized out>, cc=<optimized out>) at vm_insnhelper.c:2417
 #198 0x000055946cf0cb05 in vm_exec_core (ec=ec@entry=0x55946da519c8, initial=initial@entry=0) at /tmp/ruby-build.20180216151216.13740/ruby-trunk/insns.def:716
 #199 0x000055946cf02f4c in vm_exec (ec=0x55946da519c8) at vm.c:1804
 #200 0x000055946cf118d1 in rb_iseq_eval (iseq=iseq@entry=0x55946e35f2c0) at vm.c:2046
 #201 0x000055946cdd2164 in rb_load_internal0 (ec=ec@entry=0x55946da519c8, fname=fname@entry=94095992643280, wrap=<optimized out>) at load.c:611
 #202 0x000055946cdd2850 in rb_load_internal (wrap=0, fname=94095992643280) at load.c:642
 #203 rb_f_load (argc=<optimized out>, argv=<optimized out>) at load.c:710
 #204 0x000055946cefb61f in vm_call_cfunc_with_frame (ci=0x55946e24bb20, cc=<optimized out>, calling=<optimized out>, reg_cfp=0x7fc7bdc4ec58, ec=0x55946da519c8) at vm_insnhelper.c:1928
 #205 vm_call_cfunc (ec=0x55946da519c8, reg_cfp=0x7fc7bdc4ec58, calling=<optimized out>, ci=0x55946e24bb20, cc=<optimized out>) at vm_insnhelper.c:1944
 #206 0x000055946cf03ea3 in vm_call_method (ec=0x55946da519c8, cfp=0x7fc7bdc4ec58, calling=<optimized out>, ci=<optimized out>, cc=<optimized out>) at vm_insnhelper.c:2417
 #207 0x000055946cf0b5c2 in vm_exec_core (ec=ec@entry=0x55946da519c8, initial=initial@entry=0) at /tmp/ruby-build.20180216151216.13740/ruby-trunk/insns.def:779
 #208 0x000055946cf02f4c in vm_exec (ec=0x55946da519c8) at vm.c:1804
 #209 0x000055946cf118d1 in rb_iseq_eval (iseq=iseq@entry=0x55946e3a7390) at vm.c:2046
 #210 0x000055946cdd2164 in rb_load_internal0 (ec=ec@entry=0x55946da519c8, fname=fname@entry=94095993616120, wrap=<optimized out>) at load.c:611
 #211 0x000055946cdd2850 in rb_load_internal (wrap=0, fname=94095993616120) at load.c:642
 #212 rb_f_load (argc=<optimized out>, argv=<optimized out>) at load.c:710
 #213 0x000055946cefb61f in vm_call_cfunc_with_frame (ci=0x55946e6a00d0, cc=<optimized out>, calling=<optimized out>, reg_cfp=0x7fc7bdc4ecc8, ec=0x55946da519c8) at vm_insnhelper.c:1928
 #214 vm_call_cfunc (ec=0x55946da519c8, reg_cfp=0x7fc7bdc4ecc8, calling=<optimized out>, ci=0x55946e6a00d0, cc=<optimized out>) at vm_insnhelper.c:1944
 #215 0x000055946cf03ea3 in vm_call_method (ec=0x55946da519c8, cfp=0x7fc7bdc4ecc8, calling=<optimized out>, ci=<optimized out>, cc=<optimized out>) at vm_insnhelper.c:2417
 #216 0x000055946cf0b5c2 in vm_exec_core (ec=ec@entry=0x55946da519c8, initial=initial@entry=0) at /tmp/ruby-build.20180216151216.13740/ruby-trunk/insns.def:779
 #217 0x000055946cf02f4c in vm_exec (ec=0x55946da519c8) at vm.c:1804
 #218 0x000055946cf118d1 in rb_iseq_eval (iseq=iseq@entry=0x55946e470100) at vm.c:2046
 #219 0x000055946cdd2164 in rb_load_internal0 (ec=ec@entry=0x55946da519c8, fname=fname@entry=94095993672200, wrap=<optimized out>) at load.c:611
 #220 0x000055946cdd2850 in rb_load_internal (wrap=0, fname=94095993672200) at load.c:642
 #221 rb_f_load (argc=<optimized out>, argv=<optimized out>) at load.c:710
 #222 0x000055946cefb61f in vm_call_cfunc_with_frame (ci=0x55946e3306a0, cc=<optimized out>, calling=<optimized out>, reg_cfp=0x7fc7bdc4efa0, ec=0x55946da519c8) at vm_insnhelper.c:1928
 #223 vm_call_cfunc (ec=0x55946da519c8, reg_cfp=0x7fc7bdc4efa0, calling=<optimized out>, ci=0x55946e3306a0, cc=<optimized out>) at vm_insnhelper.c:1944
 #224 0x000055946cf03ea3 in vm_call_method (ec=0x55946da519c8, cfp=0x7fc7bdc4efa0, calling=<optimized out>, ci=<optimized out>, cc=<optimized out>) at vm_insnhelper.c:2417
 #225 0x000055946cf0b5c2 in vm_exec_core (ec=ec@entry=0x55946da519c8, initial=initial@entry=0) at /tmp/ruby-build.20180216151216.13740/ruby-trunk/insns.def:779
 #226 0x000055946cf02f4c in vm_exec (ec=0x55946da519c8) at vm.c:1804
 #227 0x000055946cf119d5 in rb_iseq_eval_main (iseq=iseq@entry=0x55946e4bbba0) at vm.c:2057
 #228 0x000055946cd83d54 in ruby_exec_internal (n=0x55946e4bbba0) at eval.c:247
 #229 0x000055946cd87fdf in ruby_exec_node (n=0x55946e4bbba0) at eval.c:311
 #230 ruby_run_node (n=<optimized out>) at eval.c:303
 #231 0x000055946cd831bf in main (argc=22, argv=0x7ffd6f6d0148) at ./main.c:42

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@62433 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
matzbot pushed a commit that referenced this pull request Mar 19, 2018
@nagachika
merge revision(s) 61562,61563,61566,61568,61569: [Backport #14269]
4b0b1d7 
	fix SEGV touching uninitialized memory

	This function can be called from boot_defclass().
	No assumption can be made about object internals.

	(lldb) run
	Process 2386 launched: './miniruby' (x86_64)
	Process 2386 stopped
	* thread #1: tid = 0x13f3b6, 0x00000001001e0b26 miniruby`rb_class_path_cached(klass=4311373720) + 20 at variable.c:321, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x8)
	    frame #0: 0x00000001001e0b26 miniruby`rb_class_path_cached(klass=4311373720) + 20 at variable.c:321
	   318  VALUE
	   319  rb_class_path_cached(VALUE klass)
	   320  {
	-> 321      st_table *ivtbl = RCLASS_IV_TBL(klass);
	   322      st_data_t n;
	   323
	   324      if (!ivtbl) return Qnil;
	(lldb) bt
	* thread #1: tid = 0x13f3b6, 0x00000001001e0b26 miniruby`rb_class_path_cached(klass=4311373720) + 20 at variable.c:321, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x8)
	  * frame #0: 0x00000001001e0b26 miniruby`rb_class_path_cached(klass=4311373720) + 20 at variable.c:321
	    frame #1: 0x000000010009cbd0 miniruby`rb_raw_obj_info(buff="0x0000000100fa5798 [2    ] T_CLASS", buff_size=256, obj=4311373720) + 1393 at gc.c:9341
	    frame #2: 0x000000010009cf16 miniruby`obj_info(obj=4311373720) + 98 at gc.c:9423
	    frame #3: 0x000000010008ca87 miniruby`newobj_init(klass=0, flags=66, v1=0, v2=0, v3=0, wb_protected=1, objspace=0x00000001007cf280, obj=4311373720) + 338 at gc.c:1887
	    frame #4: 0x000000010008cd51 miniruby`newobj_of(klass=0, flags=66, v1=0, v2=0, v3=0, wb_protected=1) + 171 at gc.c:1970
	    frame #5: 0x000000010008ce1b miniruby`rb_wb_protected_newobj_of(klass=0, flags=66) + 54 at gc.c:1990
	    frame #6: 0x0000000100027563 miniruby`class_alloc(flags=2, klass=0) + 46 at class.c:165
	    frame #7: 0x000000010002761a miniruby`rb_class_boot(super=0) + 35 at class.c:203
	    frame #8: 0x0000000100028612 miniruby`boot_defclass(name="BasicObject", super=0) + 28 at class.c:537
	    frame #9: 0x000000010002868b miniruby`Init_class_hierarchy + 26 at class.c:548
	    frame #10: 0x00000001000efe69 miniruby`InitVM_Object + 9 at object.c:3892
	    frame #11: 0x00000001000f138e miniruby`Init_Object + 57 at object.c:4122
	    frame #12: 0x00000001000a59bd miniruby`rb_call_inits + 29 at inits.c:23
	    frame #13: 0x000000010007af30 miniruby`ruby_setup + 229 at eval.c:61
	    frame #14: 0x000000010007af7e miniruby`ruby_init + 13 at eval.c:78
	    frame #15: 0x0000000100000c58 miniruby`main(argc=2, argv=0x00007fff5fbfdbf0) + 88 at main.c:41
	    frame #16: 0x00007fff88eda5ad libdyld.dylib`start + 1
	(lldb)

	fix SEGV touching uninitialized memory

	This function can be called from InitVM_Object().
	No assumption can be made about object internals.

	(lldb) run
	Process 10675 launched: './miniruby' (x86_64)
	Process 10675 stopped
	* thread #1: tid = 0x14252c, 0x00000001000bdda9 miniruby`rb_raw_obj_info(buff="0x0000000100fc1588 [0    ] T_IMEMO ment", buff_size=256, obj=4311487880) + 2489 at gc.c:9383, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x0)
	    frame #0: 0x00000001000bdda9 miniruby`rb_raw_obj_info(buff="0x0000000100fc1588 [0    ] T_IMEMO ment", buff_size=256, obj=4311487880) + 2489 at gc.c:9383
	   9380                 const rb_method_entry_t *me = &RANY(obj)->as.imemo.ment;
	   9381                 snprintf(buff, buff_size, "%s (called_id: %s, type: %s, alias: %d, owner: %s, defined_class: %s)", buff,
	   9382                          rb_id2name(me->called_id),
	-> 9383                          method_type_name(me->def->type),
	   9384                          me->def->alias_count,
	   9385                          obj_info(me->owner),
	   9386                          obj_info(me->defined_class));
	(lldb) p *me
	(rb_method_entry_t) $0 = {
	  flags = 24602
	  defined_class = 4311488400
	  def = 0x0000000000000000
	  called_id = 3057
	  owner = 4311488400
	}
	(lldb) bt
	* thread #1: tid = 0x14252c, 0x00000001000bdda9 miniruby`rb_raw_obj_info(buff="0x0000000100fc1588 [0    ] T_IMEMO ment", buff_size=256, obj=4311487880) + 2489 at gc.c:9383, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x0)
	  * frame #0: 0x00000001000bdda9 miniruby`rb_raw_obj_info(buff="0x0000000100fc1588 [0    ] T_IMEMO ment", buff_size=256, obj=4311487880) + 2489 at gc.c:9383
	    frame #1: 0x00000001000b7cbf miniruby`obj_info(obj=4311487880) + 95 at gc.c:9423
	    frame #2: 0x00000001000c16a8 miniruby`newobj_init(klass=4311488400, flags=24602, v1=0, v2=3057, v3=4311488400, wb_protected=1, objspace=0x00000001007ee280, obj=4311487880) + 424 at gc.c:1887
	    frame #3: 0x00000001000b4529 miniruby`newobj_of(klass=4311488400, flags=24602, v1=0, v2=3057, v3=4311488400, wb_protected=1) + 217 at gc.c:1970
	    frame #4: 0x00000001000b46ab miniruby`rb_imemo_new(type=imemo_ment, v1=0, v2=3057, v3=4311488400, v0=4311488400) + 75 at gc.c:2017
	    frame #5: 0x00000001002773b4 miniruby`rb_method_entry_alloc(called_id=3057, owner=4311488400, defined_class=4311488400, def=0x0000000000000000) + 52 at vm_method.c:368
	    frame #6: 0x0000000100277307 miniruby`rb_method_entry_create(called_id=3057, klass=4311488400, visi=METHOD_VISI_PRIVATE, def=0x0000000000000000) + 71 at vm_method.c:389
	    frame #7: 0x00000001002784c7 miniruby`rb_method_entry_make(klass=4311488400, mid=3057, defined_class=4311488400, visi=METHOD_VISI_PRIVATE, type=VM_METHOD_TYPE_CFUNC, def=0x0000000000000000, original_id=3057, opts=0x00007fff5fbfd9e8) + 1207 at vm_method.c:594
	    frame #8: 0x00000001002770f9 miniruby`rb_add_method(klass=4311488400, mid=3057, type=VM_METHOD_TYPE_CFUNC, opts=0x00007fff5fbfd9e8, visi=METHOD_VISI_PRIVATE) + 73 at vm_method.c:650
	    frame #9: 0x000000010027708a miniruby`rb_add_method_cfunc(klass=4311488400, mid=3057, func=(miniruby`rb_obj_dummy at object.c:1125), argc=0, visi=METHOD_VISI_PRIVATE) + 138 at vm_method.c:137
	    frame #10: 0x00000001000391e4 miniruby`rb_define_private_method(klass=4311488400, name="initialize", func=(miniruby`rb_obj_dummy at object.c:1125), argc=0) + 68 at class.c:1529
	    frame #11: 0x000000010013f5bf miniruby`InitVM_Object + 47 at object.c:3905
	    frame #12: 0x0000000100142ffd miniruby`Init_Object + 61 at object.c:4122
	    frame #13: 0x00000001000d4edd miniruby`rb_call_inits + 29 at inits.c:23
	    frame #14: 0x000000010009fe66 miniruby`ruby_setup + 198 at eval.c:61
	    frame #15: 0x000000010009febd miniruby`ruby_init + 13 at eval.c:78
	    frame #16: 0x0000000100000a4d miniruby`main(argc=2, argv=0x00007fff5fbfdbf0) + 93 at main.c:41
	    frame #17: 0x00007fff88eda5ad libdyld.dylib`start + 1
	(lldb)

	fix SEGV touching uninitialized local variable

	This imemo_name is used uninitialized because the switch
	above does not cover all possible imemo types.

	(lldb) run
	Process 26068 launched: './miniruby' (x86_64)
	Process 26068 stopped
	* thread #1: tid = 0x14ba96, 0x00007fff8a402132 libsystem_c.dylib`strlen + 18, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0xfffffffffffffff0)
	    frame #0: 0x00007fff8a402132 libsystem_c.dylib`strlen + 18
	libsystem_c.dylib`strlen:
	->  0x7fff8a402132 <+18>: pcmpeqb (%rdi), %xmm0
	    0x7fff8a402136 <+22>: pmovmskb %xmm0, %esi
	    0x7fff8a40213a <+26>: andq   $0xf, %rcx
	    0x7fff8a40213e <+30>: orq    $-0x1, %rax
	(lldb) bt
	* thread #1: tid = 0x14ba96, 0x00007fff8a402132 libsystem_c.dylib`strlen + 18, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0xfffffffffffffff0)
	  * frame #0: 0x00007fff8a402132 libsystem_c.dylib`strlen + 18
	    frame #1: 0x00000001001f1531 miniruby`BSD_vfprintf(fp=0x00007fff5fbfc9e0, fmt0="%s %s", ap=0x00007fff5fbfcbf0) + 5873 at vsnprintf.c:1026
	    frame #2: 0x00000001001ef213 miniruby`ruby_do_vsnprintf(str="0x0000000100f46450 [0    ] T_IMEMO", n=256, fmt="%s %s", ap=0x00007fff5fbfcbf0) + 131 at sprintf.c:1285
	    frame #3: 0x00000001001ef3ea miniruby`ruby_snprintf(str="0x0000000100f46450 [0    ] T_IMEMO", n=256, fmt="%s %s") + 426 at sprintf.c:1300
	    frame #4: 0x00000001000bdc61 miniruby`rb_raw_obj_info(buff="0x0000000100f46450 [0    ] T_IMEMO", buff_size=256, obj=4310983760) + 2353 at gc.c:9376
	    frame #5: 0x00000001000b7bff miniruby`obj_info(obj=4310983760) + 95 at gc.c:9428
	    frame #6: 0x00000001000c1658 miniruby`newobj_init(klass=0, flags=36890, v1=0, v2=4303040512, v3=4310983800, wb_protected=1, objspace=0x00000001007ee280, obj=4310983760) + 424 at gc.c:1887
	    frame #7: 0x00000001000b4469 miniruby`newobj_of(klass=0, flags=36890, v1=0, v2=4303040512, v3=4310983800, wb_protected=1) + 217 at gc.c:1970
	    frame #8: 0x00000001000b45eb miniruby`rb_imemo_new(type=imemo_ast, v1=0, v2=4303040512, v3=4310983800, v0=0) + 75 at gc.c:2017
	    frame #9: 0x000000010011daed miniruby`rb_ast_new + 61 at node.c:1146
	    frame #10: 0x0000000100160e15 miniruby`rb_parser_compile_file_path(vparser=4310984400, fname=4310984960, file=4310984080, start=1) + 53 at parse.y:5776
	    frame #11: 0x00000001001e18ea miniruby`load_file_internal(argp_v=140734799795024) + 1834 at ruby.c:1907
	    frame #12: 0x00000001000a1bb5 miniruby`rb_ensure(b_proc=(miniruby`load_file_internal at ruby.c:1795), data1=140734799795024, e_proc=(miniruby`restore_load_file at ruby.c:2007), data2=140734799795024) + 245 at eval.c:1037
	    frame #13: 0x00000001001df4a4 miniruby`load_file(parser=4310984400, fname=4310984960, f=4310984080, script=1, opt=0x00007fff5fbfda28) + 100 at ruby.c:2026
	    frame #14: 0x00000001001e084e miniruby`process_options(argc=0, argv=0x00007fff5fbfdc00, opt=0x00007fff5fbfda28) + 3454 at ruby.c:1682
	    frame #15: 0x00000001001dfaae miniruby`ruby_process_options(argc=2, argv=0x00007fff5fbfdbf0) + 238 at ruby.c:2257
	    frame #16: 0x000000010009ff43 miniruby`ruby_options(argc=2, argv=0x00007fff5fbfdbf0) + 211 at eval.c:105
	    frame #17: 0x0000000100000989 miniruby`main(argc=2, argv=0x00007fff5fbfdbf0) + 105 at main.c:42
	    frame #18: 0x00007fff88eda5ad libdyld.dylib`start + 1
	(lldb) up 4
	frame #4: 0x00000001000bdc61 miniruby`rb_raw_obj_info(buff="0x0000000100f46450 [0    ] T_IMEMO", buff_size=256, obj=4310983760) + 2353 at gc.c:9376
	   9373 #undef IMEMO_NAME
	   9374               default: UNREACHABLE;
	   9375             }
	-> 9376             snprintf(buff, buff_size, "%s %s", buff, imemo_name);
	   9377
	   9378             switch (imemo_type(obj)) {
	   9379               case imemo_ment: {
	(lldb) p imemo_name
	(const char *) $0 = 0xffffffffffffffff
	(lldb) p imemo_type(obj)
	(imemo_type) $1 = imemo_ast
	(lldb)

	fix SEGV inspecting already freed objects

	obj_info() assumes the given object is alive.  Passing freed
	objects to it results in SEGV.

	(lldb) run
	Process 29718 launched: './miniruby' (x86_64)
	Process 29718 stopped
	* thread #1: tid = 0x3082c5, 0x00000001000bfaab miniruby`pathobj_path(pathobj=4478683640) + 70 at vm_core.h:269, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x0)
	    frame #0: 0x00000001000bfaab miniruby`pathobj_path(pathobj=4478683640) + 70 at vm_core.h:269
	   266      }
	   267      else {
	   268          VM_ASSERT(RB_TYPE_P(pathobj, T_ARRAY));
	-> 269          return RARRAY_AREF(pathobj, PATHOBJ_PATH);
	   270      }
	   271  }
	   272
	(lldb) bt
	* thread #1: tid = 0x3082c5, 0x00000001000bfaab miniruby`pathobj_path(pathobj=4478683640) + 70 at vm_core.h:269, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x0)
	  * frame #0: 0x00000001000bfaab miniruby`pathobj_path(pathobj=4478683640) + 70 at vm_core.h:269
	    frame #1: 0x00000001000c25ff miniruby`rb_iseq_path(iseq=0x000000010af34a20) + 32 at iseq.c:723
	    frame #2: 0x000000010009db09 miniruby`rb_raw_iseq_info(buff="0x000000010af34a20 [1    ] T_IMEMO iseq", buff_size=256, iseq=0x000000010af34a20) + 69 at gc.c:9274
	    frame #3: 0x000000010009e45a miniruby`rb_raw_obj_info(buff="0x000000010af34a20 [1    ] T_IMEMO iseq", buff_size=256, obj=4478683680) + 2191 at gc.c:9397
	    frame #4: 0x000000010009e4d5 miniruby`obj_info(obj=4478683680) + 98 at gc.c:9429
	    frame #5: 0x0000000100091ae3 miniruby`gc_page_sweep(objspace=0x00000001007d3280, heap=0x00000001007d32a0, sweep_page=0x000000010ae07bc0) + 622 at gc.c:3529
	    frame #6: 0x000000010009206a miniruby`gc_sweep_step(objspace=0x00000001007d3280, heap=0x00000001007d32a0) + 188 at gc.c:3705
	    frame #7: 0x0000000100092254 miniruby`gc_sweep_continue(objspace=0x00000001007d3280, heap=0x00000001007d32a0) + 133 at gc.c:3772
	    frame #8: 0x000000010008d7f9 miniruby`heap_prepare(objspace=0x00000001007d3280, heap=0x00000001007d32a0) + 48 at gc.c:1746
	    frame #9: 0x000000010008d8a1 miniruby`heap_get_freeobj_from_next_freepage(objspace=0x00000001007d3280, heap=0x00000001007d32a0) + 37 at gc.c:1769
	    frame #10: 0x000000010008d98d miniruby`heap_get_freeobj(objspace=0x00000001007d3280, heap=0x00000001007d32a0) + 83 at gc.c:1803
	    frame #11: 0x000000010008dcb0 miniruby`newobj_slowpath(klass=4334386280, flags=5, v1=0, v2=0, v3=0, objspace=0x00000001007d3280, wb_protected=1) + 220 at gc.c:1930
	    frame #12: 0x000000010008dd6c miniruby`newobj_slowpath_wb_protected(klass=4334386280, flags=5, v1=0, v2=0, v3=0, objspace=0x00000001007d3280) + 76 at gc.c:1942
	    frame #13: 0x000000010008dea1 miniruby`newobj_of(klass=4334386280, flags=5, v1=0, v2=0, v3=0, wb_protected=1) + 221 at gc.c:1974
	    frame #14: 0x000000010008df39 miniruby`rb_wb_protected_newobj_of(klass=4334386280, flags=5) + 54 at gc.c:1990
	    frame #15: 0x0000000100195f7c miniruby`str_alloc(klass=4334386280) + 29 at string.c:692
	    frame #16: 0x0000000100195fe9 miniruby`str_new0(klass=4334386280, ptr="gitm", len=4, termlen=1) + 73 at string.c:714
	    frame #17: 0x000000010019633e miniruby`rb_enc_str_new(ptr="gitm", len=4, enc=0x00000001025d50a0) + 81 at string.c:766
	    frame #18: 0x000000010010a80a miniruby`parser_str_new(p="gitm", n=4, enc=0x00000001025d50a0, func=66, enc0=0x00000001025d50a0) + 50 at parse.y:5817
	    frame #19: 0x000000010010ce1a miniruby`parser_parse_string(parser=0x00000001042ac5c0, quote=0x000000010460c028) + 795 at parse.y:6675
	    frame #20: 0x00000001001120bd miniruby`parser_yylex(parser=0x00000001042ac5c0) + 159 at parse.y:8281
	    frame #21: 0x0000000100115068 miniruby`yylex(lval=0x00007fff5fbf9948, yylloc=0x00007fff5fbf9ab0, parser=0x00000001042ac5c0) + 55 at parse.y:8931
	    frame #22: 0x00000001000fc79f miniruby`ruby_yyparse(parser=0x00000001042ac5c0) + 1198 at parse.c:5798
	    frame #23: 0x0000000100109f5a miniruby`yycompile0(arg=4364879296) + 317 at parse.y:5595
	    frame #24: 0x0000000100214ef0 miniruby`rb_suppress_tracing(func=(miniruby`yycompile0 at parse.y:5565), arg=4364879296) + 349 at vm_trace.c:397
	    frame #25: 0x000000010010a1df miniruby`yycompile(parser=0x00000001042ac5c0, fname=4443743440, line=1) + 126 at parse.y:5637
	    frame #26: 0x000000010010a4c1 miniruby`parser_compile_string(vparser=4443743480, fname=4443743440, s=4443743520, line=1) + 191 at parse.y:5706
	    frame #27: 0x000000010010a5b7 miniruby`rb_parser_compile_string_path(vparser=4443743480, f=4443743440, s=4443743520, line=1) + 58 at parse.y:5730
	    frame #28: 0x0000000100206025 miniruby`eval_make_iseq(src=4443743520, fname=4443743440, line=1, bind=0x0000000000000000, base_block=0x00007fff5fbfb370) + 266 at vm_eval.c:1274
	    frame #29: 0x0000000100206153 miniruby`eval_string_with_cref(self=4334412520, src=4443743520, cref=0x0000000000000000, file=52, line=1) + 197 at vm_eval.c:1307
	    frame #30: 0x0000000100206389 miniruby`rb_f_eval(argc=1, argv=0x0000000102400eb8, self=4334412520) + 219 at vm_eval.c:1382
	    frame #31: 0x00000001001f247c miniruby`call_cfunc_m1(func=(miniruby`rb_f_eval at vm_eval.c:1364), recv=4334412520, argc=1, argv=0x0000000102400eb8) + 47 at vm_insnhelper.c:1723
	    frame #32: 0x00000001001f2f87 miniruby`vm_call_cfunc_with_frame(ec=0x00000001007d3548, reg_cfp=0x0000000102500d80, calling=0x00007fff5fbfbf50, ci=0x000000010263f240, cc=0x0000000100749b50) + 386 at vm_insnhelper.c:1918
	    frame #33: 0x00000001001f30d6 miniruby`vm_call_cfunc(ec=0x00000001007d3548, reg_cfp=0x0000000102500d80, calling=0x00007fff5fbfbf50, ci=0x000000010263f240, cc=0x0000000100749b50) + 149 at vm_insnhelper.c:1934
	    frame #34: 0x00000001001faf0e miniruby`vm_exec_core(ec=0x00000001007d3548, initial=0) + 8471 at insns.def:915
	    frame #35: 0x000000010020b75d miniruby`vm_exec(ec=0x00000001007d3548) + 230 at vm.c:1771
	    frame #36: 0x00000001002093f8 miniruby`invoke_block(ec=0x00000001007d3548, iseq=0x000000010252d7f0, self=4334412520, captured=0x0000000102500df8, cref=0x0000000000000000, type=572653569, opt_pc=0) + 224 at vm.c:988
	    frame #37: 0x0000000100209766 miniruby`invoke_iseq_block_from_c(ec=0x00000001007d3548, captured=0x0000000102500df8, self=4334412520, argc=0, argv=0x0000000000000000, passed_block_handler=0, cref=0x0000000000000000, is_lambda=0) + 389 at vm.c:1040
	    frame #38: 0x0000000100209824 miniruby`invoke_block_from_c_bh(ec=0x00000001007d3548, block_handler=4333768185, argc=0, argv=0x0000000000000000, passed_block_handler=0, cref=0x0000000000000000, is_lambda=0, force_blockarg=0) + 138 at vm.c:1058
	    frame #39: 0x00000001002099d0 miniruby`vm_yield(ec=0x00000001007d3548, argc=0, argv=0x0000000000000000) + 69 at vm.c:1103
	    frame #40: 0x0000000100205623 miniruby`rb_yield_0(argc=0, argv=0x0000000000000000) + 40 at vm_eval.c:970
	    frame #41: 0x0000000100205964 miniruby`loop_i + 19 at vm_eval.c:1049
	    frame #42: 0x000000010007db07 miniruby`rb_rescue2(b_proc=(miniruby`loop_i at vm_eval.c:1047), data1=0, r_proc=(miniruby`loop_stop at vm_eval.c:1056), data2=0) + 369 at eval.c:896
	    frame #43: 0x0000000100205a2e miniruby`rb_f_loop(self=4334412520) + 121 at vm_eval.c:1100
	    frame #44: 0x00000001001f24a7 miniruby`call_cfunc_0(func=(miniruby`rb_f_loop at vm_eval.c:1098), recv=4334412520, argc=0, argv=0x0000000102400e80) + 41 at vm_insnhelper.c:1729
	    frame #45: 0x00000001001f2f87 miniruby`vm_call_cfunc_with_frame(ec=0x00000001007d3548, reg_cfp=0x0000000102500de0, calling=0x00007fff5fbfd4d0, ci=0x000000010263bbf0, cc=0x0000000102642118) + 386 at vm_insnhelper.c:1918
	    frame #46: 0x00000001001f30d6 miniruby`vm_call_cfunc(ec=0x00000001007d3548, reg_cfp=0x0000000102500de0, calling=0x00007fff5fbfd4d0, ci=0x000000010263bbf0, cc=0x0000000102642118) + 149 at vm_insnhelper.c:1934
	    frame #47: 0x00000001001f4319 miniruby`vm_call_method_each_type(ec=0x00000001007d3548, cfp=0x0000000102500de0, calling=0x00007fff5fbfd4d0, ci=0x000000010263bbf0, cc=0x0000000102642118) + 239 at vm_insnhelper.c:2232
	    frame #48: 0x00000001001f4a2c miniruby`vm_call_method(ec=0x00000001007d3548, cfp=0x0000000102500de0, calling=0x00007fff5fbfd4d0, ci=0x000000010263bbf0, cc=0x0000000102642118) + 253 at vm_insnhelper.c:2366
	    frame #49: 0x00000001001f4b7a miniruby`vm_call_general(ec=0x00000001007d3548, reg_cfp=0x0000000102500de0, calling=0x00007fff5fbfd4d0, ci=0x000000010263bbf0, cc=0x0000000102642118) + 59 at vm_insnhelper.c:2398
	    frame #50: 0x00000001001fab2f miniruby`vm_exec_core(ec=0x00000001007d3548, initial=0) + 7480 at insns.def:850
	    frame #51: 0x000000010020b75d miniruby`vm_exec(ec=0x00000001007d3548) + 230 at vm.c:1771
	    frame #52: 0x000000010020c40f miniruby`rb_iseq_eval_main(iseq=0x000000010252dd90) + 52 at vm.c:2019
	    frame #53: 0x000000010007c768 miniruby`ruby_exec_internal(n=0x000000010252dd90) + 297 at eval.c:246
	    frame #54: 0x000000010007c88e miniruby`ruby_exec_node(n=0x000000010252dd90) + 36 at eval.c:310
	    frame #55: 0x000000010007c861 miniruby`ruby_run_node(n=0x000000010252dd90) + 62 at eval.c:302
	    frame #56: 0x000000010000138d miniruby`main(argc=2, argv=0x00007fff5fbfdbf0) + 113 at main.c:42
	    frame #57: 0x00007fff88eda5ad libdyld.dylib`start + 1
	(lldb) p ((struct RVALUE*)pathobj)->as.basic
	(RBasic) $0 = (flags = 0, klass = 4478683600)
	(lldb)

	fix SEGV inspecting uninitialized objects

	obj_info() assumes the given object is alive.  OTOH
	gc_writebarrier_incremental is called before or in middle of
	object initialization.  Can casue SEGV.

	(lldb) run
	Process 48188 launched: './miniruby' (x86_64)
	Process 48188 stopped
	* thread #1: tid = 0x30fd53, 0x00000001000bf7a9 miniruby`rb_array_const_ptr(a=5251291222225483145) + 12 at ruby.h:2072, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=EXC_I386_GPFLT)
	    frame #0: 0x00000001000bf7a9 miniruby`rb_array_const_ptr(a=5251291222225483145) + 12 at ruby.h:2072
	   2069 static inline const VALUE *
	   2070 rb_array_const_ptr(VALUE a)
	   2071 {
	-> 2072     return FIX_CONST_VALUE_PTR((RBASIC(a)->flags & RARRAY_EMBED_FLAG) ?
	   2073         RARRAY(a)->as.ary : RARRAY(a)->as.heap.ptr);
	   2074 }
	   2075
	(lldb) bt
	* thread #1: tid = 0x30fd53, 0x00000001000bf7a9 miniruby`rb_array_const_ptr(a=5251291222225483145) + 12 at ruby.h:2072, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=EXC_I386_GPFLT)
	  * frame #0: 0x00000001000bf7a9 miniruby`rb_array_const_ptr(a=5251291222225483145) + 12 at ruby.h:2072
	    frame #1: 0x00000001000bfaab miniruby`pathobj_path(pathobj=5251291222225483145) + 70 at vm_core.h:269
	    frame #2: 0x00000001000c25ff miniruby`rb_iseq_path(iseq=0x00000001025b71a8) + 32 at iseq.c:723
	    frame #3: 0x000000010009db09 miniruby`rb_raw_iseq_info(buff="0x00000001025b7158 [0    ] proc (Proc)", buff_size=256, iseq=0x00000001025b71a8) + 69 at gc.c:9274
	    frame #4: 0x000000010009e1d5 miniruby`rb_raw_obj_info(buff="0x00000001025b7158 [0    ] proc (Proc)", buff_size=256, obj=4334514520) + 1546 at gc.c:9351
	    frame #5: 0x000000010009e4d5 miniruby`obj_info(obj=4334514520) + 98 at gc.c:9429
	    frame #6: 0x0000000100096658 miniruby`gc_writebarrier_incremental(a=4334514520, b=4334514600, objspace=0x00000001007d3280) + 61 at gc.c:5963
	    frame #7: 0x00000001000968ca miniruby`rb_gc_writebarrier(a=4334514520, b=4334514600) + 127 at gc.c:6009
	    frame #8: 0x00000001001eabe0 miniruby`rb_obj_written(a=4334514520, oldv=52, b=4334514600, filename="/Users/urabe.shyouhei/data/src/pedantic/vm.c", line=821) + 72 at ruby.h:1472
	    frame #9: 0x00000001001eac2c miniruby`rb_obj_write(a=4334514520, slot=0x000000010259ff10, b=4334514600, filename="/Users/urabe.shyouhei/data/src/pedantic/vm.c", line=821) + 70 at ruby.h:1489
	    frame #10: 0x0000000100208b6f miniruby`vm_proc_create_from_captured(klass=4311027960, captured=0x0000000102500338, block_type=block_type_ifunc, is_from_method='\0', is_lambda='\x01') + 137 at vm.c:821
	    frame #11: 0x0000000100208e5c miniruby`rb_vm_make_proc_lambda(ec=0x00000001007d3548, captured=0x0000000102500338, klass=4311027960, is_lambda='\x01') + 134 at vm.c:892
	    frame #12: 0x000000010011f08e miniruby`proc_new(klass=4311027960, is_lambda='\x01') + 445 at proc.c:752
	    frame #13: 0x000000010011f110 miniruby`rb_block_lambda + 27 at proc.c:808
	    frame #14: 0x00000001001f24a7 miniruby`call_cfunc_0(func=(miniruby`rb_block_lambda at proc.c:807), recv=4310991600, argc=0, argv=0x0000000000000000) + 41 at vm_insnhelper.c:1729
	    frame #15: 0x00000001002033de miniruby`vm_call0_cfunc_with_frame(ec=0x00000001007d3548, calling=0x00007fff5fbfb080, ci=0x00007fff5fbfb070, cc=0x00007fff5fbfb0a0, argv=0x0000000000000000) + 370 at vm_eval.c:85
	    frame #16: 0x00000001002034d9 miniruby`vm_call0_cfunc(ec=0x00000001007d3548, calling=0x00007fff5fbfb080, ci=0x00007fff5fbfb070, cc=0x00007fff5fbfb0a0, argv=0x0000000000000000) + 59 at vm_eval.c:100
	    frame #17: 0x000000010020368f miniruby`vm_call0_body(ec=0x00000001007d3548, calling=0x00007fff5fbfb080, ci=0x00007fff5fbfb070, cc=0x00007fff5fbfb0a0, argv=0x0000000000000000) + 436 at vm_eval.c:131
	    frame #18: 0x000000010020326a miniruby`vm_call0(ec=0x00000001007d3548, recv=4310991600, id=2993, argc=0, argv=0x0000000000000000, me=0x0000000100f48110) + 142 at vm_eval.c:58
	    frame #19: 0x0000000100203c60 miniruby`rb_call0(ec=0x00000001007d3548, recv=4310991600, mid=2993, argc=0, argv=0x0000000000000000, scope=CALL_FCALL, self=4334514640) + 166 at vm_eval.c:296
	    frame #20: 0x0000000100204827 miniruby`rb_call(recv=4310991600, mid=2993, argc=0, argv=0x0000000000000000, scope=CALL_FCALL) + 84 at vm_eval.c:589
	    frame #21: 0x000000010020518b miniruby`rb_funcallv(recv=4310991600, mid=2993, argc=0, argv=0x0000000000000000) + 52 at vm_eval.c:815
	    frame #22: 0x000000010012242e miniruby`mlambda(method=0) + 45 at proc.c:2661
	    frame #23: 0x0000000100205bac miniruby`rb_iterate0(it_proc=(miniruby`mlambda at proc.c:2660), data1=0, ifunc=0x00000001025b71a8, ec=0x00000001007d3548) + 380 at vm_eval.c:1134
	    frame #24: 0x0000000100205d16 miniruby`rb_iterate(it_proc=(miniruby`mlambda at proc.c:2660), data1=0, bl_proc=(miniruby`bmcall at proc.c:2666), data2=4334514640) + 88 at vm_eval.c:1166
	    frame #25: 0x00000001001224c7 miniruby`method_to_proc(method=4334514640) + 43 at proc.c:2701
	    frame #26: 0x00000001001f24a7 miniruby`call_cfunc_0(func=(miniruby`method_to_proc at proc.c:2688), recv=4334514640, argc=0, argv=0x0000000102400568) + 41 at vm_insnhelper.c:1729
	    frame #27: 0x00000001001f2f87 miniruby`vm_call_cfunc_with_frame(ec=0x00000001007d3548, reg_cfp=0x0000000102500350, calling=0x00007fff5fbfc030, ci=0x0000000100f2ec70, cc=0x0000000102735718) + 386 at vm_insnhelper.c:1918
	    frame #28: 0x00000001001f30d6 miniruby`vm_call_cfunc(ec=0x00000001007d3548, reg_cfp=0x0000000102500350, calling=0x00007fff5fbfc030, ci=0x0000000100f2ec70, cc=0x0000000102735718) + 149 at vm_insnhelper.c:1934
	    frame #29: 0x00000001001f4319 miniruby`vm_call_method_each_type(ec=0x00000001007d3548, cfp=0x0000000102500350, calling=0x00007fff5fbfc030, ci=0x0000000100f2ec70, cc=0x0000000102735718) + 239 at vm_insnhelper.c:2232
	    frame #30: 0x00000001001f49a4 miniruby`vm_call_method(ec=0x00000001007d3548, cfp=0x0000000102500350, calling=0x00007fff5fbfc030, ci=0x0000000100f2ec70, cc=0x0000000102735718) + 117 at vm_insnhelper.c:2355
	    frame #31: 0x00000001001f4b7a miniruby`vm_call_general(ec=0x00000001007d3548, reg_cfp=0x0000000102500350, calling=0x00007fff5fbfc030, ci=0x0000000100f2ec70, cc=0x0000000102735718) + 59 at vm_insnhelper.c:2398
	    frame #32: 0x00000001001faf0e miniruby`vm_exec_core(ec=0x00000001007d3548, initial=0) + 8471 at insns.def:915
	    frame #33: 0x000000010020b75d miniruby`vm_exec(ec=0x00000001007d3548) + 230 at vm.c:1771
	    frame #34: 0x000000010020c3d1 miniruby`rb_iseq_eval(iseq=0x00000001007f8270) + 52 at vm.c:2008
	    frame #35: 0x00000001000caa4a miniruby`rb_load_internal0(ec=0x00000001007d3548, fname=4310799960, wrap=0) + 631 at load.c:611
	    frame #36: 0x00000001000cab36 miniruby`rb_load_internal(fname=4310799960, wrap=0) + 46 at load.c:642
	    frame #37: 0x00000001000cae1d miniruby`rb_f_load(argc=1, argv=0x00000001024004b8) + 217 at load.c:710
	    frame #38: 0x00000001001f247c miniruby`call_cfunc_m1(func=(miniruby`rb_f_load at load.c:695), recv=4311327440, argc=1, argv=0x00000001024004b8) + 47 at vm_insnhelper.c:1723
	    frame #39: 0x00000001001f2f87 miniruby`vm_call_cfunc_with_frame(ec=0x00000001007d3548, reg_cfp=0x00000001025003e0, calling=0x00007fff5fbfd3e0, ci=0x0000000102541070, cc=0x0000000100f9e918) + 386 at vm_insnhelper.c:1918
	    frame #40: 0x00000001001f30d6 miniruby`vm_call_cfunc(ec=0x00000001007d3548, reg_cfp=0x00000001025003e0, calling=0x00007fff5fbfd3e0, ci=0x0000000102541070, cc=0x0000000100f9e918) + 149 at vm_insnhelper.c:1934
	    frame #41: 0x00000001001f4319 miniruby`vm_call_method_each_type(ec=0x00000001007d3548, cfp=0x00000001025003e0, calling=0x00007fff5fbfd3e0, ci=0x0000000102541070, cc=0x0000000100f9e918) + 239 at vm_insnhelper.c:2232
	    frame #42: 0x00000001001f4a2c miniruby`vm_call_method(ec=0x00000001007d3548, cfp=0x00000001025003e0, calling=0x00007fff5fbfd3e0, ci=0x0000000102541070, cc=0x0000000100f9e918) + 253 at vm_insnhelper.c:2366
	    frame #43: 0x00000001001f4b7a miniruby`vm_call_general(ec=0x00000001007d3548, reg_cfp=0x00000001025003e0, calling=0x00007fff5fbfd3e0, ci=0x0000000102541070, cc=0x0000000100f9e918) + 59 at vm_insnhelper.c:2398
	    frame #44: 0x00000001001faf0e miniruby`vm_exec_core(ec=0x00000001007d3548, initial=0) + 8471 at insns.def:915
	    frame #45: 0x000000010020b75d miniruby`vm_exec(ec=0x00000001007d3548) + 230 at vm.c:1771
	    frame #46: 0x000000010020c40f miniruby`rb_iseq_eval_main(iseq=0x0000000100f21240) + 52 at vm.c:2019
	    frame #47: 0x000000010007c774 miniruby`ruby_exec_internal(n=0x0000000100f21240) + 297 at eval.c:246
	    frame #48: 0x000000010007c89a miniruby`ruby_exec_node(n=0x0000000100f21240) + 36 at eval.c:310
	    frame #49: 0x000000010007c86d miniruby`ruby_run_node(n=0x0000000100f21240) + 62 at eval.c:302
	    frame #50: 0x0000000100001399 miniruby`main(argc=9, argv=0x00007fff5fbfdae0) + 113 at main.c:42
	    frame #51: 0x00007fff88eda5ad libdyld.dylib`start + 1
	(lldb)

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_4@62850 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
matzbot pushed a commit that referenced this pull request Mar 20, 2018
@nagachika
merge revision(s) 61564,61565,61571: [Backport #14270]
ab2e735 
	fix SEGV touching uninitialized memory

	This function can be called from Init_VM().
	No assumption can be made about object internals.

	(lldb) run
	Process 15734 launched: './miniruby' (x86_64)
	Process 15734 stopped
	* thread #1: tid = 0x1441d4, 0x00000001000bdfcb miniruby`rb_raw_iseq_info(buff="0x0000000100f61f48 [0    ] T_IMEMO iseq", buff_size=256, iseq=0x0000000100f61f48) + 27 at gc.c:9273, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x50)
	    frame #0: 0x00000001000bdfcb miniruby`rb_raw_iseq_info(buff="0x0000000100f61f48 [0    ] T_IMEMO iseq", buff_size=256, iseq=0x0000000100f61f48) + 27 at gc.c:9273
	   9270 static void
	   9271 rb_raw_iseq_info(char *buff, const int buff_size, const rb_iseq_t *iseq)
	   9272 {
	-> 9273     if (iseq->body->location.label) {
	   9274         VALUE path = rb_iseq_path(iseq);
	   9275         snprintf(buff, buff_size, "%s %s@%s:%d", buff,
	   9276                  RSTRING_PTR(iseq->body->location.label),
	(lldb) p *iseq
	(rb_iseq_t) $0 = {
	  flags = 28698
	  reserved1 = 0
	  body = 0x0000000000000000
	  aux = {
	    compile_data = 0x0000000000000000
	    loader = (obj = 0, index = 0)
	    trace_events = 0
	  }
	}
	(lldb) bt
	* thread #1: tid = 0x1441d4, 0x00000001000bdfcb miniruby`rb_raw_iseq_info(buff="0x0000000100f61f48 [0    ] T_IMEMO iseq", buff_size=256, iseq=0x0000000100f61f48) + 27 at gc.c:9273, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x50)
	  * frame #0: 0x00000001000bdfcb miniruby`rb_raw_iseq_info(buff="0x0000000100f61f48 [0    ] T_IMEMO iseq", buff_size=256, iseq=0x0000000100f61f48) + 27 at gc.c:9273
	    frame #1: 0x00000001000bde72 miniruby`rb_raw_obj_info(buff="0x0000000100f61f48 [0    ] T_IMEMO iseq", buff_size=256, obj=4311097160) + 2786 at gc.c:9396
	    frame #2: 0x00000001000b7c5f miniruby`obj_info(obj=4311097160) + 95 at gc.c:9428
	    frame #3: 0x00000001000c16a8 miniruby`newobj_init(klass=0, flags=28698, v1=0, v2=0, v3=0, wb_protected=1, objspace=0x00000001007ee280, obj=4311097160) + 424 at gc.c:1887
	    frame #4: 0x00000001000b44c9 miniruby`newobj_of(klass=0, flags=28698, v1=0, v2=0, v3=0, wb_protected=1) + 217 at gc.c:1970
	    frame #5: 0x00000001000b464b miniruby`rb_imemo_new(type=imemo_iseq, v1=0, v2=0, v3=0, v0=0) + 75 at gc.c:2017
	    frame #6: 0x00000001000fd914 miniruby`iseq_imemo_alloc + 36 at iseq.h:156
	    frame #7: 0x00000001000f6e1d miniruby`iseq_alloc + 13 at iseq.c:211
	    frame #8: 0x00000001000f6bf8 miniruby`rb_iseq_new_with_opt(node=0x0000000000000000, name=4311097200, path=4311097200, realpath=8, first_lineno=1, parent=0x0000000000000000, type=ISEQ_TYPE_TOP, option=0x0000000100335c30) + 56 at iseq.c:519
	    frame #9: 0x00000001000f6bb6 miniruby`rb_iseq_new(node=0x0000000000000000, name=4311097200, path=4311097200, realpath=8, parent=0x0000000000000000, type=ISEQ_TYPE_TOP) + 86 at iseq.c:480
	    frame #10: 0x0000000100284bb0 miniruby`Init_VM + 1040 at vm.c:3022
	    frame #11: 0x00000001000d4f7d miniruby`rb_call_inits + 189 at inits.c:55
	    frame #12: 0x000000010009fe06 miniruby`ruby_setup + 198 at eval.c:61
	    frame #13: 0x000000010009fe5d miniruby`ruby_init + 13 at eval.c:78
	    frame #14: 0x00000001000009ed miniruby`main(argc=2, argv=0x00007fff5fbfdbf0) + 93 at main.c:41
	    frame #15: 0x00007fff88eda5ad libdyld.dylib`start + 1
	(lldb)

	fix SEGV touching uninitialized memory

	This function can be called from rb_data_typed_object_zalloc().
	No assumption can be made about object internals.

	(lldb) run
	Process 22135 launched: './miniruby' (x86_64)
	Process 22135 stopped
	* thread #1: tid = 0x14a3af, 0x000000010008ac8a miniruby`vm_block_type(block=0x0000000000000000) + 12 at vm_core.h:1364, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x18)
	    frame #0: 0x000000010008ac8a miniruby`vm_block_type(block=0x0000000000000000) + 12 at vm_core.h:1364
	   1361         break;
	   1362     }
	   1363 #endif
	-> 1364     return block->type;
	   1365 }
	   1366
	   1367 static inline void
	(lldb) bt
	* thread #1: tid = 0x14a3af, 0x000000010008ac8a miniruby`vm_block_type(block=0x0000000000000000) + 12 at vm_core.h:1364, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x18)
	  * frame #0: 0x000000010008ac8a miniruby`vm_block_type(block=0x0000000000000000) + 12 at vm_core.h:1364
	    frame #1: 0x000000010008acdb miniruby`vm_block_iseq(block=0x0000000000000000) + 24 at vm_core.h:1399
	    frame #2: 0x000000010008acc1 miniruby`vm_proc_iseq(procval=4310866360) + 32 at vm_core.h:1387
	    frame #3: 0x000000010009cbed miniruby`rb_raw_obj_info(buff="0x0000000100f299b8 [0    ] proc (Proc)", buff_size=256, obj=4310866360) + 1513 at gc.c:9349
	    frame #4: 0x000000010009cf01 miniruby`obj_info(obj=4310866360) + 98 at gc.c:9428
	    frame #5: 0x000000010008ca1b miniruby`newobj_init(klass=4311027960, flags=12, v1=4298186080, v2=1, v3=0, wb_protected=32, objspace=0x00000001007cf280, obj=4310866360) + 338 at gc.c:1887
	    frame #6: 0x000000010008cce5 miniruby`newobj_of(klass=4311027960, flags=12, v1=4298186080, v2=1, v3=0, wb_protected=32) + 171 at gc.c:1970
	    frame #7: 0x000000010008d01d miniruby`rb_data_typed_object_wrap(klass=4311027960, datap=0x0000000000000000, type=0x0000000100311d60) + 133 at gc.c:2062
	    frame #8: 0x000000010008d04e miniruby`rb_data_typed_object_zalloc(klass=4311027960, size=40, type=0x0000000100311d60) + 42 at gc.c:2073
	    frame #9: 0x000000010011b459 miniruby`rb_proc_alloc(klass=4311027960) + 36 at proc.c:113
	    frame #10: 0x0000000100204d8e miniruby`vm_proc_create_from_captured(klass=4311027960, captured=0x00000001025003f8, block_type=block_type_iseq, is_from_method='\0', is_lambda='\x01') + 44 at vm.c:814
	    frame #11: 0x00000001002050d8 miniruby`rb_vm_make_proc_lambda(ec=0x00000001007cf548, captured=0x00000001025003f8, klass=4311027960, is_lambda='\x01') + 134 at vm.c:892
	    frame #12: 0x000000010011c0d2 miniruby`proc_new(klass=4311027960, is_lambda='\x01') + 445 at proc.c:752
	    frame #13: 0x000000010011c154 miniruby`rb_block_lambda + 27 at proc.c:808
	    frame #14: 0x00000001001ee7e3 miniruby`call_cfunc_0(func=(miniruby`rb_block_lambda at proc.c:807), recv=4310991600, argc=0, argv=0x0000000102400480) + 41 at vm_insnhelper.c:1729
	    frame #15: 0x00000001001ef2c3 miniruby`vm_call_cfunc_with_frame(ec=0x00000001007cf548, reg_cfp=0x00000001025003e0, calling=0x00007fff5fbfd4d0, ci=0x0000000102537be0, cc=0x000000010253e0f0) + 386 at vm_insnhelper.c:1918
	    frame #16: 0x00000001001ef412 miniruby`vm_call_cfunc(ec=0x00000001007cf548, reg_cfp=0x00000001025003e0, calling=0x00007fff5fbfd4d0, ci=0x0000000102537be0, cc=0x000000010253e0f0) + 149 at vm_insnhelper.c:1934
	    frame #17: 0x00000001001f0655 miniruby`vm_call_method_each_type(ec=0x00000001007cf548, cfp=0x00000001025003e0, calling=0x00007fff5fbfd4d0, ci=0x0000000102537be0, cc=0x000000010253e0f0) + 239 at vm_insnhelper.c:2232
	    frame #18: 0x00000001001f0ce0 miniruby`vm_call_method(ec=0x00000001007cf548, cfp=0x00000001025003e0, calling=0x00007fff5fbfd4d0, ci=0x0000000102537be0, cc=0x000000010253e0f0) + 117 at vm_insnhelper.c:2355
	    frame #19: 0x00000001001f0eb6 miniruby`vm_call_general(ec=0x00000001007cf548, reg_cfp=0x00000001025003e0, calling=0x00007fff5fbfd4d0, ci=0x0000000102537be0, cc=0x000000010253e0f0) + 59 at vm_insnhelper.c:2398
	    frame #20: 0x00000001001f6e61 miniruby`vm_exec_core(ec=0x00000001007cf548, initial=0) + 7480 at insns.def:850
	    frame #21: 0x0000000100207995 miniruby`vm_exec(ec=0x00000001007cf548) + 230 at vm.c:1771
	    frame #22: 0x0000000100208647 miniruby`rb_iseq_eval_main(iseq=0x0000000100f29fd0) + 52 at vm.c:2019
	    frame #23: 0x000000010007b750 miniruby`ruby_exec_internal(n=0x0000000100f29fd0) + 297 at eval.c:246
	    frame #24: 0x000000010007b876 miniruby`ruby_exec_node(n=0x0000000100f29fd0) + 36 at eval.c:310
	    frame #25: 0x000000010007b849 miniruby`ruby_run_node(n=0x0000000100f29fd0) + 62 at eval.c:302
	    frame #26: 0x0000000100000c05 miniruby`main(argc=2, argv=0x00007fff5fbfdbf0) + 113 at main.c:42
	    frame #27: 0x00007fff88eda5ad libdyld.dylib`start + 1
	(lldb)

	check an existence of block.

	* gc.c (rb_raw_obj_info): check block before using it.

	* vm_core.h (vm_block_iseq): r61565 introduced NULL check but this
	  check is only needed by `rb_raw_obj_info()` and it is called at GC
	  debug mode. Above fix for `rb_raw_obj_info()` solves this problem and
	  NULL check should not be needed any more.


git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_4@62864 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
matzbot pushed a commit that referenced this pull request Mar 28, 2018
@unak
merge revision(s) 61562,61563,61566,61568,61569: [Backport #14269]
815d4c4 
	fix SEGV touching uninitialized memory

	This function can be called from boot_defclass().
	No assumption can be made about object internals.

	(lldb) run
	Process 2386 launched: './miniruby' (x86_64)
	Process 2386 stopped
	* thread #1: tid = 0x13f3b6, 0x00000001001e0b26 miniruby`rb_class_path_cached(klass=4311373720) + 20 at variable.c:321, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x8)
	    frame #0: 0x00000001001e0b26 miniruby`rb_class_path_cached(klass=4311373720) + 20 at variable.c:321
	   318  VALUE
	   319  rb_class_path_cached(VALUE klass)
	   320  {
	-> 321      st_table *ivtbl = RCLASS_IV_TBL(klass);
	   322      st_data_t n;
	   323
	   324      if (!ivtbl) return Qnil;
	(lldb) bt
	* thread #1: tid = 0x13f3b6, 0x00000001001e0b26 miniruby`rb_class_path_cached(klass=4311373720) + 20 at variable.c:321, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x8)
	  * frame #0: 0x00000001001e0b26 miniruby`rb_class_path_cached(klass=4311373720) + 20 at variable.c:321
	    frame #1: 0x000000010009cbd0 miniruby`rb_raw_obj_info(buff="0x0000000100fa5798 [2    ] T_CLASS", buff_size=256, obj=4311373720) + 1393 at gc.c:9341
	    frame #2: 0x000000010009cf16 miniruby`obj_info(obj=4311373720) + 98 at gc.c:9423
	    frame #3: 0x000000010008ca87 miniruby`newobj_init(klass=0, flags=66, v1=0, v2=0, v3=0, wb_protected=1, objspace=0x00000001007cf280, obj=4311373720) + 338 at gc.c:1887
	    frame #4: 0x000000010008cd51 miniruby`newobj_of(klass=0, flags=66, v1=0, v2=0, v3=0, wb_protected=1) + 171 at gc.c:1970
	    frame #5: 0x000000010008ce1b miniruby`rb_wb_protected_newobj_of(klass=0, flags=66) + 54 at gc.c:1990
	    frame #6: 0x0000000100027563 miniruby`class_alloc(flags=2, klass=0) + 46 at class.c:165
	    frame #7: 0x000000010002761a miniruby`rb_class_boot(super=0) + 35 at class.c:203
	    frame #8: 0x0000000100028612 miniruby`boot_defclass(name="BasicObject", super=0) + 28 at class.c:537
	    frame #9: 0x000000010002868b miniruby`Init_class_hierarchy + 26 at class.c:548
	    frame #10: 0x00000001000efe69 miniruby`InitVM_Object + 9 at object.c:3892
	    frame #11: 0x00000001000f138e miniruby`Init_Object + 57 at object.c:4122
	    frame #12: 0x00000001000a59bd miniruby`rb_call_inits + 29 at inits.c:23
	    frame #13: 0x000000010007af30 miniruby`ruby_setup + 229 at eval.c:61
	    frame #14: 0x000000010007af7e miniruby`ruby_init + 13 at eval.c:78
	    frame #15: 0x0000000100000c58 miniruby`main(argc=2, argv=0x00007fff5fbfdbf0) + 88 at main.c:41
	    frame #16: 0x00007fff88eda5ad libdyld.dylib`start + 1
	(lldb)

	fix SEGV touching uninitialized memory

	This function can be called from InitVM_Object().
	No assumption can be made about object internals.

	(lldb) run
	Process 10675 launched: './miniruby' (x86_64)
	Process 10675 stopped
	* thread #1: tid = 0x14252c, 0x00000001000bdda9 miniruby`rb_raw_obj_info(buff="0x0000000100fc1588 [0    ] T_IMEMO ment", buff_size=256, obj=4311487880) + 2489 at gc.c:9383, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x0)
	    frame #0: 0x00000001000bdda9 miniruby`rb_raw_obj_info(buff="0x0000000100fc1588 [0    ] T_IMEMO ment", buff_size=256, obj=4311487880) + 2489 at gc.c:9383
	   9380                 const rb_method_entry_t *me = &RANY(obj)->as.imemo.ment;
	   9381                 snprintf(buff, buff_size, "%s (called_id: %s, type: %s, alias: %d, owner: %s, defined_class: %s)", buff,
	   9382                          rb_id2name(me->called_id),
	-> 9383                          method_type_name(me->def->type),
	   9384                          me->def->alias_count,
	   9385                          obj_info(me->owner),
	   9386                          obj_info(me->defined_class));
	(lldb) p *me
	(rb_method_entry_t) $0 = {
	  flags = 24602
	  defined_class = 4311488400
	  def = 0x0000000000000000
	  called_id = 3057
	  owner = 4311488400
	}
	(lldb) bt
	* thread #1: tid = 0x14252c, 0x00000001000bdda9 miniruby`rb_raw_obj_info(buff="0x0000000100fc1588 [0    ] T_IMEMO ment", buff_size=256, obj=4311487880) + 2489 at gc.c:9383, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x0)
	  * frame #0: 0x00000001000bdda9 miniruby`rb_raw_obj_info(buff="0x0000000100fc1588 [0    ] T_IMEMO ment", buff_size=256, obj=4311487880) + 2489 at gc.c:9383
	    frame #1: 0x00000001000b7cbf miniruby`obj_info(obj=4311487880) + 95 at gc.c:9423
	    frame #2: 0x00000001000c16a8 miniruby`newobj_init(klass=4311488400, flags=24602, v1=0, v2=3057, v3=4311488400, wb_protected=1, objspace=0x00000001007ee280, obj=4311487880) + 424 at gc.c:1887
	    frame #3: 0x00000001000b4529 miniruby`newobj_of(klass=4311488400, flags=24602, v1=0, v2=3057, v3=4311488400, wb_protected=1) + 217 at gc.c:1970
	    frame #4: 0x00000001000b46ab miniruby`rb_imemo_new(type=imemo_ment, v1=0, v2=3057, v3=4311488400, v0=4311488400) + 75 at gc.c:2017
	    frame #5: 0x00000001002773b4 miniruby`rb_method_entry_alloc(called_id=3057, owner=4311488400, defined_class=4311488400, def=0x0000000000000000) + 52 at vm_method.c:368
	    frame #6: 0x0000000100277307 miniruby`rb_method_entry_create(called_id=3057, klass=4311488400, visi=METHOD_VISI_PRIVATE, def=0x0000000000000000) + 71 at vm_method.c:389
	    frame #7: 0x00000001002784c7 miniruby`rb_method_entry_make(klass=4311488400, mid=3057, defined_class=4311488400, visi=METHOD_VISI_PRIVATE, type=VM_METHOD_TYPE_CFUNC, def=0x0000000000000000, original_id=3057, opts=0x00007fff5fbfd9e8) + 1207 at vm_method.c:594
	    frame #8: 0x00000001002770f9 miniruby`rb_add_method(klass=4311488400, mid=3057, type=VM_METHOD_TYPE_CFUNC, opts=0x00007fff5fbfd9e8, visi=METHOD_VISI_PRIVATE) + 73 at vm_method.c:650
	    frame #9: 0x000000010027708a miniruby`rb_add_method_cfunc(klass=4311488400, mid=3057, func=(miniruby`rb_obj_dummy at object.c:1125), argc=0, visi=METHOD_VISI_PRIVATE) + 138 at vm_method.c:137
	    frame #10: 0x00000001000391e4 miniruby`rb_define_private_method(klass=4311488400, name="initialize", func=(miniruby`rb_obj_dummy at object.c:1125), argc=0) + 68 at class.c:1529
	    frame #11: 0x000000010013f5bf miniruby`InitVM_Object + 47 at object.c:3905
	    frame #12: 0x0000000100142ffd miniruby`Init_Object + 61 at object.c:4122
	    frame #13: 0x00000001000d4edd miniruby`rb_call_inits + 29 at inits.c:23
	    frame #14: 0x000000010009fe66 miniruby`ruby_setup + 198 at eval.c:61
	    frame #15: 0x000000010009febd miniruby`ruby_init + 13 at eval.c:78
	    frame #16: 0x0000000100000a4d miniruby`main(argc=2, argv=0x00007fff5fbfdbf0) + 93 at main.c:41
	    frame #17: 0x00007fff88eda5ad libdyld.dylib`start + 1
	(lldb)

	fix SEGV touching uninitialized local variable

	This imemo_name is used uninitialized because the switch
	above does not cover all possible imemo types.

	(lldb) run
	Process 26068 launched: './miniruby' (x86_64)
	Process 26068 stopped
	* thread #1: tid = 0x14ba96, 0x00007fff8a402132 libsystem_c.dylib`strlen + 18, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0xfffffffffffffff0)
	    frame #0: 0x00007fff8a402132 libsystem_c.dylib`strlen + 18
	libsystem_c.dylib`strlen:
	->  0x7fff8a402132 <+18>: pcmpeqb (%rdi), %xmm0
	    0x7fff8a402136 <+22>: pmovmskb %xmm0, %esi
	    0x7fff8a40213a <+26>: andq   $0xf, %rcx
	    0x7fff8a40213e <+30>: orq    $-0x1, %rax
	(lldb) bt
	* thread #1: tid = 0x14ba96, 0x00007fff8a402132 libsystem_c.dylib`strlen + 18, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0xfffffffffffffff0)
	  * frame #0: 0x00007fff8a402132 libsystem_c.dylib`strlen + 18
	    frame #1: 0x00000001001f1531 miniruby`BSD_vfprintf(fp=0x00007fff5fbfc9e0, fmt0="%s %s", ap=0x00007fff5fbfcbf0) + 5873 at vsnprintf.c:1026
	    frame #2: 0x00000001001ef213 miniruby`ruby_do_vsnprintf(str="0x0000000100f46450 [0    ] T_IMEMO", n=256, fmt="%s %s", ap=0x00007fff5fbfcbf0) + 131 at sprintf.c:1285
	    frame #3: 0x00000001001ef3ea miniruby`ruby_snprintf(str="0x0000000100f46450 [0    ] T_IMEMO", n=256, fmt="%s %s") + 426 at sprintf.c:1300
	    frame #4: 0x00000001000bdc61 miniruby`rb_raw_obj_info(buff="0x0000000100f46450 [0    ] T_IMEMO", buff_size=256, obj=4310983760) + 2353 at gc.c:9376
	    frame #5: 0x00000001000b7bff miniruby`obj_info(obj=4310983760) + 95 at gc.c:9428
	    frame #6: 0x00000001000c1658 miniruby`newobj_init(klass=0, flags=36890, v1=0, v2=4303040512, v3=4310983800, wb_protected=1, objspace=0x00000001007ee280, obj=4310983760) + 424 at gc.c:1887
	    frame #7: 0x00000001000b4469 miniruby`newobj_of(klass=0, flags=36890, v1=0, v2=4303040512, v3=4310983800, wb_protected=1) + 217 at gc.c:1970
	    frame #8: 0x00000001000b45eb miniruby`rb_imemo_new(type=imemo_ast, v1=0, v2=4303040512, v3=4310983800, v0=0) + 75 at gc.c:2017
	    frame #9: 0x000000010011daed miniruby`rb_ast_new + 61 at node.c:1146
	    frame #10: 0x0000000100160e15 miniruby`rb_parser_compile_file_path(vparser=4310984400, fname=4310984960, file=4310984080, start=1) + 53 at parse.y:5776
	    frame #11: 0x00000001001e18ea miniruby`load_file_internal(argp_v=140734799795024) + 1834 at ruby.c:1907
	    frame #12: 0x00000001000a1bb5 miniruby`rb_ensure(b_proc=(miniruby`load_file_internal at ruby.c:1795), data1=140734799795024, e_proc=(miniruby`restore_load_file at ruby.c:2007), data2=140734799795024) + 245 at eval.c:1037
	    frame #13: 0x00000001001df4a4 miniruby`load_file(parser=4310984400, fname=4310984960, f=4310984080, script=1, opt=0x00007fff5fbfda28) + 100 at ruby.c:2026
	    frame #14: 0x00000001001e084e miniruby`process_options(argc=0, argv=0x00007fff5fbfdc00, opt=0x00007fff5fbfda28) + 3454 at ruby.c:1682
	    frame #15: 0x00000001001dfaae miniruby`ruby_process_options(argc=2, argv=0x00007fff5fbfdbf0) + 238 at ruby.c:2257
	    frame #16: 0x000000010009ff43 miniruby`ruby_options(argc=2, argv=0x00007fff5fbfdbf0) + 211 at eval.c:105
	    frame #17: 0x0000000100000989 miniruby`main(argc=2, argv=0x00007fff5fbfdbf0) + 105 at main.c:42
	    frame #18: 0x00007fff88eda5ad libdyld.dylib`start + 1
	(lldb) up 4
	frame #4: 0x00000001000bdc61 miniruby`rb_raw_obj_info(buff="0x0000000100f46450 [0    ] T_IMEMO", buff_size=256, obj=4310983760) + 2353 at gc.c:9376
	   9373 #undef IMEMO_NAME
	   9374               default: UNREACHABLE;
	   9375             }
	-> 9376             snprintf(buff, buff_size, "%s %s", buff, imemo_name);
	   9377
	   9378             switch (imemo_type(obj)) {
	   9379               case imemo_ment: {
	(lldb) p imemo_name
	(const char *) $0 = 0xffffffffffffffff
	(lldb) p imemo_type(obj)
	(imemo_type) $1 = imemo_ast
	(lldb)

	fix SEGV inspecting already freed objects

	obj_info() assumes the given object is alive.  Passing freed
	objects to it results in SEGV.

	(lldb) run
	Process 29718 launched: './miniruby' (x86_64)
	Process 29718 stopped
	* thread #1: tid = 0x3082c5, 0x00000001000bfaab miniruby`pathobj_path(pathobj=4478683640) + 70 at vm_core.h:269, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x0)
	    frame #0: 0x00000001000bfaab miniruby`pathobj_path(pathobj=4478683640) + 70 at vm_core.h:269
	   266      }
	   267      else {
	   268          VM_ASSERT(RB_TYPE_P(pathobj, T_ARRAY));
	-> 269          return RARRAY_AREF(pathobj, PATHOBJ_PATH);
	   270      }
	   271  }
	   272
	(lldb) bt
	* thread #1: tid = 0x3082c5, 0x00000001000bfaab miniruby`pathobj_path(pathobj=4478683640) + 70 at vm_core.h:269, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x0)
	  * frame #0: 0x00000001000bfaab miniruby`pathobj_path(pathobj=4478683640) + 70 at vm_core.h:269
	    frame #1: 0x00000001000c25ff miniruby`rb_iseq_path(iseq=0x000000010af34a20) + 32 at iseq.c:723
	    frame #2: 0x000000010009db09 miniruby`rb_raw_iseq_info(buff="0x000000010af34a20 [1    ] T_IMEMO iseq", buff_size=256, iseq=0x000000010af34a20) + 69 at gc.c:9274
	    frame #3: 0x000000010009e45a miniruby`rb_raw_obj_info(buff="0x000000010af34a20 [1    ] T_IMEMO iseq", buff_size=256, obj=4478683680) + 2191 at gc.c:9397
	    frame #4: 0x000000010009e4d5 miniruby`obj_info(obj=4478683680) + 98 at gc.c:9429
	    frame #5: 0x0000000100091ae3 miniruby`gc_page_sweep(objspace=0x00000001007d3280, heap=0x00000001007d32a0, sweep_page=0x000000010ae07bc0) + 622 at gc.c:3529
	    frame #6: 0x000000010009206a miniruby`gc_sweep_step(objspace=0x00000001007d3280, heap=0x00000001007d32a0) + 188 at gc.c:3705
	    frame #7: 0x0000000100092254 miniruby`gc_sweep_continue(objspace=0x00000001007d3280, heap=0x00000001007d32a0) + 133 at gc.c:3772
	    frame #8: 0x000000010008d7f9 miniruby`heap_prepare(objspace=0x00000001007d3280, heap=0x00000001007d32a0) + 48 at gc.c:1746
	    frame #9: 0x000000010008d8a1 miniruby`heap_get_freeobj_from_next_freepage(objspace=0x00000001007d3280, heap=0x00000001007d32a0) + 37 at gc.c:1769
	    frame #10: 0x000000010008d98d miniruby`heap_get_freeobj(objspace=0x00000001007d3280, heap=0x00000001007d32a0) + 83 at gc.c:1803
	    frame #11: 0x000000010008dcb0 miniruby`newobj_slowpath(klass=4334386280, flags=5, v1=0, v2=0, v3=0, objspace=0x00000001007d3280, wb_protected=1) + 220 at gc.c:1930
	    frame #12: 0x000000010008dd6c miniruby`newobj_slowpath_wb_protected(klass=4334386280, flags=5, v1=0, v2=0, v3=0, objspace=0x00000001007d3280) + 76 at gc.c:1942
	    frame #13: 0x000000010008dea1 miniruby`newobj_of(klass=4334386280, flags=5, v1=0, v2=0, v3=0, wb_protected=1) + 221 at gc.c:1974
	    frame #14: 0x000000010008df39 miniruby`rb_wb_protected_newobj_of(klass=4334386280, flags=5) + 54 at gc.c:1990
	    frame #15: 0x0000000100195f7c miniruby`str_alloc(klass=4334386280) + 29 at string.c:692
	    frame #16: 0x0000000100195fe9 miniruby`str_new0(klass=4334386280, ptr="gitm", len=4, termlen=1) + 73 at string.c:714
	    frame #17: 0x000000010019633e miniruby`rb_enc_str_new(ptr="gitm", len=4, enc=0x00000001025d50a0) + 81 at string.c:766
	    frame #18: 0x000000010010a80a miniruby`parser_str_new(p="gitm", n=4, enc=0x00000001025d50a0, func=66, enc0=0x00000001025d50a0) + 50 at parse.y:5817
	    frame #19: 0x000000010010ce1a miniruby`parser_parse_string(parser=0x00000001042ac5c0, quote=0x000000010460c028) + 795 at parse.y:6675
	    frame #20: 0x00000001001120bd miniruby`parser_yylex(parser=0x00000001042ac5c0) + 159 at parse.y:8281
	    frame #21: 0x0000000100115068 miniruby`yylex(lval=0x00007fff5fbf9948, yylloc=0x00007fff5fbf9ab0, parser=0x00000001042ac5c0) + 55 at parse.y:8931
	    frame #22: 0x00000001000fc79f miniruby`ruby_yyparse(parser=0x00000001042ac5c0) + 1198 at parse.c:5798
	    frame #23: 0x0000000100109f5a miniruby`yycompile0(arg=4364879296) + 317 at parse.y:5595
	    frame #24: 0x0000000100214ef0 miniruby`rb_suppress_tracing(func=(miniruby`yycompile0 at parse.y:5565), arg=4364879296) + 349 at vm_trace.c:397
	    frame #25: 0x000000010010a1df miniruby`yycompile(parser=0x00000001042ac5c0, fname=4443743440, line=1) + 126 at parse.y:5637
	    frame #26: 0x000000010010a4c1 miniruby`parser_compile_string(vparser=4443743480, fname=4443743440, s=4443743520, line=1) + 191 at parse.y:5706
	    frame #27: 0x000000010010a5b7 miniruby`rb_parser_compile_string_path(vparser=4443743480, f=4443743440, s=4443743520, line=1) + 58 at parse.y:5730
	    frame #28: 0x0000000100206025 miniruby`eval_make_iseq(src=4443743520, fname=4443743440, line=1, bind=0x0000000000000000, base_block=0x00007fff5fbfb370) + 266 at vm_eval.c:1274
	    frame #29: 0x0000000100206153 miniruby`eval_string_with_cref(self=4334412520, src=4443743520, cref=0x0000000000000000, file=52, line=1) + 197 at vm_eval.c:1307
	    frame #30: 0x0000000100206389 miniruby`rb_f_eval(argc=1, argv=0x0000000102400eb8, self=4334412520) + 219 at vm_eval.c:1382
	    frame #31: 0x00000001001f247c miniruby`call_cfunc_m1(func=(miniruby`rb_f_eval at vm_eval.c:1364), recv=4334412520, argc=1, argv=0x0000000102400eb8) + 47 at vm_insnhelper.c:1723
	    frame #32: 0x00000001001f2f87 miniruby`vm_call_cfunc_with_frame(ec=0x00000001007d3548, reg_cfp=0x0000000102500d80, calling=0x00007fff5fbfbf50, ci=0x000000010263f240, cc=0x0000000100749b50) + 386 at vm_insnhelper.c:1918
	    frame #33: 0x00000001001f30d6 miniruby`vm_call_cfunc(ec=0x00000001007d3548, reg_cfp=0x0000000102500d80, calling=0x00007fff5fbfbf50, ci=0x000000010263f240, cc=0x0000000100749b50) + 149 at vm_insnhelper.c:1934
	    frame #34: 0x00000001001faf0e miniruby`vm_exec_core(ec=0x00000001007d3548, initial=0) + 8471 at insns.def:915
	    frame #35: 0x000000010020b75d miniruby`vm_exec(ec=0x00000001007d3548) + 230 at vm.c:1771
	    frame #36: 0x00000001002093f8 miniruby`invoke_block(ec=0x00000001007d3548, iseq=0x000000010252d7f0, self=4334412520, captured=0x0000000102500df8, cref=0x0000000000000000, type=572653569, opt_pc=0) + 224 at vm.c:988
	    frame #37: 0x0000000100209766 miniruby`invoke_iseq_block_from_c(ec=0x00000001007d3548, captured=0x0000000102500df8, self=4334412520, argc=0, argv=0x0000000000000000, passed_block_handler=0, cref=0x0000000000000000, is_lambda=0) + 389 at vm.c:1040
	    frame #38: 0x0000000100209824 miniruby`invoke_block_from_c_bh(ec=0x00000001007d3548, block_handler=4333768185, argc=0, argv=0x0000000000000000, passed_block_handler=0, cref=0x0000000000000000, is_lambda=0, force_blockarg=0) + 138 at vm.c:1058
	    frame #39: 0x00000001002099d0 miniruby`vm_yield(ec=0x00000001007d3548, argc=0, argv=0x0000000000000000) + 69 at vm.c:1103
	    frame #40: 0x0000000100205623 miniruby`rb_yield_0(argc=0, argv=0x0000000000000000) + 40 at vm_eval.c:970
	    frame #41: 0x0000000100205964 miniruby`loop_i + 19 at vm_eval.c:1049
	    frame #42: 0x000000010007db07 miniruby`rb_rescue2(b_proc=(miniruby`loop_i at vm_eval.c:1047), data1=0, r_proc=(miniruby`loop_stop at vm_eval.c:1056), data2=0) + 369 at eval.c:896
	    frame #43: 0x0000000100205a2e miniruby`rb_f_loop(self=4334412520) + 121 at vm_eval.c:1100
	    frame #44: 0x00000001001f24a7 miniruby`call_cfunc_0(func=(miniruby`rb_f_loop at vm_eval.c:1098), recv=4334412520, argc=0, argv=0x0000000102400e80) + 41 at vm_insnhelper.c:1729
	    frame #45: 0x00000001001f2f87 miniruby`vm_call_cfunc_with_frame(ec=0x00000001007d3548, reg_cfp=0x0000000102500de0, calling=0x00007fff5fbfd4d0, ci=0x000000010263bbf0, cc=0x0000000102642118) + 386 at vm_insnhelper.c:1918
	    frame #46: 0x00000001001f30d6 miniruby`vm_call_cfunc(ec=0x00000001007d3548, reg_cfp=0x0000000102500de0, calling=0x00007fff5fbfd4d0, ci=0x000000010263bbf0, cc=0x0000000102642118) + 149 at vm_insnhelper.c:1934
	    frame #47: 0x00000001001f4319 miniruby`vm_call_method_each_type(ec=0x00000001007d3548, cfp=0x0000000102500de0, calling=0x00007fff5fbfd4d0, ci=0x000000010263bbf0, cc=0x0000000102642118) + 239 at vm_insnhelper.c:2232
	    frame #48: 0x00000001001f4a2c miniruby`vm_call_method(ec=0x00000001007d3548, cfp=0x0000000102500de0, calling=0x00007fff5fbfd4d0, ci=0x000000010263bbf0, cc=0x0000000102642118) + 253 at vm_insnhelper.c:2366
	    frame #49: 0x00000001001f4b7a miniruby`vm_call_general(ec=0x00000001007d3548, reg_cfp=0x0000000102500de0, calling=0x00007fff5fbfd4d0, ci=0x000000010263bbf0, cc=0x0000000102642118) + 59 at vm_insnhelper.c:2398
	    frame #50: 0x00000001001fab2f miniruby`vm_exec_core(ec=0x00000001007d3548, initial=0) + 7480 at insns.def:850
	    frame #51: 0x000000010020b75d miniruby`vm_exec(ec=0x00000001007d3548) + 230 at vm.c:1771
	    frame #52: 0x000000010020c40f miniruby`rb_iseq_eval_main(iseq=0x000000010252dd90) + 52 at vm.c:2019
	    frame #53: 0x000000010007c768 miniruby`ruby_exec_internal(n=0x000000010252dd90) + 297 at eval.c:246
	    frame #54: 0x000000010007c88e miniruby`ruby_exec_node(n=0x000000010252dd90) + 36 at eval.c:310
	    frame #55: 0x000000010007c861 miniruby`ruby_run_node(n=0x000000010252dd90) + 62 at eval.c:302
	    frame #56: 0x000000010000138d miniruby`main(argc=2, argv=0x00007fff5fbfdbf0) + 113 at main.c:42
	    frame #57: 0x00007fff88eda5ad libdyld.dylib`start + 1
	(lldb) p ((struct RVALUE*)pathobj)->as.basic
	(RBasic) $0 = (flags = 0, klass = 4478683600)
	(lldb)

	fix SEGV inspecting uninitialized objects

	obj_info() assumes the given object is alive.  OTOH
	gc_writebarrier_incremental is called before or in middle of
	object initialization.  Can casue SEGV.

	(lldb) run
	Process 48188 launched: './miniruby' (x86_64)
	Process 48188 stopped
	* thread #1: tid = 0x30fd53, 0x00000001000bf7a9 miniruby`rb_array_const_ptr(a=5251291222225483145) + 12 at ruby.h:2072, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=EXC_I386_GPFLT)
	    frame #0: 0x00000001000bf7a9 miniruby`rb_array_const_ptr(a=5251291222225483145) + 12 at ruby.h:2072
	   2069 static inline const VALUE *
	   2070 rb_array_const_ptr(VALUE a)
	   2071 {
	-> 2072     return FIX_CONST_VALUE_PTR((RBASIC(a)->flags & RARRAY_EMBED_FLAG) ?
	   2073         RARRAY(a)->as.ary : RARRAY(a)->as.heap.ptr);
	   2074 }
	   2075
	(lldb) bt
	* thread #1: tid = 0x30fd53, 0x00000001000bf7a9 miniruby`rb_array_const_ptr(a=5251291222225483145) + 12 at ruby.h:2072, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=EXC_I386_GPFLT)
	  * frame #0: 0x00000001000bf7a9 miniruby`rb_array_const_ptr(a=5251291222225483145) + 12 at ruby.h:2072
	    frame #1: 0x00000001000bfaab miniruby`pathobj_path(pathobj=5251291222225483145) + 70 at vm_core.h:269
	    frame #2: 0x00000001000c25ff miniruby`rb_iseq_path(iseq=0x00000001025b71a8) + 32 at iseq.c:723
	    frame #3: 0x000000010009db09 miniruby`rb_raw_iseq_info(buff="0x00000001025b7158 [0    ] proc (Proc)", buff_size=256, iseq=0x00000001025b71a8) + 69 at gc.c:9274
	    frame #4: 0x000000010009e1d5 miniruby`rb_raw_obj_info(buff="0x00000001025b7158 [0    ] proc (Proc)", buff_size=256, obj=4334514520) + 1546 at gc.c:9351
	    frame #5: 0x000000010009e4d5 miniruby`obj_info(obj=4334514520) + 98 at gc.c:9429
	    frame #6: 0x0000000100096658 miniruby`gc_writebarrier_incremental(a=4334514520, b=4334514600, objspace=0x00000001007d3280) + 61 at gc.c:5963
	    frame #7: 0x00000001000968ca miniruby`rb_gc_writebarrier(a=4334514520, b=4334514600) + 127 at gc.c:6009
	    frame #8: 0x00000001001eabe0 miniruby`rb_obj_written(a=4334514520, oldv=52, b=4334514600, filename="/Users/urabe.shyouhei/data/src/pedantic/vm.c", line=821) + 72 at ruby.h:1472
	    frame #9: 0x00000001001eac2c miniruby`rb_obj_write(a=4334514520, slot=0x000000010259ff10, b=4334514600, filename="/Users/urabe.shyouhei/data/src/pedantic/vm.c", line=821) + 70 at ruby.h:1489
	    frame #10: 0x0000000100208b6f miniruby`vm_proc_create_from_captured(klass=4311027960, captured=0x0000000102500338, block_type=block_type_ifunc, is_from_method='\0', is_lambda='\x01') + 137 at vm.c:821
	    frame #11: 0x0000000100208e5c miniruby`rb_vm_make_proc_lambda(ec=0x00000001007d3548, captured=0x0000000102500338, klass=4311027960, is_lambda='\x01') + 134 at vm.c:892
	    frame #12: 0x000000010011f08e miniruby`proc_new(klass=4311027960, is_lambda='\x01') + 445 at proc.c:752
	    frame #13: 0x000000010011f110 miniruby`rb_block_lambda + 27 at proc.c:808
	    frame #14: 0x00000001001f24a7 miniruby`call_cfunc_0(func=(miniruby`rb_block_lambda at proc.c:807), recv=4310991600, argc=0, argv=0x0000000000000000) + 41 at vm_insnhelper.c:1729
	    frame #15: 0x00000001002033de miniruby`vm_call0_cfunc_with_frame(ec=0x00000001007d3548, calling=0x00007fff5fbfb080, ci=0x00007fff5fbfb070, cc=0x00007fff5fbfb0a0, argv=0x0000000000000000) + 370 at vm_eval.c:85
	    frame #16: 0x00000001002034d9 miniruby`vm_call0_cfunc(ec=0x00000001007d3548, calling=0x00007fff5fbfb080, ci=0x00007fff5fbfb070, cc=0x00007fff5fbfb0a0, argv=0x0000000000000000) + 59 at vm_eval.c:100
	    frame #17: 0x000000010020368f miniruby`vm_call0_body(ec=0x00000001007d3548, calling=0x00007fff5fbfb080, ci=0x00007fff5fbfb070, cc=0x00007fff5fbfb0a0, argv=0x0000000000000000) + 436 at vm_eval.c:131
	    frame #18: 0x000000010020326a miniruby`vm_call0(ec=0x00000001007d3548, recv=4310991600, id=2993, argc=0, argv=0x0000000000000000, me=0x0000000100f48110) + 142 at vm_eval.c:58
	    frame #19: 0x0000000100203c60 miniruby`rb_call0(ec=0x00000001007d3548, recv=4310991600, mid=2993, argc=0, argv=0x0000000000000000, scope=CALL_FCALL, self=4334514640) + 166 at vm_eval.c:296
	    frame #20: 0x0000000100204827 miniruby`rb_call(recv=4310991600, mid=2993, argc=0, argv=0x0000000000000000, scope=CALL_FCALL) + 84 at vm_eval.c:589
	    frame #21: 0x000000010020518b miniruby`rb_funcallv(recv=4310991600, mid=2993, argc=0, argv=0x0000000000000000) + 52 at vm_eval.c:815
	    frame #22: 0x000000010012242e miniruby`mlambda(method=0) + 45 at proc.c:2661
	    frame #23: 0x0000000100205bac miniruby`rb_iterate0(it_proc=(miniruby`mlambda at proc.c:2660), data1=0, ifunc=0x00000001025b71a8, ec=0x00000001007d3548) + 380 at vm_eval.c:1134
	    frame #24: 0x0000000100205d16 miniruby`rb_iterate(it_proc=(miniruby`mlambda at proc.c:2660), data1=0, bl_proc=(miniruby`bmcall at proc.c:2666), data2=4334514640) + 88 at vm_eval.c:1166
	    frame #25: 0x00000001001224c7 miniruby`method_to_proc(method=4334514640) + 43 at proc.c:2701
	    frame #26: 0x00000001001f24a7 miniruby`call_cfunc_0(func=(miniruby`method_to_proc at proc.c:2688), recv=4334514640, argc=0, argv=0x0000000102400568) + 41 at vm_insnhelper.c:1729
	    frame #27: 0x00000001001f2f87 miniruby`vm_call_cfunc_with_frame(ec=0x00000001007d3548, reg_cfp=0x0000000102500350, calling=0x00007fff5fbfc030, ci=0x0000000100f2ec70, cc=0x0000000102735718) + 386 at vm_insnhelper.c:1918
	    frame #28: 0x00000001001f30d6 miniruby`vm_call_cfunc(ec=0x00000001007d3548, reg_cfp=0x0000000102500350, calling=0x00007fff5fbfc030, ci=0x0000000100f2ec70, cc=0x0000000102735718) + 149 at vm_insnhelper.c:1934
	    frame #29: 0x00000001001f4319 miniruby`vm_call_method_each_type(ec=0x00000001007d3548, cfp=0x0000000102500350, calling=0x00007fff5fbfc030, ci=0x0000000100f2ec70, cc=0x0000000102735718) + 239 at vm_insnhelper.c:2232
	    frame #30: 0x00000001001f49a4 miniruby`vm_call_method(ec=0x00000001007d3548, cfp=0x0000000102500350, calling=0x00007fff5fbfc030, ci=0x0000000100f2ec70, cc=0x0000000102735718) + 117 at vm_insnhelper.c:2355
	    frame #31: 0x00000001001f4b7a miniruby`vm_call_general(ec=0x00000001007d3548, reg_cfp=0x0000000102500350, calling=0x00007fff5fbfc030, ci=0x0000000100f2ec70, cc=0x0000000102735718) + 59 at vm_insnhelper.c:2398
	    frame #32: 0x00000001001faf0e miniruby`vm_exec_core(ec=0x00000001007d3548, initial=0) + 8471 at insns.def:915
	    frame #33: 0x000000010020b75d miniruby`vm_exec(ec=0x00000001007d3548) + 230 at vm.c:1771
	    frame #34: 0x000000010020c3d1 miniruby`rb_iseq_eval(iseq=0x00000001007f8270) + 52 at vm.c:2008
	    frame #35: 0x00000001000caa4a miniruby`rb_load_internal0(ec=0x00000001007d3548, fname=4310799960, wrap=0) + 631 at load.c:611
	    frame #36: 0x00000001000cab36 miniruby`rb_load_internal(fname=4310799960, wrap=0) + 46 at load.c:642
	    frame #37: 0x00000001000cae1d miniruby`rb_f_load(argc=1, argv=0x00000001024004b8) + 217 at load.c:710
	    frame #38: 0x00000001001f247c miniruby`call_cfunc_m1(func=(miniruby`rb_f_load at load.c:695), recv=4311327440, argc=1, argv=0x00000001024004b8) + 47 at vm_insnhelper.c:1723
	    frame #39: 0x00000001001f2f87 miniruby`vm_call_cfunc_with_frame(ec=0x00000001007d3548, reg_cfp=0x00000001025003e0, calling=0x00007fff5fbfd3e0, ci=0x0000000102541070, cc=0x0000000100f9e918) + 386 at vm_insnhelper.c:1918
	    frame #40: 0x00000001001f30d6 miniruby`vm_call_cfunc(ec=0x00000001007d3548, reg_cfp=0x00000001025003e0, calling=0x00007fff5fbfd3e0, ci=0x0000000102541070, cc=0x0000000100f9e918) + 149 at vm_insnhelper.c:1934
	    frame #41: 0x00000001001f4319 miniruby`vm_call_method_each_type(ec=0x00000001007d3548, cfp=0x00000001025003e0, calling=0x00007fff5fbfd3e0, ci=0x0000000102541070, cc=0x0000000100f9e918) + 239 at vm_insnhelper.c:2232
	    frame #42: 0x00000001001f4a2c miniruby`vm_call_method(ec=0x00000001007d3548, cfp=0x00000001025003e0, calling=0x00007fff5fbfd3e0, ci=0x0000000102541070, cc=0x0000000100f9e918) + 253 at vm_insnhelper.c:2366
	    frame #43: 0x00000001001f4b7a miniruby`vm_call_general(ec=0x00000001007d3548, reg_cfp=0x00000001025003e0, calling=0x00007fff5fbfd3e0, ci=0x0000000102541070, cc=0x0000000100f9e918) + 59 at vm_insnhelper.c:2398
	    frame #44: 0x00000001001faf0e miniruby`vm_exec_core(ec=0x00000001007d3548, initial=0) + 8471 at insns.def:915
	    frame #45: 0x000000010020b75d miniruby`vm_exec(ec=0x00000001007d3548) + 230 at vm.c:1771
	    frame #46: 0x000000010020c40f miniruby`rb_iseq_eval_main(iseq=0x0000000100f21240) + 52 at vm.c:2019
	    frame #47: 0x000000010007c774 miniruby`ruby_exec_internal(n=0x0000000100f21240) + 297 at eval.c:246
	    frame #48: 0x000000010007c89a miniruby`ruby_exec_node(n=0x0000000100f21240) + 36 at eval.c:310
	    frame #49: 0x000000010007c86d miniruby`ruby_run_node(n=0x0000000100f21240) + 62 at eval.c:302
	    frame #50: 0x0000000100001399 miniruby`main(argc=9, argv=0x00007fff5fbfdae0) + 113 at main.c:42
	    frame #51: 0x00007fff88eda5ad libdyld.dylib`start + 1
	(lldb)

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_3@62941 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
shyouhei added a commit to shyouhei/ruby that referenced this pull request Apr 26, 2019
@shyouhei
ivptr might be GC marked before it gets used
8c03aaf 
GC.stress unveils that an ivptr allocated using transient heap gets
marked right before it evacuates to normal heaps (the evacuation
itself triggers GC).

Should fill something beforehand.

=================================================================
==60984==ERROR: AddressSanitizer: use-after-poison on address 0x7f0fcfdf0020 at pc 0x55bdaad55381 bp 0x7fffcddc0910 sp 0x7fffcddc0908
READ of size 8 at 0x7f0fcfdf0020 thread T0
    #0 0x55bdaad55380 in gc_mark_children gc.c:5063:39
    #1 0x55bdaad6b7c2 in gc_mark_stacked_objects gc.c:5156:9
    #2 0x55bdaad6cb1a in gc_mark_stacked_objects_all gc.c:5196:12
    #3 0x55bdaad6a180 in gc_marks_rest gc.c:6109:2
    #4 0x55bdaad6ef51 in gc_marks gc.c:6169:6
    #5 0x55bdaad63bfd in gc_start gc.c:6974:2
    #6 0x55bdaad4fa73 in garbage_collect gc.c:6869:12
    #7 0x55bdaad7866e in garbage_collect_with_gvl gc.c:7127:9
    #8 0x55bdaad784d6 in objspace_malloc_gc_stress gc.c:9270:9
    #9 0x55bdaad56f29 in objspace_xmalloc0 gc.c:9416:5
    #10 0x55bdaad56ef2 in ruby_xmalloc2_body gc.c:9623:12
    #11 0x55bdaad615dc in ruby_xmalloc2 gc.c:11479:12
    #12 0x55bdab26a601 in obj_ivar_heap_alloc variable.c:1405:18
    #13 0x55bdab27a35b in obj_ivar_heap_realloc variable.c:1418:23
    ruby#14 0x55bdab26ac98 in obj_ivar_set variable.c:1490:26
    ruby#15 0x55bdab2621fd in rb_ivar_set variable.c:1513:16
    ruby#16 0x55bdab2e841d in vm_setivar vm_insnhelper.c:1118:12
    ruby#17 0x55bdab2ecca4 in vm_setinstancevariable vm_insnhelper.c:1130:5
    ruby#18 0x55bdab28113c in vm_exec_core insns.def:227:5

0x7f0fcfdf0020 is located 26181664 bytes inside of 33554432-byte region [0x7f0fce4f8000,0x7f0fd04f8000)
allocated by thread T0 here:
    #0 0x55bdaacd3047 in posix_memalign (ruby+0x1c2047)
    #1 0x55bdaad56b75 in rb_aligned_malloc gc.c:9195:9
    #2 0x55bdab24c523 in transient_heap_block_alloc transient_heap.c:296:24
    #3 0x55bdab24c1fe in Init_TransientHeap transient_heap.c:435:39
    #4 0x55bdaada26f8 in rb_call_inits inits.c:20:5
    #5 0x55bdaad076af in ruby_setup eval.c:74:2
    #6 0x55bdaad0796c in ruby_init eval.c:91:17
    #7 0x55bdaad01598 in main main.c:41:2
    #8 0x7f0fd344cb96 in __libc_start_main /build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310

SUMMARY: AddressSanitizer: use-after-poison gc.c:5063:39 in gc_mark_children
Shadow bytes around the buggy address:
  0x0fe279fb5fb0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
  0x0fe279fb5fc0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
  0x0fe279fb5fd0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
  0x0fe279fb5fe0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
  0x0fe279fb5ff0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
=>0x0fe279fb6000: 00 00 f7 f7[f7]f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
  0x0fe279fb6010: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
  0x0fe279fb6020: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
  0x0fe279fb6030: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
  0x0fe279fb6040: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
  0x0fe279fb6050: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==60984==ABORTING
shyouhei added a commit to shyouhei/ruby that referenced this pull request Apr 26, 2019
@shyouhei
avoid buffer overflow in vm_check_canary
2a16e8a 
ec->cfp->iseq might not exist at the very beginning of a thread.

=================================================================
==82954==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7fc86f334810 at pc 0x55ceaf013125 bp 0x7ffe2eddbbf0 sp 0x7ffe2eddbbe8
READ of size 8 at 0x7fc86f334810 thread T0
    #0 0x55ceaf013124 in vm_check_canary vm_insnhelper.c:217:24
    #1 0x55ceaefb4796 in vm_push_frame vm_insnhelper.c:276:5
    #2 0x55ceaf0124bd in th_init vm.c:2661:5
    #3 0x55ceaf00d5eb in ruby_thread_init vm.c:2690:5
    #4 0x55ceaf00d4b1 in rb_thread_alloc vm.c:2703:5
    #5 0x55ceaef0038b in thread_s_new thread.c:872:20
    #6 0x55ceaf04d8c1 in call_cfunc_m1 vm_insnhelper.c:2041:12
    #7 0x55ceaf03118d in vm_call_cfunc_with_frame vm_insnhelper.c:2207:11
    #8 0x55ceaf017985 in vm_call_cfunc vm_insnhelper.c:2225:12
    #9 0x55ceaf01548b in vm_call_method_each_type vm_insnhelper.c:2560:9
    #10 0x55ceaf014c96 in vm_call_method vm_insnhelper.c:2686:13
    #11 0x55ceaefb5de4 in vm_call_general vm_insnhelper.c:2730:12
    #12 0x55ceaf03c868 in vm_sendish vm_insnhelper.c:3623:11
    #13 0x55ceaefc95bb in vm_exec_core insns.def:771:11
    ruby#14 0x55ceaf006700 in rb_vm_exec vm.c:1892:22
    ruby#15 0x55ceaf00acbf in rb_iseq_eval_main vm.c:2151:11
    ruby#16 0x55ceaea250ca in ruby_exec_internal eval.c:262:2
    ruby#17 0x55ceaea2498b in ruby_exec_node eval.c:326:12
    ruby#18 0x55ceaea247d0 in ruby_run_node eval.c:318:25
    ruby#19 0x55ceae88c486 in main main.c:42:9
    #20 0x7fc874330b96 in __libc_start_main /build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310
    ruby#21 0x55ceae7e5289 in _start (miniruby+0x15f289)

0x7fc86f334810 is located 16 bytes to the right of 1048576-byte region [0x7fc86f234800,0x7fc86f334800)
allocated by thread T0 here:
    #0 0x55ceae85d56d in malloc (miniruby+0x1d756d)
    #1 0x55ceaea71d12 in objspace_xmalloc0 gc.c:9416:5
    #2 0x55ceaea71cd2 in ruby_xmalloc2_body gc.c:9623:12
    #3 0x55ceaea7d09c in ruby_xmalloc2 gc.c:11479:12
    #4 0x55ceaf00c3b7 in rb_thread_recycle_stack vm.c:2462:12
    #5 0x55ceaf012256 in th_init vm.c:2656:29
    #6 0x55ceaf00d5eb in ruby_thread_init vm.c:2690:5
    #7 0x55ceaf00d4b1 in rb_thread_alloc vm.c:2703:5
    #8 0x55ceaef0038b in thread_s_new thread.c:872:20
    #9 0x55ceaf04d8c1 in call_cfunc_m1 vm_insnhelper.c:2041:12
    #10 0x55ceaf03118d in vm_call_cfunc_with_frame vm_insnhelper.c:2207:11
    #11 0x55ceaf017985 in vm_call_cfunc vm_insnhelper.c:2225:12
    #12 0x55ceaf01548b in vm_call_method_each_type vm_insnhelper.c:2560:9
    #13 0x55ceaf014c96 in vm_call_method vm_insnhelper.c:2686:13
    ruby#14 0x55ceaefb5de4 in vm_call_general vm_insnhelper.c:2730:12
    ruby#15 0x55ceaf03c868 in vm_sendish vm_insnhelper.c:3623:11
    ruby#16 0x55ceaefc95bb in vm_exec_core insns.def:771:11
    ruby#17 0x55ceaf006700 in rb_vm_exec vm.c:1892:22
    ruby#18 0x55ceaf00acbf in rb_iseq_eval_main vm.c:2151:11
    ruby#19 0x55ceaea250ca in ruby_exec_internal eval.c:262:2
    #20 0x55ceaea2498b in ruby_exec_node eval.c:326:12
    ruby#21 0x55ceaea247d0 in ruby_run_node eval.c:318:25
    ruby#22 0x55ceae88c486 in main main.c:42:9
    ruby#23 0x7fc874330b96 in __libc_start_main /build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310

SUMMARY: AddressSanitizer: heap-buffer-overflow vm_insnhelper.c:217:24 in vm_check_canary
Shadow bytes around the buggy address:
  0x0ff98de5e8b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0ff98de5e8c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0ff98de5e8d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0ff98de5e8e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0ff98de5e8f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0ff98de5e900: fa fa[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0ff98de5e910: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0ff98de5e920: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0ff98de5e930: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0ff98de5e940: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0ff98de5e950: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==82954==ABORTING
shyouhei added a commit to shyouhei/ruby that referenced this pull request Apr 26, 2019
@shyouhei
eliminate use of freed memory
5ca015c 
rb_io_fptr_finalize_internal frees the memory region.

=================================================================
==85264==ERROR: AddressSanitizer: heap-use-after-free on address 0x610000000d8c at pc 0x5608e38077f7 bp 0x7ffee12d5440 sp 0x7ffee12d5438
READ of size 4 at 0x610000000d8c thread T0
    #0 0x5608e38077f6 in rb_io_memsize io.c:4749:24
    #1 0x5608e37a0481 in obj_memsize_of gc.c:3547:14
    #2 0x5608e37a4f30 in check_rvalue_consistency gc.c:1107:2
    #3 0x5608e37a2624 in RVALUE_OLD_P gc.c:1218:5
    #4 0x5608e37a5bae in rb_gc_force_recycle gc.c:6652:18
    #5 0x5608e38191f9 in rb_f_backquote io.c:9021:5
    #6 0x5608e3d8aa14 in call_cfunc_1 vm_insnhelper.c:2058:12
    #7 0x5608e3d6e23d in vm_call_cfunc_with_frame vm_insnhelper.c:2211:11
    #8 0x5608e3d54a35 in vm_call_cfunc vm_insnhelper.c:2229:12
    #9 0x5608e3d5253b in vm_call_method_each_type vm_insnhelper.c:2564:9
    #10 0x5608e3d51f50 in vm_call_method vm_insnhelper.c:2701:13
    #11 0x5608e3cf2de4 in vm_call_general vm_insnhelper.c:2734:12
    #12 0x5608e3d79918 in vm_sendish vm_insnhelper.c:3627:11
    #13 0x5608e3d06cf5 in vm_exec_core insns.def:789:11
    ruby#14 0x5608e3d43700 in rb_vm_exec vm.c:1892:22
    ruby#15 0x5608e3d47cbf in rb_iseq_eval_main vm.c:2151:11
    ruby#16 0x5608e37620ca in ruby_exec_internal eval.c:262:2
    ruby#17 0x5608e376198b in ruby_exec_node eval.c:326:12
    ruby#18 0x5608e37617d0 in ruby_run_node eval.c:318:25
    ruby#19 0x5608e35c9486 in main main.c:42:9
    #20 0x7f62e9421b96 in __libc_start_main /build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310
    ruby#21 0x5608e3522289 in _start (miniruby+0x15f289)

0x610000000d8c is located 76 bytes inside of 192-byte region [0x610000000d40,0x610000000e00)
freed by thread T0 here:
    #0 0x5608e359a2ed in free (miniruby+0x1d72ed)
    #1 0x5608e37af421 in objspace_xfree gc.c:9591:5
    #2 0x5608e37af3da in ruby_sized_xfree gc.c:9687:2
    #3 0x5608e3799ac8 in ruby_xfree gc.c:9694:5
    #4 0x5608e380746d in rb_io_fptr_finalize_internal io.c:4728:5
    #5 0x5608e38191ed in rb_f_backquote io.c:9020:5
    #6 0x5608e3d8aa14 in call_cfunc_1 vm_insnhelper.c:2058:12
    #7 0x5608e3d6e23d in vm_call_cfunc_with_frame vm_insnhelper.c:2211:11
    #8 0x5608e3d54a35 in vm_call_cfunc vm_insnhelper.c:2229:12
    #9 0x5608e3d5253b in vm_call_method_each_type vm_insnhelper.c:2564:9
    #10 0x5608e3d51f50 in vm_call_method vm_insnhelper.c:2701:13
    #11 0x5608e3cf2de4 in vm_call_general vm_insnhelper.c:2734:12
    #12 0x5608e3d79918 in vm_sendish vm_insnhelper.c:3627:11
    #13 0x5608e3d06cf5 in vm_exec_core insns.def:789:11
    ruby#14 0x5608e3d43700 in rb_vm_exec vm.c:1892:22
    ruby#15 0x5608e3d47cbf in rb_iseq_eval_main vm.c:2151:11
    ruby#16 0x5608e37620ca in ruby_exec_internal eval.c:262:2
    ruby#17 0x5608e376198b in ruby_exec_node eval.c:326:12
    ruby#18 0x5608e37617d0 in ruby_run_node eval.c:318:25
    ruby#19 0x5608e35c9486 in main main.c:42:9
    #20 0x7f62e9421b96 in __libc_start_main
/build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310

previously allocated by thread T0 here:
    #0 0x5608e359a56d in malloc (miniruby+0x1d756d)
    #1 0x5608e37aed12 in objspace_xmalloc0 gc.c:9416:5
    #2 0x5608e37aebe7 in ruby_xmalloc0 gc.c:9600:12
    #3 0x5608e37aea8b in ruby_xmalloc_body gc.c:9609:12
    #4 0x5608e37a6d64 in ruby_xmalloc gc.c:11469:12
    #5 0x5608e380e4b4 in rb_io_fptr_new io.c:8040:19
    #6 0x5608e380e446 in rb_io_make_open_file io.c:8077:10
    #7 0x5608e3850ea0 in pipe_open io.c:6707:5
    #8 0x5608e384edb4 in pipe_open_s io.c:6772:12
    #9 0x5608e381910b in rb_f_backquote io.c:9014:12
    #10 0x5608e3d8aa14 in call_cfunc_1 vm_insnhelper.c:2058:12
    #11 0x5608e3d6e23d in vm_call_cfunc_with_frame vm_insnhelper.c:2211:11
    #12 0x5608e3d54a35 in vm_call_cfunc vm_insnhelper.c:2229:12
    #13 0x5608e3d5253b in vm_call_method_each_type vm_insnhelper.c:2564:9
    ruby#14 0x5608e3d51f50 in vm_call_method vm_insnhelper.c:2701:13
    ruby#15 0x5608e3cf2de4 in vm_call_general vm_insnhelper.c:2734:12
    ruby#16 0x5608e3d79918 in vm_sendish vm_insnhelper.c:3627:11
    ruby#17 0x5608e3d06cf5 in vm_exec_core insns.def:789:11
    ruby#18 0x5608e3d43700 in rb_vm_exec vm.c:1892:22
    ruby#19 0x5608e3d47cbf in rb_iseq_eval_main vm.c:2151:11
    #20 0x5608e37620ca in ruby_exec_internal eval.c:262:2
    ruby#21 0x5608e376198b in ruby_exec_node eval.c:326:12
    ruby#22 0x5608e37617d0 in ruby_run_node eval.c:318:25
    ruby#23 0x5608e35c9486 in main main.c:42:9
    ruby#24 0x7f62e9421b96 in __libc_start_main /build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310

SUMMARY: AddressSanitizer: heap-use-after-free io.c:4749:24 in
rb_io_memsize
Shadow bytes around the buggy address:
  0x0c207fff8160: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
  0x0c207fff8170: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c207fff8180: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
  0x0c207fff8190: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c207fff81a0: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
=>0x0c207fff81b0: fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c207fff81c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c207fff81d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c207fff81e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c207fff81f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c207fff8200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==85264==ABORTING
shyouhei added a commit to shyouhei/ruby that referenced this pull request Apr 26, 2019
@shyouhei
ivptr might be GC marked before it gets used
b629668 
GC.stress unveils that an ivptr allocated using transient heap gets
marked right before it evacuates to normal heaps (the evacuation
itself triggers GC).

Should fill something beforehand.

=================================================================
==60984==ERROR: AddressSanitizer: use-after-poison on address 0x7f0fcfdf0020 at pc 0x55bdaad55381 bp 0x7fffcddc0910 sp 0x7fffcddc0908
READ of size 8 at 0x7f0fcfdf0020 thread T0
    #0 0x55bdaad55380 in gc_mark_children gc.c:5063:39
    #1 0x55bdaad6b7c2 in gc_mark_stacked_objects gc.c:5156:9
    #2 0x55bdaad6cb1a in gc_mark_stacked_objects_all gc.c:5196:12
    #3 0x55bdaad6a180 in gc_marks_rest gc.c:6109:2
    #4 0x55bdaad6ef51 in gc_marks gc.c:6169:6
    #5 0x55bdaad63bfd in gc_start gc.c:6974:2
    #6 0x55bdaad4fa73 in garbage_collect gc.c:6869:12
    #7 0x55bdaad7866e in garbage_collect_with_gvl gc.c:7127:9
    #8 0x55bdaad784d6 in objspace_malloc_gc_stress gc.c:9270:9
    #9 0x55bdaad56f29 in objspace_xmalloc0 gc.c:9416:5
    #10 0x55bdaad56ef2 in ruby_xmalloc2_body gc.c:9623:12
    #11 0x55bdaad615dc in ruby_xmalloc2 gc.c:11479:12
    #12 0x55bdab26a601 in obj_ivar_heap_alloc variable.c:1405:18
    #13 0x55bdab27a35b in obj_ivar_heap_realloc variable.c:1418:23
    ruby#14 0x55bdab26ac98 in obj_ivar_set variable.c:1490:26
    ruby#15 0x55bdab2621fd in rb_ivar_set variable.c:1513:16
    ruby#16 0x55bdab2e841d in vm_setivar vm_insnhelper.c:1118:12
    ruby#17 0x55bdab2ecca4 in vm_setinstancevariable vm_insnhelper.c:1130:5
    ruby#18 0x55bdab28113c in vm_exec_core insns.def:227:5

0x7f0fcfdf0020 is located 26181664 bytes inside of 33554432-byte region [0x7f0fce4f8000,0x7f0fd04f8000)
allocated by thread T0 here:
    #0 0x55bdaacd3047 in posix_memalign (ruby+0x1c2047)
    #1 0x55bdaad56b75 in rb_aligned_malloc gc.c:9195:9
    #2 0x55bdab24c523 in transient_heap_block_alloc transient_heap.c:296:24
    #3 0x55bdab24c1fe in Init_TransientHeap transient_heap.c:435:39
    #4 0x55bdaada26f8 in rb_call_inits inits.c:20:5
    #5 0x55bdaad076af in ruby_setup eval.c:74:2
    #6 0x55bdaad0796c in ruby_init eval.c:91:17
    #7 0x55bdaad01598 in main main.c:41:2
    #8 0x7f0fd344cb96 in __libc_start_main /build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310

SUMMARY: AddressSanitizer: use-after-poison gc.c:5063:39 in gc_mark_children
Shadow bytes around the buggy address:
  0x0fe279fb5fb0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
  0x0fe279fb5fc0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
  0x0fe279fb5fd0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
  0x0fe279fb5fe0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
  0x0fe279fb5ff0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
=>0x0fe279fb6000: 00 00 f7 f7[f7]f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
  0x0fe279fb6010: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
  0x0fe279fb6020: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
  0x0fe279fb6030: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
  0x0fe279fb6040: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
  0x0fe279fb6050: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==60984==ABORTING
shyouhei added a commit to shyouhei/ruby that referenced this pull request Apr 26, 2019
@shyouhei
avoid buffer overflow in vm_check_canary
56d6c06 
ec->cfp->iseq might not exist at the very beginning of a thread.

=================================================================
==82954==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7fc86f334810 at pc 0x55ceaf013125 bp 0x7ffe2eddbbf0 sp 0x7ffe2eddbbe8
READ of size 8 at 0x7fc86f334810 thread T0
    #0 0x55ceaf013124 in vm_check_canary vm_insnhelper.c:217:24
    #1 0x55ceaefb4796 in vm_push_frame vm_insnhelper.c:276:5
    #2 0x55ceaf0124bd in th_init vm.c:2661:5
    #3 0x55ceaf00d5eb in ruby_thread_init vm.c:2690:5
    #4 0x55ceaf00d4b1 in rb_thread_alloc vm.c:2703:5
    #5 0x55ceaef0038b in thread_s_new thread.c:872:20
    #6 0x55ceaf04d8c1 in call_cfunc_m1 vm_insnhelper.c:2041:12
    #7 0x55ceaf03118d in vm_call_cfunc_with_frame vm_insnhelper.c:2207:11
    #8 0x55ceaf017985 in vm_call_cfunc vm_insnhelper.c:2225:12
    #9 0x55ceaf01548b in vm_call_method_each_type vm_insnhelper.c:2560:9
    #10 0x55ceaf014c96 in vm_call_method vm_insnhelper.c:2686:13
    #11 0x55ceaefb5de4 in vm_call_general vm_insnhelper.c:2730:12
    #12 0x55ceaf03c868 in vm_sendish vm_insnhelper.c:3623:11
    #13 0x55ceaefc95bb in vm_exec_core insns.def:771:11
    ruby#14 0x55ceaf006700 in rb_vm_exec vm.c:1892:22
    ruby#15 0x55ceaf00acbf in rb_iseq_eval_main vm.c:2151:11
    ruby#16 0x55ceaea250ca in ruby_exec_internal eval.c:262:2
    ruby#17 0x55ceaea2498b in ruby_exec_node eval.c:326:12
    ruby#18 0x55ceaea247d0 in ruby_run_node eval.c:318:25
    ruby#19 0x55ceae88c486 in main main.c:42:9
    #20 0x7fc874330b96 in __libc_start_main /build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310
    ruby#21 0x55ceae7e5289 in _start (miniruby+0x15f289)

0x7fc86f334810 is located 16 bytes to the right of 1048576-byte region [0x7fc86f234800,0x7fc86f334800)
allocated by thread T0 here:
    #0 0x55ceae85d56d in malloc (miniruby+0x1d756d)
    #1 0x55ceaea71d12 in objspace_xmalloc0 gc.c:9416:5
    #2 0x55ceaea71cd2 in ruby_xmalloc2_body gc.c:9623:12
    #3 0x55ceaea7d09c in ruby_xmalloc2 gc.c:11479:12
    #4 0x55ceaf00c3b7 in rb_thread_recycle_stack vm.c:2462:12
    #5 0x55ceaf012256 in th_init vm.c:2656:29
    #6 0x55ceaf00d5eb in ruby_thread_init vm.c:2690:5
    #7 0x55ceaf00d4b1 in rb_thread_alloc vm.c:2703:5
    #8 0x55ceaef0038b in thread_s_new thread.c:872:20
    #9 0x55ceaf04d8c1 in call_cfunc_m1 vm_insnhelper.c:2041:12
    #10 0x55ceaf03118d in vm_call_cfunc_with_frame vm_insnhelper.c:2207:11
    #11 0x55ceaf017985 in vm_call_cfunc vm_insnhelper.c:2225:12
    #12 0x55ceaf01548b in vm_call_method_each_type vm_insnhelper.c:2560:9
    #13 0x55ceaf014c96 in vm_call_method vm_insnhelper.c:2686:13
    ruby#14 0x55ceaefb5de4 in vm_call_general vm_insnhelper.c:2730:12
    ruby#15 0x55ceaf03c868 in vm_sendish vm_insnhelper.c:3623:11
    ruby#16 0x55ceaefc95bb in vm_exec_core insns.def:771:11
    ruby#17 0x55ceaf006700 in rb_vm_exec vm.c:1892:22
    ruby#18 0x55ceaf00acbf in rb_iseq_eval_main vm.c:2151:11
    ruby#19 0x55ceaea250ca in ruby_exec_internal eval.c:262:2
    #20 0x55ceaea2498b in ruby_exec_node eval.c:326:12
    ruby#21 0x55ceaea247d0 in ruby_run_node eval.c:318:25
    ruby#22 0x55ceae88c486 in main main.c:42:9
    ruby#23 0x7fc874330b96 in __libc_start_main /build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310

SUMMARY: AddressSanitizer: heap-buffer-overflow vm_insnhelper.c:217:24 in vm_check_canary
Shadow bytes around the buggy address:
  0x0ff98de5e8b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0ff98de5e8c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0ff98de5e8d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0ff98de5e8e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0ff98de5e8f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0ff98de5e900: fa fa[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0ff98de5e910: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0ff98de5e920: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0ff98de5e930: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0ff98de5e940: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0ff98de5e950: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==82954==ABORTING
shyouhei added a commit to shyouhei/ruby that referenced this pull request Apr 26, 2019
@shyouhei
eliminate use of freed memory
996b087 
rb_io_fptr_finalize_internal frees the memory region.

=================================================================
==85264==ERROR: AddressSanitizer: heap-use-after-free on address 0x610000000d8c at pc 0x5608e38077f7 bp 0x7ffee12d5440 sp 0x7ffee12d5438
READ of size 4 at 0x610000000d8c thread T0
    #0 0x5608e38077f6 in rb_io_memsize io.c:4749:24
    #1 0x5608e37a0481 in obj_memsize_of gc.c:3547:14
    #2 0x5608e37a4f30 in check_rvalue_consistency gc.c:1107:2
    #3 0x5608e37a2624 in RVALUE_OLD_P gc.c:1218:5
    #4 0x5608e37a5bae in rb_gc_force_recycle gc.c:6652:18
    #5 0x5608e38191f9 in rb_f_backquote io.c:9021:5
    #6 0x5608e3d8aa14 in call_cfunc_1 vm_insnhelper.c:2058:12
    #7 0x5608e3d6e23d in vm_call_cfunc_with_frame vm_insnhelper.c:2211:11
    #8 0x5608e3d54a35 in vm_call_cfunc vm_insnhelper.c:2229:12
    #9 0x5608e3d5253b in vm_call_method_each_type vm_insnhelper.c:2564:9
    #10 0x5608e3d51f50 in vm_call_method vm_insnhelper.c:2701:13
    #11 0x5608e3cf2de4 in vm_call_general vm_insnhelper.c:2734:12
    #12 0x5608e3d79918 in vm_sendish vm_insnhelper.c:3627:11
    #13 0x5608e3d06cf5 in vm_exec_core insns.def:789:11
    ruby#14 0x5608e3d43700 in rb_vm_exec vm.c:1892:22
    ruby#15 0x5608e3d47cbf in rb_iseq_eval_main vm.c:2151:11
    ruby#16 0x5608e37620ca in ruby_exec_internal eval.c:262:2
    ruby#17 0x5608e376198b in ruby_exec_node eval.c:326:12
    ruby#18 0x5608e37617d0 in ruby_run_node eval.c:318:25
    ruby#19 0x5608e35c9486 in main main.c:42:9
    #20 0x7f62e9421b96 in __libc_start_main /build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310
    ruby#21 0x5608e3522289 in _start (miniruby+0x15f289)

0x610000000d8c is located 76 bytes inside of 192-byte region [0x610000000d40,0x610000000e00)
freed by thread T0 here:
    #0 0x5608e359a2ed in free (miniruby+0x1d72ed)
    #1 0x5608e37af421 in objspace_xfree gc.c:9591:5
    #2 0x5608e37af3da in ruby_sized_xfree gc.c:9687:2
    #3 0x5608e3799ac8 in ruby_xfree gc.c:9694:5
    #4 0x5608e380746d in rb_io_fptr_finalize_internal io.c:4728:5
    #5 0x5608e38191ed in rb_f_backquote io.c:9020:5
    #6 0x5608e3d8aa14 in call_cfunc_1 vm_insnhelper.c:2058:12
    #7 0x5608e3d6e23d in vm_call_cfunc_with_frame vm_insnhelper.c:2211:11
    #8 0x5608e3d54a35 in vm_call_cfunc vm_insnhelper.c:2229:12
    #9 0x5608e3d5253b in vm_call_method_each_type vm_insnhelper.c:2564:9
    #10 0x5608e3d51f50 in vm_call_method vm_insnhelper.c:2701:13
    #11 0x5608e3cf2de4 in vm_call_general vm_insnhelper.c:2734:12
    #12 0x5608e3d79918 in vm_sendish vm_insnhelper.c:3627:11
    #13 0x5608e3d06cf5 in vm_exec_core insns.def:789:11
    ruby#14 0x5608e3d43700 in rb_vm_exec vm.c:1892:22
    ruby#15 0x5608e3d47cbf in rb_iseq_eval_main vm.c:2151:11
    ruby#16 0x5608e37620ca in ruby_exec_internal eval.c:262:2
    ruby#17 0x5608e376198b in ruby_exec_node eval.c:326:12
    ruby#18 0x5608e37617d0 in ruby_run_node eval.c:318:25
    ruby#19 0x5608e35c9486 in main main.c:42:9
    #20 0x7f62e9421b96 in __libc_start_main
/build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310

previously allocated by thread T0 here:
    #0 0x5608e359a56d in malloc (miniruby+0x1d756d)
    #1 0x5608e37aed12 in objspace_xmalloc0 gc.c:9416:5
    #2 0x5608e37aebe7 in ruby_xmalloc0 gc.c:9600:12
    #3 0x5608e37aea8b in ruby_xmalloc_body gc.c:9609:12
    #4 0x5608e37a6d64 in ruby_xmalloc gc.c:11469:12
    #5 0x5608e380e4b4 in rb_io_fptr_new io.c:8040:19
    #6 0x5608e380e446 in rb_io_make_open_file io.c:8077:10
    #7 0x5608e3850ea0 in pipe_open io.c:6707:5
    #8 0x5608e384edb4 in pipe_open_s io.c:6772:12
    #9 0x5608e381910b in rb_f_backquote io.c:9014:12
    #10 0x5608e3d8aa14 in call_cfunc_1 vm_insnhelper.c:2058:12
    #11 0x5608e3d6e23d in vm_call_cfunc_with_frame vm_insnhelper.c:2211:11
    #12 0x5608e3d54a35 in vm_call_cfunc vm_insnhelper.c:2229:12
    #13 0x5608e3d5253b in vm_call_method_each_type vm_insnhelper.c:2564:9
    ruby#14 0x5608e3d51f50 in vm_call_method vm_insnhelper.c:2701:13
    ruby#15 0x5608e3cf2de4 in vm_call_general vm_insnhelper.c:2734:12
    ruby#16 0x5608e3d79918 in vm_sendish vm_insnhelper.c:3627:11
    ruby#17 0x5608e3d06cf5 in vm_exec_core insns.def:789:11
    ruby#18 0x5608e3d43700 in rb_vm_exec vm.c:1892:22
    ruby#19 0x5608e3d47cbf in rb_iseq_eval_main vm.c:2151:11
    #20 0x5608e37620ca in ruby_exec_internal eval.c:262:2
    ruby#21 0x5608e376198b in ruby_exec_node eval.c:326:12
    ruby#22 0x5608e37617d0 in ruby_run_node eval.c:318:25
    ruby#23 0x5608e35c9486 in main main.c:42:9
    ruby#24 0x7f62e9421b96 in __libc_start_main /build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310

SUMMARY: AddressSanitizer: heap-use-after-free io.c:4749:24 in
rb_io_memsize
Shadow bytes around the buggy address:
  0x0c207fff8160: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
  0x0c207fff8170: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c207fff8180: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
  0x0c207fff8190: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c207fff81a0: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
=>0x0c207fff81b0: fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c207fff81c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c207fff81d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c207fff81e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c207fff81f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c207fff8200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==85264==ABORTING
shyouhei added a commit to shyouhei/ruby that referenced this pull request Apr 26, 2019
@shyouhei
avoid buffer overflow in vm_check_canary
d374945 
ec->cfp->iseq might not exist at the very beginning of a thread.

=================================================================
==82954==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7fc86f334810 at pc 0x55ceaf013125 bp 0x7ffe2eddbbf0 sp 0x7ffe2eddbbe8
READ of size 8 at 0x7fc86f334810 thread T0
    #0 0x55ceaf013124 in vm_check_canary vm_insnhelper.c:217:24
    #1 0x55ceaefb4796 in vm_push_frame vm_insnhelper.c:276:5
    #2 0x55ceaf0124bd in th_init vm.c:2661:5
    #3 0x55ceaf00d5eb in ruby_thread_init vm.c:2690:5
    #4 0x55ceaf00d4b1 in rb_thread_alloc vm.c:2703:5
    #5 0x55ceaef0038b in thread_s_new thread.c:872:20
    #6 0x55ceaf04d8c1 in call_cfunc_m1 vm_insnhelper.c:2041:12
    #7 0x55ceaf03118d in vm_call_cfunc_with_frame vm_insnhelper.c:2207:11
    #8 0x55ceaf017985 in vm_call_cfunc vm_insnhelper.c:2225:12
    #9 0x55ceaf01548b in vm_call_method_each_type vm_insnhelper.c:2560:9
    #10 0x55ceaf014c96 in vm_call_method vm_insnhelper.c:2686:13
    #11 0x55ceaefb5de4 in vm_call_general vm_insnhelper.c:2730:12
    #12 0x55ceaf03c868 in vm_sendish vm_insnhelper.c:3623:11
    #13 0x55ceaefc95bb in vm_exec_core insns.def:771:11
    ruby#14 0x55ceaf006700 in rb_vm_exec vm.c:1892:22
    ruby#15 0x55ceaf00acbf in rb_iseq_eval_main vm.c:2151:11
    ruby#16 0x55ceaea250ca in ruby_exec_internal eval.c:262:2
    ruby#17 0x55ceaea2498b in ruby_exec_node eval.c:326:12
    ruby#18 0x55ceaea247d0 in ruby_run_node eval.c:318:25
    ruby#19 0x55ceae88c486 in main main.c:42:9
    #20 0x7fc874330b96 in __libc_start_main /build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310
    ruby#21 0x55ceae7e5289 in _start (miniruby+0x15f289)

0x7fc86f334810 is located 16 bytes to the right of 1048576-byte region [0x7fc86f234800,0x7fc86f334800)
allocated by thread T0 here:
    #0 0x55ceae85d56d in malloc (miniruby+0x1d756d)
    #1 0x55ceaea71d12 in objspace_xmalloc0 gc.c:9416:5
    #2 0x55ceaea71cd2 in ruby_xmalloc2_body gc.c:9623:12
    #3 0x55ceaea7d09c in ruby_xmalloc2 gc.c:11479:12
    #4 0x55ceaf00c3b7 in rb_thread_recycle_stack vm.c:2462:12
    #5 0x55ceaf012256 in th_init vm.c:2656:29
    #6 0x55ceaf00d5eb in ruby_thread_init vm.c:2690:5
    #7 0x55ceaf00d4b1 in rb_thread_alloc vm.c:2703:5
    #8 0x55ceaef0038b in thread_s_new thread.c:872:20
    #9 0x55ceaf04d8c1 in call_cfunc_m1 vm_insnhelper.c:2041:12
    #10 0x55ceaf03118d in vm_call_cfunc_with_frame vm_insnhelper.c:2207:11
    #11 0x55ceaf017985 in vm_call_cfunc vm_insnhelper.c:2225:12
    #12 0x55ceaf01548b in vm_call_method_each_type vm_insnhelper.c:2560:9
    #13 0x55ceaf014c96 in vm_call_method vm_insnhelper.c:2686:13
    ruby#14 0x55ceaefb5de4 in vm_call_general vm_insnhelper.c:2730:12
    ruby#15 0x55ceaf03c868 in vm_sendish vm_insnhelper.c:3623:11
    ruby#16 0x55ceaefc95bb in vm_exec_core insns.def:771:11
    ruby#17 0x55ceaf006700 in rb_vm_exec vm.c:1892:22
    ruby#18 0x55ceaf00acbf in rb_iseq_eval_main vm.c:2151:11
    ruby#19 0x55ceaea250ca in ruby_exec_internal eval.c:262:2
    #20 0x55ceaea2498b in ruby_exec_node eval.c:326:12
    ruby#21 0x55ceaea247d0 in ruby_run_node eval.c:318:25
    ruby#22 0x55ceae88c486 in main main.c:42:9
    ruby#23 0x7fc874330b96 in __libc_start_main /build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310

SUMMARY: AddressSanitizer: heap-buffer-overflow vm_insnhelper.c:217:24 in vm_check_canary
Shadow bytes around the buggy address:
  0x0ff98de5e8b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0ff98de5e8c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0ff98de5e8d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0ff98de5e8e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0ff98de5e8f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0ff98de5e900: fa fa[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0ff98de5e910: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0ff98de5e920: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0ff98de5e930: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0ff98de5e940: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0ff98de5e950: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==82954==ABORTING
shyouhei added a commit to shyouhei/ruby that referenced this pull request Apr 26, 2019
@shyouhei
eliminate use of freed memory
6e9ba28 
rb_io_fptr_finalize_internal frees the memory region.

=================================================================
==85264==ERROR: AddressSanitizer: heap-use-after-free on address 0x610000000d8c at pc 0x5608e38077f7 bp 0x7ffee12d5440 sp 0x7ffee12d5438
READ of size 4 at 0x610000000d8c thread T0
    #0 0x5608e38077f6 in rb_io_memsize io.c:4749:24
    #1 0x5608e37a0481 in obj_memsize_of gc.c:3547:14
    #2 0x5608e37a4f30 in check_rvalue_consistency gc.c:1107:2
    #3 0x5608e37a2624 in RVALUE_OLD_P gc.c:1218:5
    #4 0x5608e37a5bae in rb_gc_force_recycle gc.c:6652:18
    #5 0x5608e38191f9 in rb_f_backquote io.c:9021:5
    #6 0x5608e3d8aa14 in call_cfunc_1 vm_insnhelper.c:2058:12
    #7 0x5608e3d6e23d in vm_call_cfunc_with_frame vm_insnhelper.c:2211:11
    #8 0x5608e3d54a35 in vm_call_cfunc vm_insnhelper.c:2229:12
    #9 0x5608e3d5253b in vm_call_method_each_type vm_insnhelper.c:2564:9
    #10 0x5608e3d51f50 in vm_call_method vm_insnhelper.c:2701:13
    #11 0x5608e3cf2de4 in vm_call_general vm_insnhelper.c:2734:12
    #12 0x5608e3d79918 in vm_sendish vm_insnhelper.c:3627:11
    #13 0x5608e3d06cf5 in vm_exec_core insns.def:789:11
    ruby#14 0x5608e3d43700 in rb_vm_exec vm.c:1892:22
    ruby#15 0x5608e3d47cbf in rb_iseq_eval_main vm.c:2151:11
    ruby#16 0x5608e37620ca in ruby_exec_internal eval.c:262:2
    ruby#17 0x5608e376198b in ruby_exec_node eval.c:326:12
    ruby#18 0x5608e37617d0 in ruby_run_node eval.c:318:25
    ruby#19 0x5608e35c9486 in main main.c:42:9
    #20 0x7f62e9421b96 in __libc_start_main /build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310
    ruby#21 0x5608e3522289 in _start (miniruby+0x15f289)

0x610000000d8c is located 76 bytes inside of 192-byte region [0x610000000d40,0x610000000e00)
freed by thread T0 here:
    #0 0x5608e359a2ed in free (miniruby+0x1d72ed)
    #1 0x5608e37af421 in objspace_xfree gc.c:9591:5
    #2 0x5608e37af3da in ruby_sized_xfree gc.c:9687:2
    #3 0x5608e3799ac8 in ruby_xfree gc.c:9694:5
    #4 0x5608e380746d in rb_io_fptr_finalize_internal io.c:4728:5
    #5 0x5608e38191ed in rb_f_backquote io.c:9020:5
    #6 0x5608e3d8aa14 in call_cfunc_1 vm_insnhelper.c:2058:12
    #7 0x5608e3d6e23d in vm_call_cfunc_with_frame vm_insnhelper.c:2211:11
    #8 0x5608e3d54a35 in vm_call_cfunc vm_insnhelper.c:2229:12
    #9 0x5608e3d5253b in vm_call_method_each_type vm_insnhelper.c:2564:9
    #10 0x5608e3d51f50 in vm_call_method vm_insnhelper.c:2701:13
    #11 0x5608e3cf2de4 in vm_call_general vm_insnhelper.c:2734:12
    #12 0x5608e3d79918 in vm_sendish vm_insnhelper.c:3627:11
    #13 0x5608e3d06cf5 in vm_exec_core insns.def:789:11
    ruby#14 0x5608e3d43700 in rb_vm_exec vm.c:1892:22
    ruby#15 0x5608e3d47cbf in rb_iseq_eval_main vm.c:2151:11
    ruby#16 0x5608e37620ca in ruby_exec_internal eval.c:262:2
    ruby#17 0x5608e376198b in ruby_exec_node eval.c:326:12
    ruby#18 0x5608e37617d0 in ruby_run_node eval.c:318:25
    ruby#19 0x5608e35c9486 in main main.c:42:9
    #20 0x7f62e9421b96 in __libc_start_main
/build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310

previously allocated by thread T0 here:
    #0 0x5608e359a56d in malloc (miniruby+0x1d756d)
    #1 0x5608e37aed12 in objspace_xmalloc0 gc.c:9416:5
    #2 0x5608e37aebe7 in ruby_xmalloc0 gc.c:9600:12
    #3 0x5608e37aea8b in ruby_xmalloc_body gc.c:9609:12
    #4 0x5608e37a6d64 in ruby_xmalloc gc.c:11469:12
    #5 0x5608e380e4b4 in rb_io_fptr_new io.c:8040:19
    #6 0x5608e380e446 in rb_io_make_open_file io.c:8077:10
    #7 0x5608e3850ea0 in pipe_open io.c:6707:5
    #8 0x5608e384edb4 in pipe_open_s io.c:6772:12
    #9 0x5608e381910b in rb_f_backquote io.c:9014:12
    #10 0x5608e3d8aa14 in call_cfunc_1 vm_insnhelper.c:2058:12
    #11 0x5608e3d6e23d in vm_call_cfunc_with_frame vm_insnhelper.c:2211:11
    #12 0x5608e3d54a35 in vm_call_cfunc vm_insnhelper.c:2229:12
    #13 0x5608e3d5253b in vm_call_method_each_type vm_insnhelper.c:2564:9
    ruby#14 0x5608e3d51f50 in vm_call_method vm_insnhelper.c:2701:13
    ruby#15 0x5608e3cf2de4 in vm_call_general vm_insnhelper.c:2734:12
    ruby#16 0x5608e3d79918 in vm_sendish vm_insnhelper.c:3627:11
    ruby#17 0x5608e3d06cf5 in vm_exec_core insns.def:789:11
    ruby#18 0x5608e3d43700 in rb_vm_exec vm.c:1892:22
    ruby#19 0x5608e3d47cbf in rb_iseq_eval_main vm.c:2151:11
    #20 0x5608e37620ca in ruby_exec_internal eval.c:262:2
    ruby#21 0x5608e376198b in ruby_exec_node eval.c:326:12
    ruby#22 0x5608e37617d0 in ruby_run_node eval.c:318:25
    ruby#23 0x5608e35c9486 in main main.c:42:9
    ruby#24 0x7f62e9421b96 in __libc_start_main /build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310

SUMMARY: AddressSanitizer: heap-use-after-free io.c:4749:24 in
rb_io_memsize
Shadow bytes around the buggy address:
  0x0c207fff8160: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
  0x0c207fff8170: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c207fff8180: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
  0x0c207fff8190: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c207fff81a0: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
=>0x0c207fff81b0: fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c207fff81c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c207fff81d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c207fff81e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c207fff81f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c207fff8200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==85264==ABORTING
ruby-bench-server pushed a commit to tgxworld/ruby that referenced this pull request Apr 26, 2019
@shyouhei
avoid buffer overflow in vm_check_canary
2a863d4 
ec->cfp->iseq might not exist at the very beginning of a thread.

=================================================================
==82954==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7fc86f334810 at pc 0x55ceaf013125 bp 0x7ffe2eddbbf0 sp 0x7ffe2eddbbe8
READ of size 8 at 0x7fc86f334810 thread T0
    #0 0x55ceaf013124 in vm_check_canary vm_insnhelper.c:217:24
    ruby#1 0x55ceaefb4796 in vm_push_frame vm_insnhelper.c:276:5
    ruby#2 0x55ceaf0124bd in th_init vm.c:2661:5
    ruby#3 0x55ceaf00d5eb in ruby_thread_init vm.c:2690:5
    ruby#4 0x55ceaf00d4b1 in rb_thread_alloc vm.c:2703:5
    ruby#5 0x55ceaef0038b in thread_s_new thread.c:872:20
    ruby#6 0x55ceaf04d8c1 in call_cfunc_m1 vm_insnhelper.c:2041:12
    ruby#7 0x55ceaf03118d in vm_call_cfunc_with_frame vm_insnhelper.c:2207:11
    ruby#8 0x55ceaf017985 in vm_call_cfunc vm_insnhelper.c:2225:12
    ruby#9 0x55ceaf01548b in vm_call_method_each_type vm_insnhelper.c:2560:9
    ruby#10 0x55ceaf014c96 in vm_call_method vm_insnhelper.c:2686:13
    ruby#11 0x55ceaefb5de4 in vm_call_general vm_insnhelper.c:2730:12
    ruby#12 0x55ceaf03c868 in vm_sendish vm_insnhelper.c:3623:11
    ruby#13 0x55ceaefc95bb in vm_exec_core insns.def:771:11
    ruby#14 0x55ceaf006700 in rb_vm_exec vm.c:1892:22
    ruby#15 0x55ceaf00acbf in rb_iseq_eval_main vm.c:2151:11
    ruby#16 0x55ceaea250ca in ruby_exec_internal eval.c:262:2
    ruby#17 0x55ceaea2498b in ruby_exec_node eval.c:326:12
    ruby#18 0x55ceaea247d0 in ruby_run_node eval.c:318:25
    ruby#19 0x55ceae88c486 in main main.c:42:9
    #20 0x7fc874330b96 in __libc_start_main /build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310
    ruby#21 0x55ceae7e5289 in _start (miniruby+0x15f289)

0x7fc86f334810 is located 16 bytes to the right of 1048576-byte region [0x7fc86f234800,0x7fc86f334800)
allocated by thread T0 here:
    #0 0x55ceae85d56d in malloc (miniruby+0x1d756d)
    ruby#1 0x55ceaea71d12 in objspace_xmalloc0 gc.c:9416:5
    ruby#2 0x55ceaea71cd2 in ruby_xmalloc2_body gc.c:9623:12
    ruby#3 0x55ceaea7d09c in ruby_xmalloc2 gc.c:11479:12
    ruby#4 0x55ceaf00c3b7 in rb_thread_recycle_stack vm.c:2462:12
    ruby#5 0x55ceaf012256 in th_init vm.c:2656:29
    ruby#6 0x55ceaf00d5eb in ruby_thread_init vm.c:2690:5
    ruby#7 0x55ceaf00d4b1 in rb_thread_alloc vm.c:2703:5
    ruby#8 0x55ceaef0038b in thread_s_new thread.c:872:20
    ruby#9 0x55ceaf04d8c1 in call_cfunc_m1 vm_insnhelper.c:2041:12
    ruby#10 0x55ceaf03118d in vm_call_cfunc_with_frame vm_insnhelper.c:2207:11
    ruby#11 0x55ceaf017985 in vm_call_cfunc vm_insnhelper.c:2225:12
    ruby#12 0x55ceaf01548b in vm_call_method_each_type vm_insnhelper.c:2560:9
    ruby#13 0x55ceaf014c96 in vm_call_method vm_insnhelper.c:2686:13
    ruby#14 0x55ceaefb5de4 in vm_call_general vm_insnhelper.c:2730:12
    ruby#15 0x55ceaf03c868 in vm_sendish vm_insnhelper.c:3623:11
    ruby#16 0x55ceaefc95bb in vm_exec_core insns.def:771:11
    ruby#17 0x55ceaf006700 in rb_vm_exec vm.c:1892:22
    ruby#18 0x55ceaf00acbf in rb_iseq_eval_main vm.c:2151:11
    ruby#19 0x55ceaea250ca in ruby_exec_internal eval.c:262:2
    #20 0x55ceaea2498b in ruby_exec_node eval.c:326:12
    ruby#21 0x55ceaea247d0 in ruby_run_node eval.c:318:25
    ruby#22 0x55ceae88c486 in main main.c:42:9
    ruby#23 0x7fc874330b96 in __libc_start_main /build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310

SUMMARY: AddressSanitizer: heap-buffer-overflow vm_insnhelper.c:217:24 in vm_check_canary
Shadow bytes around the buggy address:
  0x0ff98de5e8b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0ff98de5e8c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0ff98de5e8d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0ff98de5e8e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0ff98de5e8f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0ff98de5e900: fa fa[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0ff98de5e910: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0ff98de5e920: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0ff98de5e930: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0ff98de5e940: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0ff98de5e950: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==82954==ABORTING
ruby-bench-server pushed a commit to tgxworld/ruby that referenced this pull request Apr 26, 2019
@shyouhei
eliminate use of freed memory
7b7043e 
rb_io_fptr_finalize_internal frees the memory region.

=================================================================
==85264==ERROR: AddressSanitizer: heap-use-after-free on address 0x610000000d8c at pc 0x5608e38077f7 bp 0x7ffee12d5440 sp 0x7ffee12d5438
READ of size 4 at 0x610000000d8c thread T0
    #0 0x5608e38077f6 in rb_io_memsize io.c:4749:24
    ruby#1 0x5608e37a0481 in obj_memsize_of gc.c:3547:14
    ruby#2 0x5608e37a4f30 in check_rvalue_consistency gc.c:1107:2
    ruby#3 0x5608e37a2624 in RVALUE_OLD_P gc.c:1218:5
    ruby#4 0x5608e37a5bae in rb_gc_force_recycle gc.c:6652:18
    ruby#5 0x5608e38191f9 in rb_f_backquote io.c:9021:5
    ruby#6 0x5608e3d8aa14 in call_cfunc_1 vm_insnhelper.c:2058:12
    ruby#7 0x5608e3d6e23d in vm_call_cfunc_with_frame vm_insnhelper.c:2211:11
    ruby#8 0x5608e3d54a35 in vm_call_cfunc vm_insnhelper.c:2229:12
    ruby#9 0x5608e3d5253b in vm_call_method_each_type vm_insnhelper.c:2564:9
    ruby#10 0x5608e3d51f50 in vm_call_method vm_insnhelper.c:2701:13
    ruby#11 0x5608e3cf2de4 in vm_call_general vm_insnhelper.c:2734:12
    ruby#12 0x5608e3d79918 in vm_sendish vm_insnhelper.c:3627:11
    ruby#13 0x5608e3d06cf5 in vm_exec_core insns.def:789:11
    ruby#14 0x5608e3d43700 in rb_vm_exec vm.c:1892:22
    ruby#15 0x5608e3d47cbf in rb_iseq_eval_main vm.c:2151:11
    ruby#16 0x5608e37620ca in ruby_exec_internal eval.c:262:2
    ruby#17 0x5608e376198b in ruby_exec_node eval.c:326:12
    ruby#18 0x5608e37617d0 in ruby_run_node eval.c:318:25
    ruby#19 0x5608e35c9486 in main main.c:42:9
    #20 0x7f62e9421b96 in __libc_start_main /build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310
    ruby#21 0x5608e3522289 in _start (miniruby+0x15f289)

0x610000000d8c is located 76 bytes inside of 192-byte region [0x610000000d40,0x610000000e00)
freed by thread T0 here:
    #0 0x5608e359a2ed in free (miniruby+0x1d72ed)
    ruby#1 0x5608e37af421 in objspace_xfree gc.c:9591:5
    ruby#2 0x5608e37af3da in ruby_sized_xfree gc.c:9687:2
    ruby#3 0x5608e3799ac8 in ruby_xfree gc.c:9694:5
    ruby#4 0x5608e380746d in rb_io_fptr_finalize_internal io.c:4728:5
    ruby#5 0x5608e38191ed in rb_f_backquote io.c:9020:5
    ruby#6 0x5608e3d8aa14 in call_cfunc_1 vm_insnhelper.c:2058:12
    ruby#7 0x5608e3d6e23d in vm_call_cfunc_with_frame vm_insnhelper.c:2211:11
    ruby#8 0x5608e3d54a35 in vm_call_cfunc vm_insnhelper.c:2229:12
    ruby#9 0x5608e3d5253b in vm_call_method_each_type vm_insnhelper.c:2564:9
    ruby#10 0x5608e3d51f50 in vm_call_method vm_insnhelper.c:2701:13
    ruby#11 0x5608e3cf2de4 in vm_call_general vm_insnhelper.c:2734:12
    ruby#12 0x5608e3d79918 in vm_sendish vm_insnhelper.c:3627:11
    ruby#13 0x5608e3d06cf5 in vm_exec_core insns.def:789:11
    ruby#14 0x5608e3d43700 in rb_vm_exec vm.c:1892:22
    ruby#15 0x5608e3d47cbf in rb_iseq_eval_main vm.c:2151:11
    ruby#16 0x5608e37620ca in ruby_exec_internal eval.c:262:2
    ruby#17 0x5608e376198b in ruby_exec_node eval.c:326:12
    ruby#18 0x5608e37617d0 in ruby_run_node eval.c:318:25
    ruby#19 0x5608e35c9486 in main main.c:42:9
    #20 0x7f62e9421b96 in __libc_start_main
/build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310

previously allocated by thread T0 here:
    #0 0x5608e359a56d in malloc (miniruby+0x1d756d)
    ruby#1 0x5608e37aed12 in objspace_xmalloc0 gc.c:9416:5
    ruby#2 0x5608e37aebe7 in ruby_xmalloc0 gc.c:9600:12
    ruby#3 0x5608e37aea8b in ruby_xmalloc_body gc.c:9609:12
    ruby#4 0x5608e37a6d64 in ruby_xmalloc gc.c:11469:12
    ruby#5 0x5608e380e4b4 in rb_io_fptr_new io.c:8040:19
    ruby#6 0x5608e380e446 in rb_io_make_open_file io.c:8077:10
    ruby#7 0x5608e3850ea0 in pipe_open io.c:6707:5
    ruby#8 0x5608e384edb4 in pipe_open_s io.c:6772:12
    ruby#9 0x5608e381910b in rb_f_backquote io.c:9014:12
    ruby#10 0x5608e3d8aa14 in call_cfunc_1 vm_insnhelper.c:2058:12
    ruby#11 0x5608e3d6e23d in vm_call_cfunc_with_frame vm_insnhelper.c:2211:11
    ruby#12 0x5608e3d54a35 in vm_call_cfunc vm_insnhelper.c:2229:12
    ruby#13 0x5608e3d5253b in vm_call_method_each_type vm_insnhelper.c:2564:9
    ruby#14 0x5608e3d51f50 in vm_call_method vm_insnhelper.c:2701:13
    ruby#15 0x5608e3cf2de4 in vm_call_general vm_insnhelper.c:2734:12
    ruby#16 0x5608e3d79918 in vm_sendish vm_insnhelper.c:3627:11
    ruby#17 0x5608e3d06cf5 in vm_exec_core insns.def:789:11
    ruby#18 0x5608e3d43700 in rb_vm_exec vm.c:1892:22
    ruby#19 0x5608e3d47cbf in rb_iseq_eval_main vm.c:2151:11
    #20 0x5608e37620ca in ruby_exec_internal eval.c:262:2
    ruby#21 0x5608e376198b in ruby_exec_node eval.c:326:12
    ruby#22 0x5608e37617d0 in ruby_run_node eval.c:318:25
    ruby#23 0x5608e35c9486 in main main.c:42:9
    ruby#24 0x7f62e9421b96 in __libc_start_main /build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310

SUMMARY: AddressSanitizer: heap-use-after-free io.c:4749:24 in
rb_io_memsize
Shadow bytes around the buggy address:
  0x0c207fff8160: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
  0x0c207fff8170: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c207fff8180: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
  0x0c207fff8190: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c207fff81a0: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
=>0x0c207fff81b0: fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c207fff81c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c207fff81d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c207fff81e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c207fff81f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c207fff8200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==85264==ABORTING
matzbot pushed a commit that referenced this pull request Jun 13, 2019
@nagachika
merge revision(s) 7b7043e: [Backport #15793]
f4fe2a7 
	eliminate use of freed memory

	rb_io_fptr_finalize_internal frees the memory region.

	=================================================================
	==85264==ERROR: AddressSanitizer: heap-use-after-free on address 0x610000000d8c at pc 0x5608e38077f7 bp 0x7ffee12d5440 sp 0x7ffee12d5438
	READ of size 4 at 0x610000000d8c thread T0
	    #0 0x5608e38077f6 in rb_io_memsize io.c:4749:24
	    #1 0x5608e37a0481 in obj_memsize_of gc.c:3547:14
	    #2 0x5608e37a4f30 in check_rvalue_consistency gc.c:1107:2
	    #3 0x5608e37a2624 in RVALUE_OLD_P gc.c:1218:5
	    #4 0x5608e37a5bae in rb_gc_force_recycle gc.c:6652:18
	    #5 0x5608e38191f9 in rb_f_backquote io.c:9021:5
	    #6 0x5608e3d8aa14 in call_cfunc_1 vm_insnhelper.c:2058:12
	    #7 0x5608e3d6e23d in vm_call_cfunc_with_frame vm_insnhelper.c:2211:11
	    #8 0x5608e3d54a35 in vm_call_cfunc vm_insnhelper.c:2229:12
	    #9 0x5608e3d5253b in vm_call_method_each_type vm_insnhelper.c:2564:9
	    #10 0x5608e3d51f50 in vm_call_method vm_insnhelper.c:2701:13
	    #11 0x5608e3cf2de4 in vm_call_general vm_insnhelper.c:2734:12
	    #12 0x5608e3d79918 in vm_sendish vm_insnhelper.c:3627:11
	    #13 0x5608e3d06cf5 in vm_exec_core insns.def:789:11
	    #14 0x5608e3d43700 in rb_vm_exec vm.c:1892:22
	    #15 0x5608e3d47cbf in rb_iseq_eval_main vm.c:2151:11
	    #16 0x5608e37620ca in ruby_exec_internal eval.c:262:2
	    #17 0x5608e376198b in ruby_exec_node eval.c:326:12
	    #18 0x5608e37617d0 in ruby_run_node eval.c:318:25
	    #19 0x5608e35c9486 in main main.c:42:9
	    #20 0x7f62e9421b96 in __libc_start_main /build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310
	    #21 0x5608e3522289 in _start (miniruby+0x15f289)

	0x610000000d8c is located 76 bytes inside of 192-byte region [0x610000000d40,0x610000000e00)
	freed by thread T0 here:
	    #0 0x5608e359a2ed in free (miniruby+0x1d72ed)
	    #1 0x5608e37af421 in objspace_xfree gc.c:9591:5
	    #2 0x5608e37af3da in ruby_sized_xfree gc.c:9687:2
	    #3 0x5608e3799ac8 in ruby_xfree gc.c:9694:5
	    #4 0x5608e380746d in rb_io_fptr_finalize_internal io.c:4728:5
	    #5 0x5608e38191ed in rb_f_backquote io.c:9020:5
	    #6 0x5608e3d8aa14 in call_cfunc_1 vm_insnhelper.c:2058:12
	    #7 0x5608e3d6e23d in vm_call_cfunc_with_frame vm_insnhelper.c:2211:11
	    #8 0x5608e3d54a35 in vm_call_cfunc vm_insnhelper.c:2229:12
	    #9 0x5608e3d5253b in vm_call_method_each_type vm_insnhelper.c:2564:9
	    #10 0x5608e3d51f50 in vm_call_method vm_insnhelper.c:2701:13
	    #11 0x5608e3cf2de4 in vm_call_general vm_insnhelper.c:2734:12
	    #12 0x5608e3d79918 in vm_sendish vm_insnhelper.c:3627:11
	    #13 0x5608e3d06cf5 in vm_exec_core insns.def:789:11
	    #14 0x5608e3d43700 in rb_vm_exec vm.c:1892:22
	    #15 0x5608e3d47cbf in rb_iseq_eval_main vm.c:2151:11
	    #16 0x5608e37620ca in ruby_exec_internal eval.c:262:2
	    #17 0x5608e376198b in ruby_exec_node eval.c:326:12
	    #18 0x5608e37617d0 in ruby_run_node eval.c:318:25
	    #19 0x5608e35c9486 in main main.c:42:9
	    #20 0x7f62e9421b96 in __libc_start_main
	/build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310

	previously allocated by thread T0 here:
	    #0 0x5608e359a56d in malloc (miniruby+0x1d756d)
	    #1 0x5608e37aed12 in objspace_xmalloc0 gc.c:9416:5
	    #2 0x5608e37aebe7 in ruby_xmalloc0 gc.c:9600:12
	    #3 0x5608e37aea8b in ruby_xmalloc_body gc.c:9609:12
	    #4 0x5608e37a6d64 in ruby_xmalloc gc.c:11469:12
	    #5 0x5608e380e4b4 in rb_io_fptr_new io.c:8040:19
	    #6 0x5608e380e446 in rb_io_make_open_file io.c:8077:10
	    #7 0x5608e3850ea0 in pipe_open io.c:6707:5
	    #8 0x5608e384edb4 in pipe_open_s io.c:6772:12
	    #9 0x5608e381910b in rb_f_backquote io.c:9014:12
	    #10 0x5608e3d8aa14 in call_cfunc_1 vm_insnhelper.c:2058:12
	    #11 0x5608e3d6e23d in vm_call_cfunc_with_frame vm_insnhelper.c:2211:11
	    #12 0x5608e3d54a35 in vm_call_cfunc vm_insnhelper.c:2229:12
	    #13 0x5608e3d5253b in vm_call_method_each_type vm_insnhelper.c:2564:9
	    #14 0x5608e3d51f50 in vm_call_method vm_insnhelper.c:2701:13
	    #15 0x5608e3cf2de4 in vm_call_general vm_insnhelper.c:2734:12
	    #16 0x5608e3d79918 in vm_sendish vm_insnhelper.c:3627:11
	    #17 0x5608e3d06cf5 in vm_exec_core insns.def:789:11
	    #18 0x5608e3d43700 in rb_vm_exec vm.c:1892:22
	    #19 0x5608e3d47cbf in rb_iseq_eval_main vm.c:2151:11
	    #20 0x5608e37620ca in ruby_exec_internal eval.c:262:2
	    #21 0x5608e376198b in ruby_exec_node eval.c:326:12
	    #22 0x5608e37617d0 in ruby_run_node eval.c:318:25
	    #23 0x5608e35c9486 in main main.c:42:9
	    #24 0x7f62e9421b96 in __libc_start_main /build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310

	SUMMARY: AddressSanitizer: heap-use-after-free io.c:4749:24 in
	rb_io_memsize
	Shadow bytes around the buggy address:
	  0x0c207fff8160: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
	  0x0c207fff8170: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
	  0x0c207fff8180: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
	  0x0c207fff8190: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
	  0x0c207fff81a0: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
	=>0x0c207fff81b0: fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd fd
	  0x0c207fff81c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
	  0x0c207fff81d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
	  0x0c207fff81e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
	  0x0c207fff81f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
	  0x0c207fff8200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
	Shadow byte legend (one shadow byte represents 8 application bytes):
	  Addressable:           00
	  Partially addressable: 01 02 03 04 05 06 07
	  Heap left redzone:       fa
	  Freed heap region:       fd
	  Stack left redzone:      f1
	  Stack mid redzone:       f2
	  Stack right redzone:     f3
	  Stack after return:      f5
	  Stack use after scope:   f8
	  Global redzone:          f9
	  Global init order:       f6
	  Poisoned by user:        f7
	  Container overflow:      fc
	  Array cookie:            ac
	  Intra object redzone:    bb
	  ASan internal:           fe
	  Left alloca redzone:     ca
	  Right alloca redzone:    cb
	  Shadow gap:              cc
	==85264==ABORTING

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_6@67710 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
matzbot pushed a commit that referenced this pull request Aug 4, 2019
@kou @hsbt
[ruby/rexml] xpath number: fix a bug that false is converted to NaN
39f275e 
GitHub: fix #18

It must be 0.

Reported by Mirko Budszuhn. Thanks!!!

ruby/rexml@b48f3afa3b
matzbot pushed a commit that referenced this pull request Aug 4, 2019
@kou @hsbt
[ruby/rexml] xpath: add missing value conversions for equality and re…
310a2a9 
…lational expressions

GitHub: fix #18

Reported by Mirko Budszuhn. Thanks!!!

ruby/rexml@0dca2a2ba0
matzbot pushed a commit that referenced this pull request Aug 19, 2019
@unak
merge revision(s) f4fe2a7: [Backport #15793]
bad6483 
	merge revision(s) 7b7043e: [Backport
	 #15793]

		eliminate use of freed memory

		rb_io_fptr_finalize_internal frees the memory region.

		=================================================================
		==85264==ERROR: AddressSanitizer: heap-use-after-free on address 0x610000000d8c at pc 0x5608e38077f7 bp 0x7ffee12d5440 sp 0x7ffee12d5438
		READ of size 4 at 0x610000000d8c thread T0
		    #0 0x5608e38077f6 in rb_io_memsize io.c:4749:24
		    #1 0x5608e37a0481 in obj_memsize_of gc.c:3547:14
		    #2 0x5608e37a4f30 in check_rvalue_consistency gc.c:1107:2
		    #3 0x5608e37a2624 in RVALUE_OLD_P gc.c:1218:5
		    #4 0x5608e37a5bae in rb_gc_force_recycle gc.c:6652:18
		    #5 0x5608e38191f9 in rb_f_backquote io.c:9021:5
		    #6 0x5608e3d8aa14 in call_cfunc_1 vm_insnhelper.c:2058:12
		    #7 0x5608e3d6e23d in vm_call_cfunc_with_frame vm_insnhelper.c:2211:11
		    #8 0x5608e3d54a35 in vm_call_cfunc vm_insnhelper.c:2229:12
		    #9 0x5608e3d5253b in vm_call_method_each_type vm_insnhelper.c:2564:9
		    #10 0x5608e3d51f50 in vm_call_method vm_insnhelper.c:2701:13
		    #11 0x5608e3cf2de4 in vm_call_general vm_insnhelper.c:2734:12
		    #12 0x5608e3d79918 in vm_sendish vm_insnhelper.c:3627:11
		    #13 0x5608e3d06cf5 in vm_exec_core insns.def:789:11
		    #14 0x5608e3d43700 in rb_vm_exec vm.c:1892:22
		    #15 0x5608e3d47cbf in rb_iseq_eval_main vm.c:2151:11
		    #16 0x5608e37620ca in ruby_exec_internal eval.c:262:2
		    #17 0x5608e376198b in ruby_exec_node eval.c:326:12
		    #18 0x5608e37617d0 in ruby_run_node eval.c:318:25
		    #19 0x5608e35c9486 in main main.c:42:9
		    #20 0x7f62e9421b96 in __libc_start_main /build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310
		    #21 0x5608e3522289 in _start (miniruby+0x15f289)

		0x610000000d8c is located 76 bytes inside of 192-byte region [0x610000000d40,0x610000000e00)
		freed by thread T0 here:
		    #0 0x5608e359a2ed in free (miniruby+0x1d72ed)
		    #1 0x5608e37af421 in objspace_xfree gc.c:9591:5
		    #2 0x5608e37af3da in ruby_sized_xfree gc.c:9687:2
		    #3 0x5608e3799ac8 in ruby_xfree gc.c:9694:5
		    #4 0x5608e380746d in rb_io_fptr_finalize_internal io.c:4728:5
		    #5 0x5608e38191ed in rb_f_backquote io.c:9020:5
		    #6 0x5608e3d8aa14 in call_cfunc_1 vm_insnhelper.c:2058:12
		    #7 0x5608e3d6e23d in vm_call_cfunc_with_frame vm_insnhelper.c:2211:11
		    #8 0x5608e3d54a35 in vm_call_cfunc vm_insnhelper.c:2229:12
		    #9 0x5608e3d5253b in vm_call_method_each_type vm_insnhelper.c:2564:9
		    #10 0x5608e3d51f50 in vm_call_method vm_insnhelper.c:2701:13
		    #11 0x5608e3cf2de4 in vm_call_general vm_insnhelper.c:2734:12
		    #12 0x5608e3d79918 in vm_sendish vm_insnhelper.c:3627:11
		    #13 0x5608e3d06cf5 in vm_exec_core insns.def:789:11
		    #14 0x5608e3d43700 in rb_vm_exec vm.c:1892:22
		    #15 0x5608e3d47cbf in rb_iseq_eval_main vm.c:2151:11
		    #16 0x5608e37620ca in ruby_exec_internal eval.c:262:2
		    #17 0x5608e376198b in ruby_exec_node eval.c:326:12
		    #18 0x5608e37617d0 in ruby_run_node eval.c:318:25
		    #19 0x5608e35c9486 in main main.c:42:9
		    #20 0x7f62e9421b96 in __libc_start_main
		/build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310

		previously allocated by thread T0 here:
		    #0 0x5608e359a56d in malloc (miniruby+0x1d756d)
		    #1 0x5608e37aed12 in objspace_xmalloc0 gc.c:9416:5
		    #2 0x5608e37aebe7 in ruby_xmalloc0 gc.c:9600:12
		    #3 0x5608e37aea8b in ruby_xmalloc_body gc.c:9609:12
		    #4 0x5608e37a6d64 in ruby_xmalloc gc.c:11469:12
		    #5 0x5608e380e4b4 in rb_io_fptr_new io.c:8040:19
		    #6 0x5608e380e446 in rb_io_make_open_file io.c:8077:10
		    #7 0x5608e3850ea0 in pipe_open io.c:6707:5
		    #8 0x5608e384edb4 in pipe_open_s io.c:6772:12
		    #9 0x5608e381910b in rb_f_backquote io.c:9014:12
		    #10 0x5608e3d8aa14 in call_cfunc_1 vm_insnhelper.c:2058:12
		    #11 0x5608e3d6e23d in vm_call_cfunc_with_frame vm_insnhelper.c:2211:11
		    #12 0x5608e3d54a35 in vm_call_cfunc vm_insnhelper.c:2229:12
		    #13 0x5608e3d5253b in vm_call_method_each_type vm_insnhelper.c:2564:9
		    #14 0x5608e3d51f50 in vm_call_method vm_insnhelper.c:2701:13
		    #15 0x5608e3cf2de4 in vm_call_general vm_insnhelper.c:2734:12
		    #16 0x5608e3d79918 in vm_sendish vm_insnhelper.c:3627:11
		    #17 0x5608e3d06cf5 in vm_exec_core insns.def:789:11
		    #18 0x5608e3d43700 in rb_vm_exec vm.c:1892:22
		    #19 0x5608e3d47cbf in rb_iseq_eval_main vm.c:2151:11
		    #20 0x5608e37620ca in ruby_exec_internal eval.c:262:2
		    #21 0x5608e376198b in ruby_exec_node eval.c:326:12
		    #22 0x5608e37617d0 in ruby_run_node eval.c:318:25
		    #23 0x5608e35c9486 in main main.c:42:9
		    #24 0x7f62e9421b96 in __libc_start_main /build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310

		SUMMARY: AddressSanitizer: heap-use-after-free io.c:4749:24 in
		rb_io_memsize
		Shadow bytes around the buggy address:
		  0x0c207fff8160: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
		  0x0c207fff8170: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
		  0x0c207fff8180: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
		  0x0c207fff8190: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
		  0x0c207fff81a0: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
		=>0x0c207fff81b0: fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd fd
		  0x0c207fff81c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
		  0x0c207fff81d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
		  0x0c207fff81e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
		  0x0c207fff81f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
		  0x0c207fff8200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
		Shadow byte legend (one shadow byte represents 8 application bytes):
		  Addressable:           00
		  Partially addressable: 01 02 03 04 05 06 07
		  Heap left redzone:       fa
		  Freed heap region:       fd
		  Stack left redzone:      f1
		  Stack mid redzone:       f2
		  Stack right redzone:     f3
		  Stack after return:      f5
		  Stack use after scope:   f8
		  Global redzone:          f9
		  Global init order:       f6
		  Poisoned by user:        f7
		  Container overflow:      fc
		  Array cookie:            ac
		  Intra object redzone:    bb
		  ASan internal:           fe
		  Left alloca redzone:     ca
		  Right alloca redzone:    cb
		  Shadow gap:              cc
		==85264==ABORTING

	git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_6@67710 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@67748 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
matzbot pushed a commit that referenced this pull request Dec 12, 2019
@shyouhei
proper initialization of struct RVALUE
1a4a9bd 
This changeset makes no difference unless GC_DEBUG is on.  When that flag is
set, struct RVALUE is bigger than struct RObject.  We have to take care of the
additional fields.  Otherwise we get a SIGSEGV like shown below.

The way obj is initialized in this patch works for both GC_DEBUG is on and off.
See also ISO/IEC 9899:1999 section 6.7.8 paragraph #21.

```
Program received signal SIGSEGV, Segmentation fault.
__strlen_avx2 () at ../sysdeps/x86_64/multiarch/strlen-avx2.S:62
62      ../sysdeps/x86_64/multiarch/strlen-avx2.S: No such file or directory
(gdb) bt
#0  __strlen_avx2 () at ../sysdeps/x86_64/multiarch/strlen-avx2.S:62
#1  0x00005555557dd9a7 in BSD_vfprintf (fp=0x7fffffff6be0, fmt0=0x5555558f3059 "@%s:%d", ap=0x7fffffff6dd0) at vsnprintf.c:1027
#2  0x00005555557db6f5 in ruby_do_vsnprintf (str=0x555555bfc58d <obj_info_buffers+1325> "", n=211, fmt=0x5555558f3059 "@%s:%d", ap=0x7fffffff6dd0) at sprintf.c:1022
#3  0x00005555557db909 in ruby_snprintf (str=0x555555bfc58d <obj_info_buffers+1325> "", n=211, fmt=0x5555558f3059 "@%s:%d") at sprintf.c:1040
#4  0x0000555555661ef4 in rb_raw_obj_info (buff=0x555555bfc560 <obj_info_buffers+1280> "0x0000555555d2bfa0 [0     ] T_STRING (String)", buff_size=256, obj=93825000456096) at gc.c:11449
#5  0x000055555565baaf in obj_info (obj=93825000456096) at gc.c:11612
#6  0x000055555565bae1 in rgengc_remembered (objspace=0x555555c0a1c0, obj=93825000456096) at gc.c:6618
#7  0x0000555555666987 in newobj_init (klass=93824999964192, flags=5, v1=0, v2=0, v3=0, wb_protected=1, objspace=0x555555c0a1c0, obj=93825000456096) at gc.c:2134
#8  0x0000555555666e49 in newobj_slowpath (klass=93824999964192, flags=5, v1=0, v2=0, v3=0, objspace=0x555555c0a1c0, wb_protected=1) at gc.c:2209
#9  0x0000555555666b94 in newobj_slowpath_wb_protected (klass=93824999964192, flags=5, v1=0, v2=0, v3=0, objspace=0x555555c0a1c0) at gc.c:2220
#10 0x000055555565751b in newobj_of (klass=93824999964192, flags=5, v1=0, v2=0, v3=0, wb_protected=1) at gc.c:2256
#11 0x00005555556575ca in rb_wb_protected_newobj_of (klass=93824999964192, flags=5) at gc.c:2272
#12 0x00005555557f36ea in str_alloc (klass=93824999964192) at string.c:728
#13 0x00005555557f2128 in rb_str_buf_new (capa=0) at string.c:1317
#14 0x000055555578c66d in rb_reg_preprocess (p=0x555555cc8148 "^-(.)(.+)?", end=0x555555cc8152 "", enc=0x555555cc7c80, fixed_enc=0x7fffffff74e8, err=0x7fffffff75f0 "") at re.c:2682
#15 0x000055555578ea13 in rb_reg_initialize (obj=93825000046736, s=0x555555cc8148 "^-(.)(.+)?", len=10, enc=0x555555cc7c80, options=0, err=0x7fffffff75f0 "", sourcefile=0x555555d1a5c0 "lib/optparse.rb", sourceline=1460) at re.c:2808
#16 0x000055555578e285 in rb_reg_initialize_str (obj=93825000046736, str=93825000046904, options=0, err=0x7fffffff75f0 "", sourcefile=0x555555d1a5c0 "lib/optparse.rb", sourceline=1460) at re.c:2869
#17 0x000055555578ee02 in rb_reg_compile (str=93825000046904, options=0, sourcefile=0x555555d1a5c0 "lib/optparse.rb", sourceline=1460) at re.c:2958
#18 0x0000555555748dfb in rb_parser_reg_compile (p=0x555555d1f760, str=93825000046904, options=0) at parse.y:12157
#19 0x00005555557581c3 in parser_reg_compile (p=0x555555d1f760, str=93825000046904, options=0) at parse.y:12151
#20 0x00005555557580ac in reg_compile (p=0x555555d1f760, str=93825000046904, options=0) at parse.y:12167
#21 0x0000555555746ebb in new_regexp (p=0x555555d1f760, node=0x555555dece68, options=0, loc=0x7fffffff89e8) at parse.y:10072
#22 0x000055555573d1f5 in ruby_yyparse (p=0x555555d1f760) at parse.y:4395
#23 0x000055555574a582 in yycompile0 (arg=93825000404832) at parse.y:5945
#24 0x00005555558c6898 in rb_suppress_tracing (func=0x55555574a470 <yycompile0>, arg=93825000404832) at vm_trace.c:427
#25 0x0000555555748290 in yycompile (vparser=93824999283456, p=0x555555d1f760, fname=93824999283624, line=1) at parse.y:5994
#26 0x00005555557481ae in rb_parser_compile_file_path (vparser=93824999283456, fname=93824999283624, file=93824999283400, start=1) at parse.y:6098
#27 0x00005555557cdd35 in load_file_internal (argp_v=140737488331760) at ruby.c:2023
#28 0x00005555556438c5 in rb_ensure (b_proc=0x5555557cd610 <load_file_internal>, data1=140737488331760, e_proc=0x5555557cddd0 <restore_load_file>, data2=140737488331760) at eval.c:1128
#29 0x00005555557cb68b in load_file (parser=93824999283456, fname=93824999283624, f=93824999283400, script=0, opt=0x7fffffffa468) at ruby.c:2142
#30 0x00005555557cb339 in rb_parser_load_file (parser=93824999283456, fname_v=93824999283624) at ruby.c:2164
#31 0x00005555556ba3e1 in load_iseq_eval (ec=0x555555c0a650, fname=93824999283624) at load.c:579
#32 0x00005555556b857a in require_internal (ec=0x555555c0a650, fname=93824999284352, exception=1) at load.c:1016
#33 0x00005555556b7967 in rb_require_string (fname=93824999284464) at load.c:1105
#34 0x00005555556b7939 in rb_f_require (obj=93824999994824, fname=93824999284464) at load.c:811
#35 0x00005555558b7ae0 in call_cfunc_1 (recv=93824999994824, argc=1, argv=0x7ffff7ecd0a8, func=0x5555556b7920 <rb_f_require>) at vm_insnhelper.c:2348
#36 0x00005555558a8889 in vm_call_cfunc_with_frame (ec=0x555555c0a650, reg_cfp=0x7ffff7fccfa0, calling=0x7fffffffaab0, cd=0x555555d76a10, empty_kw_splat=0) at vm_insnhelper.c:2513
#37 0x000055555589fb5c in vm_call_cfunc (ec=0x555555c0a650, reg_cfp=0x7ffff7fccfa0, calling=0x7fffffffaab0, cd=0x555555d76a10) at vm_insnhelper.c:2538
#38 0x000055555589f22e in vm_call_method_each_type (ec=0x555555c0a650, cfp=0x7ffff7fccfa0, calling=0x7fffffffaab0, cd=0x555555d76a10) at vm_insnhelper.c:2924
#39 0x000055555589ef47 in vm_call_method (ec=0x555555c0a650, cfp=0x7ffff7fccfa0, calling=0x7fffffffaab0, cd=0x555555d76a10) at vm_insnhelper.c:3038
#40 0x0000555555866dbd in vm_call_general (ec=0x555555c0a650, reg_cfp=0x7ffff7fccfa0, calling=0x7fffffffaab0, cd=0x555555d76a10) at vm_insnhelper.c:3075
#41 0x00005555558ae557 in vm_sendish (ec=0x555555c0a650, reg_cfp=0x7ffff7fccfa0, cd=0x555555d76a10, block_handler=0, method_explorer=0x5555558ae5d0 <vm_search_method_wrap>) at vm_insnhelper.c:4021
#42 0x000055555587745b in vm_exec_core (ec=0x555555c0a650, initial=0) at insns.def:801
#43 0x0000555555899b9c in rb_vm_exec (ec=0x555555c0a650, mjit_enable_p=1) at vm.c:1907
#44 0x000055555589aaf0 in rb_iseq_eval_main (iseq=0x555555c1da80) at vm.c:2166
#45 0x0000555555641f0b in rb_ec_exec_node (ec=0x555555c0a650, n=0x555555c1da80) at eval.c:277
#46 0x0000555555641d62 in ruby_run_node (n=0x555555c1da80) at eval.c:335
#47 0x000055555557a188 in main (argc=11, argv=0x7fffffffc848) at main.c:50
(gdb) fr 7
#7  0x0000555555666987 in newobj_init (klass=93824999964192, flags=5, v1=0, v2=0, v3=0, wb_protected=1, objspace=0x555555c0a1c0, obj=93825000456096) at gc.c:2134
2134        if (rgengc_remembered(objspace, (VALUE)obj)) rb_bug("newobj: %s is remembered.", obj_info(obj));
(gdb) p ((struct RVALUE*)obj)->file
$1 = 0x65a5992b0fb25ce7 <error: Cannot access memory at address 0x65a5992b0fb25ce7>
(gdb)
```
matzbot pushed a commit that referenced this pull request Jun 9, 2020
@tenderlove
Revert "Combine sweeping and moving"
62ce8f9 
This reverts commit 02b216e.
This reverts commit 9b8825b.

I found that combining sweep and move is not safe.  I don't think that
we can do compaction concurrently with _anything_ unless there is a read
barrier installed.

Here is a simple example.  A class object is freed, and during it's free
step, it tries to remove itself from its parent's subclass list.
However, during the sweep step, the parent class was moved and the
"currently being freed" class didn't have references updated yet.  So we
get a segv like this:

```
(lldb) bt
* thread #1, name = 'ruby', stop reason = signal SIGSEGV
  * frame #0: 0x0000560763e344cb ruby`rb_st_lookup at st.c:320:43
    frame #1: 0x0000560763e344cb ruby`rb_st_lookup(tab=0x2f7469672f6e6f72, key=3809, value=0x0000560765bf2270) at st.c:1010
    frame #2: 0x0000560763e8f16a ruby`rb_search_class_path at variable.c:99:9
    frame #3: 0x0000560763e8f141 ruby`rb_search_class_path at variable.c:145
    frame #4: 0x0000560763e8f141 ruby`rb_search_class_path(klass=94589785585880) at variable.c:191
    frame #5: 0x0000560763ec744e ruby`rb_vm_bugreport at vm_dump.c:996:17
    frame #6: 0x0000560763f5b958 ruby`rb_bug_for_fatal_signal at error.c:675:5
    frame #7: 0x0000560763e27dad ruby`sigsegv(sig=<unavailable>, info=<unavailable>, ctx=<unavailable>) at signal.c:955:5
    frame #8: 0x00007f8b891d33c0 libpthread.so.0`___lldb_unnamed_symbol1$$libpthread.so.0 + 1
    frame #9: 0x0000560763efa8bb ruby`rb_class_remove_from_super_subclasses(klass=94589790314280) at class.c:93:56
    frame #10: 0x0000560763d10cb7 ruby`gc_sweep_step at gc.c:2674:2
    frame #11: 0x0000560763d1187b ruby`gc_sweep at gc.c:4540:2
    frame #12: 0x0000560763d101f0 ruby`gc_start at gc.c:6797:6
    frame #13: 0x0000560763d15153 ruby`rb_gc_compact at gc.c:7479:12
    frame #14: 0x0000560763eb4eb8 ruby`vm_exec_core at vm_insnhelper.c:5183:13
    frame #15: 0x0000560763ea9bae ruby`rb_vm_exec at vm.c:1953:22
    frame #16: 0x0000560763eac08d ruby`rb_yield at vm.c:1132:9
    frame #17: 0x0000560763edb4f2 ruby`rb_ary_collect at array.c:3186:9
    frame #18: 0x0000560763e9ee15 ruby`vm_call_cfunc_with_frame at vm_insnhelper.c:2575:12
    frame #19: 0x0000560763eb2e66 ruby`vm_exec_core at vm_insnhelper.c:4177:11
    frame #20: 0x0000560763ea9bae ruby`rb_vm_exec at vm.c:1953:22
    frame #21: 0x0000560763eac08d ruby`rb_yield at vm.c:1132:9
    frame #22: 0x0000560763edb4f2 ruby`rb_ary_collect at array.c:3186:9
    frame #23: 0x0000560763e9ee15 ruby`vm_call_cfunc_with_frame at vm_insnhelper.c:2575:12
    frame #24: 0x0000560763eb2e66 ruby`vm_exec_core at vm_insnhelper.c:4177:11
    frame #25: 0x0000560763ea9bae ruby`rb_vm_exec at vm.c:1953:22
    frame #26: 0x0000560763ceee01 ruby`rb_ec_exec_node(ec=0x0000560765afa530, n=0x0000560765b088e0) at eval.c:296:2
    frame #27: 0x0000560763cf3b7b ruby`ruby_run_node(n=0x0000560765b088e0) at eval.c:354:12
    frame #28: 0x0000560763cee4a3 ruby`main(argc=<unavailable>, argv=<unavailable>) at main.c:50:9
    frame #29: 0x00007f8b88e560b3 libc.so.6`__libc_start_main + 243
    frame #30: 0x0000560763cee4ee ruby`_start + 46
(lldb) f 9
frame #9: 0x0000560763efa8bb ruby`rb_class_remove_from_super_subclasses(klass=94589790314280) at class.c:93:56
   90
   91  		*RCLASS_EXT(klass)->parent_subclasses = entry->next;
   92  		if (entry->next) {
-> 93  		    RCLASS_EXT(entry->next->klass)->parent_subclasses = RCLASS_EXT(klass)->parent_subclasses;
   94  		}
   95  		xfree(entry);
   96  	    }
(lldb) command script import -r misc/lldb_cruby.py
lldb scripts for ruby has been installed.
(lldb) rp entry->next->klass
(struct RMoved) $1 = (flags = 30, destination = 94589792806680, next = 94589784369160)
(lldb)
```
@eightbitraptor eightbitraptor mentioned this pull request Sep 3, 2020
Merged
matzbot pushed a commit that referenced this pull request Oct 10, 2020
@nobu
[ruby/io-console] Fix timeout type error (#18)
a799667 
Fixed TypeError when IO#getch timed out

`rb_io_wait` returns a bit-flags Integer representing available
events, or Qfalse if timed out.  Also the result of `NUM2INT` is
not a `VALUE`.

```
$ ./bin/ruby -v -rio/console -e "p IO.console.getch(intr: true, time: 0.1)"
ruby 3.0.0dev (2020-10-09T20:27:30Z master 5ea2ea7) [x64-mingw32]
-e:1:in `getch': no implicit conversion of false into Integer (TypeError)
        from -e:1:in `<main>'
```

ruby/io-console@3bdfaf62df
tenderlove added a commit that referenced this pull request Apr 20, 2021
@tenderlove
check ep during compaction because it can be null
32643cf 
This commit adds a check on the ep just like in the mark function.  The
env can contain null bytes if allocation tracing is enabled.

We're seeing errors during autocompaction like this:

```
(lldb) bt 40
* thread #1, name = 'ruby', stop reason = signal SIGABRT
    frame #0: 0x00007f7d64b6018b libc.so.6`raise + 203
    frame #1: 0x00007f7d64b3f859 libc.so.6`abort + 299
    frame #2: 0x000055af5f2fefc9 ruby`die at error.c:764:5
    frame #3: 0x000055af5f2ff1ac ruby`rb_bug_for_fatal_signal(default_sighandler=0x0000000000000000, sig=11, ctx=0x000055af60bc3340, fmt="") at error.c:804:5
    frame #4: 0x000055af5f4bd08f ruby`sigsegv(sig=11, info=0x000055af60bc3470, ctx=0x000055af60bc3340) at signal.c:960:5
    frame #5: 0x00007f7d64ebe3c0 libpthread.so.0`__restore_rt
    frame #6: 0x000055af5f339b0a ruby`gc_ref_update_imemo(objspace=0x000055af60b2b040, obj=0x00007f7d5b513fd0) at gc.c:9046:13
    frame #7: 0x000055af5f339172 ruby`gc_update_object_references(objspace=0x000055af60b2b040, obj=0x00007f7d5b513fd0) at gc.c:9307:9
    frame #8: 0x000055af5f338e79 ruby`gc_ref_update(vstart=0x00007f7d5b510010, vend=0x00007f7d5b513ff8, stride=40, objspace=0x000055af60b2b040, page=0x000055af62577aa0) at gc.c:9452:21
    frame #9: 0x000055af5f337846 ruby`gc_update_references(objspace=0x000055af60b2b040, heap=0x000055af60b2b068) at gc.c:9481:9
    frame #10: 0x000055af5f336569 ruby`gc_compact_finish(objspace=0x000055af60b2b040, heap=0x000055af60b2b068) at gc.c:4840:5
    frame #11: 0x000055af5f335efb ruby`gc_page_sweep(objspace=0x000055af60b2b040, heap=0x000055af60b2b068, sweep_page=0x000055af63a1eb30) at gc.c:5046:13
    frame #12: 0x000055af5f3355c5 ruby`gc_sweep_step(objspace=0x000055af60b2b040, heap=0x000055af60b2b068) at gc.c:5214:19
    frame #13: 0x000055af5f33daf6 ruby`gc_sweep_rest(objspace=0x000055af60b2b040) at gc.c:5271:2
    frame #14: 0x000055af5f33cacd ruby`gc_sweep(objspace=0x000055af60b2b040) at gc.c:5389:2
    frame #15: 0x000055af5f33c21d ruby`gc_marks_rest(objspace=0x000055af60b2b040) at gc.c:7555:5
    frame #16: 0x000055af5f324d41 ruby`gc_rest(objspace=0x000055af60b2b040) at gc.c:8457:13
    frame #17: 0x000055af5f3297d8 ruby`garbage_collect(objspace=0x000055af60b2b040, reason=45568) at gc.c:8318:9
    frame #18: 0x000055af5f344ece ruby`garbage_collect_with_gvl(objspace=0x000055af60b2b040, reason=45568) at gc.c:8632:9
    frame #19: 0x000055af5f344e61 ruby`objspace_malloc_gc_stress(objspace=0x000055af60b2b040) at gc.c:10592:9
    frame #20: 0x000055af5f32ced1 ruby`objspace_xmalloc0(objspace=0x000055af60b2b040, size=64) at gc.c:10767:5
    frame #21: 0x000055af5f32ce11 ruby`ruby_xmalloc0(size=64) at gc.c:10988:12
    frame #22: 0x000055af5f32cdac ruby`ruby_xmalloc_body(size=64) at gc.c:10997:12
    frame #23: 0x000055af5f329415 ruby`ruby_xmalloc(size=64) at gc.c:12942:12
    frame #24: 0x00007f7d611c4fe5 objspace.so`newobj_i(tpval=0x00007f7d5b553770, data=0x000055af639031a0) at object_tracing.c:101:35
    frame #25: 0x000055af5f5b283f ruby`tp_call_trace(tpval=0x00007f7d5b553770, trace_arg=0x00007fff1016d398) at vm_trace.c:1115:2
    frame #26: 0x000055af5f5b50ec ruby`exec_hooks_body(ec=0x000055af60b2b700, list=0x000055af60b2b920, trace_arg=0x00007fff1016d398) at vm_trace.c:304:3
    frame #27: 0x000055af5f5b0f24 ruby`exec_hooks_unprotected(ec=0x000055af60b2b700, list=0x000055af60b2b920, trace_arg=0x00007fff1016d398) at vm_trace.c:333:5
    frame #28: 0x000055af5f5b0da8 ruby`rb_exec_event_hooks(trace_arg=0x00007fff1016d398, hooks=0x000055af60b2b920, pop_p=0) at vm_trace.c:378:13
    frame #29: 0x000055af5f33f8e2 ruby`rb_exec_event_hook_orig(ec=0x000055af60b2b700, hooks=0x000055af60b2b920, flag=1048576, self=0x00007f7d5b5c08c0, id=0, called_id=0, klass=0x0000000000000000, data=0x00007f7d5b513fd0, pop_p=0) at vm_core.h:1989:5
    frame #30: 0x000055af5f334975 ruby`gc_event_hook_body(ec=0x000055af60b2b700, objspace=0x000055af60b2b040, event=1048576, data=0x00007f7d5b513fd0) at gc.c:2083:5
  * frame #31: 0x000055af5f3342df ruby`newobj_slowpath_wb_protected [inlined] newobj_slowpath(klass=0x00007f7d5b9d19c8, flags=0x000000000000001a, objspace=0x000055af60b2b040, cr=0x000055af60b2b910, wb_protected=1) at gc.c:2284:9
    frame #32: 0x000055af5f33410f ruby`newobj_slowpath_wb_protected(klass=0x00007f7d5b9d19c8, flags=0x000000000000001a, objspace=0x000055af60b2b040, cr=0x000055af60b2b910) at gc.c:2299
    frame #33: 0x000055af5f333de9 ruby`newobj_of0(klass=0x00007f7d5b9d19c8, flags=0x000000000000001a, wb_protected=1, cr=0x000055af60b2b910) at gc.c:2338:11
    frame #34: 0x000055af5f3227ae ruby`newobj_of(klass=0x00007f7d5b9d19c8, flags=0x000000000000001a, v1=0x000055af657d88a0, v2=0x000055af657d8890, v3=0x0000000000000000, wb_protected=1) at gc.c:2348:17
    frame #35: 0x000055af5f322c5b ruby`rb_imemo_new(type=imemo_env, v1=0x000055af657d88a0, v2=0x000055af657d8890, v3=0x0000000000000000, v0=0x00007f7d5b9d19c8) at gc.c:2434:12
    frame #36: 0x000055af5f5a3925 ruby`vm_env_new(env_ep=0x000055af657d88a0, env_body=0x000055af657d8890, env_size=4, iseq=0x00007f7d5b9d19c8) at vm_core.h:1363:33
    frame #37: 0x000055af5f5a3808 ruby`vm_make_env_each(ec=0x000055af60b2b700, cfp=0x00007f7d6482fc90) at vm.c:801:11
    frame #38: 0x000055af5f5a368d ruby`vm_make_env_each(ec=0x000055af60b2b700, cfp=0x00007f7d6482fc20) at vm.c:752:13
    frame #39: 0x000055af5f5a368d ruby`vm_make_env_each(ec=0x000055af60b2b700, cfp=0x00007f7d6482fbb0) at vm.c:752:13
(lldb) f 31
frame #31: 0x000055af5f3342df ruby`newobj_slowpath_wb_protected [inlined] newobj_slowpath(klass=0x00007f7d5b9d19c8, flags=0x000000000000001a, objspace=0x000055af60b2b040, cr=0x000055af60b2b910, wb_protected=1) at gc.c:2284:9
   2281	        }
   2282	        GC_ASSERT(obj != 0);
   2283	        newobj_init(klass, flags, wb_protected, objspace, obj);
-> 2284	        gc_event_hook_prep(objspace, RUBY_INTERNAL_EVENT_NEWOBJ, obj, newobj_fill(obj, 0, 0, 0));
   2285	    }
   2286	    RB_VM_LOCK_LEAVE_CR_LEV(cr, &lev);
   2287
(lldb) p obj
(VALUE) $3 = 0x00007f7d5b513fd0
(lldb) f 6
frame #6: 0x000055af5f339b0a ruby`gc_ref_update_imemo(objspace=0x000055af60b2b040, obj=0x00007f7d5b513fd0) at gc.c:9046:13
   9043	        {
   9044	            rb_env_t *env = (rb_env_t *)obj;
   9045	            TYPED_UPDATE_IF_MOVED(objspace, rb_iseq_t *, env->iseq);
-> 9046	            UPDATE_IF_MOVED(objspace, env->ep[VM_ENV_DATA_INDEX_ENV]);
   9047	            gc_update_values(objspace, (long)env->env_size, (VALUE *)env->env);
   9048	        }
   9049	        break;
(lldb) p obj
(VALUE) $4 = 0x00007f7d5b513fd0
(lldb)
```
matzbot pushed a commit that referenced this pull request May 6, 2021
@gmcgibbon @hsbt
[ruby/strscan] Replace "iff" with "if and only if" (#18)
a42b7de 
iff means if and only if, but readers without that knowledge might
assume this to be a spelling mistake. To me, this seems like
exclusionary language that is unnecessary. Simply using "if and only if"
instead should suffice.

ruby/strscan@066451c11e
eileencodes pushed a commit to eileencodes/ruby that referenced this pull request Jul 27, 2021
@maximecb @jeremyevans
@matzbot @ko1 @kirs @ahorek @olleolleolle @keithrbennett @hsbt @aardvark179 @headius @shugo @lzap @fawaf @stevenharman @znz @S-H-GAMELINKS @mame @romainsalles @XrXr @wonda-tea-coffee @kamipo @nobu @peterzhu2118 @ebrohman @larskanis @marcandre @mohamedhafez @gmcgibbon @eightbitraptor @eregon @TomFreudenberg
Merge upstream Ruby (ruby#18)
8476860 
* Evaluate multiple assignment left hand side before right hand side

In regular assignment, Ruby evaluates the left hand side before
the right hand side.  For example:

```ruby
foo[0] = bar
```

Calls `foo`, then `bar`, then `[]=` on the result of `foo`.

Previously, multiple assignment didn't work this way.  If you did:

```ruby
abc.def, foo[0] = bar, baz
```

Ruby would previously call `bar`, then `baz`, then `abc`, then
`def=` on the result of `abc`, then `foo`, then `[]=` on the
result of `foo`.

This change makes multiple assignment similar to single assignment,
changing the evaluation order of the above multiple assignment code
to calling `abc`, then `foo`, then `bar`, then `baz`, then `def=` on
the result of `abc`, then `[]=` on the result of `foo`.

Implementing this is challenging with the stack-based virtual machine.
We need to keep track of all of the left hand side attribute setter
receivers and setter arguments, and then keep track of the stack level
while handling the assignment processing, so we can issue the
appropriate topn instructions to get the receiver.  Here's an example
of how the multiple assignment is executed, showing the stack and
instructions:

```
self                                      # putself
abc                                       # send
abc, self                                 # putself
abc, foo                                  # send
abc, foo, 0                               # putobject 0
abc, foo, 0, [bar, baz]                   # evaluate RHS
abc, foo, 0, [bar, baz], baz, bar         # expandarray
abc, foo, 0, [bar, baz], baz, bar, abc    # topn 5
abc, foo, 0, [bar, baz], baz, abc, bar    # swap
abc, foo, 0, [bar, baz], baz, def=        # send
abc, foo, 0, [bar, baz], baz              # pop
abc, foo, 0, [bar, baz], baz, foo         # topn 3
abc, foo, 0, [bar, baz], baz, foo, 0      # topn 3
abc, foo, 0, [bar, baz], baz, foo, 0, baz # topn 2
abc, foo, 0, [bar, baz], baz, []=         # send
abc, foo, 0, [bar, baz], baz              # pop
abc, foo, 0, [bar, baz]                   # pop
[bar, baz], foo, 0, [bar, baz]            # setn 3
[bar, baz], foo, 0                        # pop
[bar, baz], foo                           # pop
[bar, baz]                                # pop
```

As multiple assignment must deal with splats, post args, and any level
of nesting, it gets quite a bit more complex than this in non-trivial
cases. To handle this, struct masgn_state is added to keep
track of the overall state of the mass assignment, which stores a linked
list of struct masgn_attrasgn, one for each assigned attribute.

This adds a new optimization that replaces a topn 1/pop instruction
combination with a single swap instruction for multiple assignment
to non-aref attributes.

This new approach isn't compatible with one of the optimizations
previously used, in the case where the multiple assignment return value
was not needed, there was no lhs splat, and one of the left hand side
used an attribute setter.  This removes that optimization. Removing
the optimization allowed for removing the POP_ELEMENT and adjust_stack
functions.

This adds a benchmark to measure how much slower multiple
assignment is with the correct evaluation order.

This benchmark shows:

* 4-9% decrease for attribute sets
* 14-23% decrease for array member sets
* Basically same speed for local variable sets

Importantly, it shows no significant difference between the popped
(where return value of the multiple assignment is not needed) and
!popped (where return value of the multiple assignment is needed)
cases for attribute and array member sets.  This indicates the
previous optimization, which was dropped in the evaluation
order fix and only affected the popped case, is not important to
performance.

Fixes [Bug ruby#4443]

* * 2021-04-22 [ci skip]

* Remove reverse VM instruction

This was previously only used by the multiple assignment code, but
is no longer needed after the multiple assignment execution order
fix.

* fix raise in exception with jump

add_ensure_iseq() adds ensure block to the end of
jump such as next/redo/return. However, if the rescue
cause are in the body, this rescue catches the exception
in ensure clause.

  iter do
    next
  rescue
    R
  ensure
    raise
  end

In this case, R should not be executed, but executed without this patch.

Fixes [Bug #13930]
Fixes [Bug #16618]

A part of tests are written by @jeremyevans ruby#4291

* [ruby/time] Make Time friendly to Ractor

ruby/time@c784e4f166

* [ruby/cgi] handle invalid encoding

ruby/cgi@2b1c2e21a4

* [ruby/cgi] Add test for escapeHTML/unescapeHTML invalid encoding fix in pure ruby version

Also, remove pointless assert_nothing_raised(ArgumentError) while
here.

ruby/cgi@c05edf5608

* [ruby/cgi] gemspec: Explicitly empty executables list

The gem exposes no executables

ruby/cgi@cd7106ad97

* [ruby/benchmark] Add comment about terminating newline in captions; fix test method name.

ruby/benchmark@02ce298d3e

* [ruby/benchmark] gemspec: Explicitly have 0 executables

This gem exposes no executables.

ruby/benchmark@ff1ef7ae06

* Ignore JRuby files on io-console

* [ruby/io-console] Enable building the C extension on TruffleRuby.

ruby/io-console@c17b8cf3a9

* [ruby/io-console] Move FFI console under lib

Having the separate dir makes testing difficult and doesn't
reflect the structure the gem will eventually have. We can filter
these files out if necessary when building the CRuby gem.

ruby/io-console@881010447c

* Separate test used by test_ractor for Ractor in test_time.rb

* Merge net-imap-0.2.0

* [ruby/net-imap] Set timeout for IDLE responses

Fixes ruby#14

ruby/net-imap@39d39ff9bb

* [ruby/net-imap] Bump version to 0.2.1

ruby/net-imap@31f96ea884

* [ruby/uri] Upstream Java proxy property checks from JRuby

These Java properties, retrieved from JRuby's "Java env" ENV_JAVA,
allow JRuby users to use the same proxy properties the rest of the
Java platform uses.

This resolves https://bugs.ruby-lang.org/issues/11194

ruby/uri@3bd2bcc95a

* [ruby/uri] Optimize URI#hostname and URI#hostname=

ruby/uri@3b7ccfd835

* [ruby/uri] Add tests for URI::RFC{2396,3986}_Parser#inspect

ruby/uri@d47dae2f8e

* [ruby/uri] Only use UnboundMethod#bind_call if it is available

This allows tests to pass on Ruby 2.4-2.6.

Fixes ruby#19

ruby/uri@67ca99ca87

* [ruby/uri] Set required_ruby_version to 2.4 in gemspec

Tests pass on Ruby 2.4, but not on Ruby 2.3.

ruby/uri@594418079a

* [ruby/uri] remove comment about URI::escape as it is removed

ruby/uri@0f0057e1b2

* [ruby/uri] Use Regexp#match? to avoid extra allocations

`#=~` builds `MatchData`, requiring extra allocations as compared to
`#match?`, which returns a boolean w/o having to build the `MatchData`.

ruby/uri@158f58a9cc

* Update bundled_gems

* Suppress warnings for unsued variable

* * 2021-04-23 [ci skip]

* Remove unneeded comment

* test/ruby/test_assignment.rb: Avoid "assigned but unused variable"

* Fix wrong documentation

It doesn't return `nil` but raises an exception, as explained a few lines after

* * 2021-04-24 [ci skip]

* Fix setting method visibility for a refinement without an origin class

If a class has been refined but does not have an origin class,
there is a single method entry marked with VM_METHOD_TYPE_REFINED,
but it contains the original method entry.  If the original method
entry is present, we shouldn't skip the method when searching even
when skipping refined methods.

Fixes [Bug #17519]

* Remove unnecessary checks for empty kw splat

These two checks are surrounded by an if that ensures the
call site is not a kw splat call site.

* Remove part of comment that is no longer accurate

In Ruby 2.7, empty keyword splats could be added back for backwards
compatibility.  However, that stopped in Ruby 3.0.

* Add back checks for empty kw splat with tests (ruby#4405)

This reverts commit a224ce8.
Turns out the checks are needed to handle splatting an array with an
empty ruby2 keywords hash.

* [Doc] Fix a typo s/invokations/invocations/

* * 2021-04-25 [ci skip]

* [Doc] Fix a typo s/evel/eval/

* [Doc] Fix a typo s/oher/other/

* [Doc] Fix a typo s/visilibity/visibility/

* [Doc] Fix a typo s/arround/around/

* [Doc] Fix a typo s/daguten/dakuten/

* [ci skip] Fix a typo s/certificiate/certificate/

* [Doc] Fix a typo s/algorthm/algorithm/

* Fix some typos by spell checker

* * 2021-04-26 [ci skip]

* Remove test of removed reverse VM instruction

since 5512353

* spec/ruby/core/file/shared/read.rb: The behavior of FreeBSD was changed

http://rubyci.s3.amazonaws.com/freebsd12/ruby-master/log/20210426T003001Z.fail.html.gz#rubyspec

* disable shareable_constant_value for CI

To debug CI failures on FreeBSD, disable `shareable_constant_value`.

* [ruby/irb] Fix typo ture -> true [ci skip]

ruby/irb@783a0569e8

* [ruby/irb] Added assert_equal_with_term

ruby/irb@b690da96d8

* [ruby/irb] Added test_colorize

ruby/irb@10e290fc3a

* [ruby/irb] Assertions on non-tty

ruby/irb@ede12890d2

* [ruby/irb] Added `colorable` keyword option

Currently `IRB::Color.colorize` and `IRB::Color.colorize_code`
refer `$stdin.tty?` internally.
This patch adds `colorable` keyword option which overrides it.

ruby/irb@402e3f1907

* [ruby/irb] Added setup and teardown to TestIRB::TestInit

Not to be affected by existing rc files in all tests.

ruby/irb@bf434892b4

* node.c (rb_ast_new): imemo_ast is WB-unprotected

Previously imemo_ast was handled as WB-protected which caused a segfault
of the following code:

    # shareable_constant_value: literal
    M0 = {}
    M1 = {}
    ...
    M100000 = {}

My analysis is here: `shareable_constant_value: literal` creates many
Hash instances during parsing, and add them to node_buffer of imemo_ast.
However, the contents are missed because imemo_ast is incorrectly
WB-protected.

This changeset makes imemo_ast as WB-unprotected.

* Revert "disable shareable_constant_value for CI"

This reverts commit c647205.

Maybe the root issue was fixed by 7ac078e

* Document binding behavior for C call/return events for TracePoint/set_trace_func

C methods do not have bindings, so binding returns the binding of
the nearest C method.

Fixes [Bug ruby#9009]

* * 2021-04-27 [ci skip]

* Fix compiler warnings in objspace_dump.c when assertions are turned on

Example:

```
In file included from ../../../include/ruby/defines.h:72,
                 from ../../../include/ruby/ruby.h:23,
                 from ../../../gc.h:3,
                 from ../../../ext/objspace/objspace_dump.c:15:
../../../ext/objspace/objspace_dump.c: In function ‘dump_append_ld’:
../../../ext/objspace/objspace_dump.c:95:26: warning: comparison of integer expressions of different signedness: ‘long unsigned int’ and ‘int’ [-Wsign-compare]
   95 |     RUBY_ASSERT(required <= width);
      |                          ^~
```

* Fix type-o in insns.def

"redefine" -> "redefined"

* Partially revert 2c7d3b3

to make imemo_ast WB-protected again. Only the test is kept.

* Make imemo_ast WB-protected again

by firing the write barrier of imemo_ast after nd_lit is modified.
This will fix the issue of ruby#4416 more
gracefully.

* test/ruby/test_exception.rb: suppress "warning: statement not reached"

* [ruby/pathname] gemspec: Explicitly list 0 executables

This gem exposes no executables.

ruby/pathname@c401d97d58

* [ruby/gdbm] Add dependency to gdbm package on mingw

RubyInstaller2 supports metadata tags for installation of dependent
MSYS2/MINGW libraries. The openssl gem requires the mingw-openssl
package to be installed on the system, which the gem installer takes
care about, when this tag is set.

The feature is documented here:
https://github.com/oneclick/rubyinstaller2/wiki/For-gem-developers#msys2-library-dependency

Fixes oneclick/rubyinstaller2#163

ruby/gdbm@d95eed3e86

* [ruby/matrix] Use Gemfile instead of Gem::Specification#add_development_dependency.

ruby/matrix@1381fde5c1

* [ruby/matrix] v0.4.0

ruby/matrix@baea4b90d4

* [ruby/matrix] v0.4.1

ruby/matrix@f7c9981907

* [ruby/matrix] Guard for < Ruby 3.0

ruby/matrix@1ef660c627

* [ruby/net-ftp] Re-apply 827e471d438fdec1ae329afb5912b8e06d534823

ruby/net-ftp@3ca80368c4

* [ruby/net-ftp] Replace Timeout.timeout with socket timeout

Timeout.timeout is inefficient since it spins up a new thread for
each invocation, use Socket.tcp's connect_timeout option instead
when we aren't using SOCKS (we can't replace Timeout.timeout
for SOCKS yet since SOCKSSocket doesn't have a connect_timeout
option).

ruby/net-ftp@d65910132f

* [ruby/net-ftp] Close the passive connection data socket if there is an error setting up the transfer

Previously, the connection leaked in this case.  This uses
begin/ensure and checking for an error in the ensure block.

An alternative approach would be to not even perform the
connection until after the RETR (or other) command has been
sent.  However, I'm not sure all FTP servers support that.
The current behavior is:

* Send (PASV/EPSV)
* Connect to the host/port returned in 227/229 reply
* Send (RETR/other command)

Changing it to connect after the RETR could break things.
FTP servers might expect that the client has already
connected before sending the RETR.  The alternative
approach is more likely to introduce backwards compatibility
issues, compared to the begin/ensure approach taken here.

Fixes Ruby Bug 17027

ruby/net-ftp@6e8535f076

* [ruby/net-ftp] Reduce resource cosumption of Net::FTP::TIME_PARSER

Reported by Alexandr Savca as a DoS vulnerability, but Net::FTP is a
client library and the impact of the issue is low, so I have decided
to fix it as a normal issue.
Based on patch by nobu.

ruby/net-ftp@a93af636f8

* [ruby/net-ftp] Add test cases

ruby/net-ftp@865232bb2a

* [ruby/net-ftp] Replace "iff" with "if and only if"

iff means if and only if, but readers without that knowledge might
assume this to be a spelling mistake. To me, this seems like
exclusionary language that is unnecessary. Simply using "if and only if"
instead should suffice.

ruby/net-ftp@e920473618

* lldb: Add Freelist Index to dump_page output

* lldb: dump_page_rvalue - dump a heap page containing an RVALUE

rather than having to do this in a two step process:

1. heap_page obj
2. dump_page $2 (or whatever lldb variable heap_page set)

we can now just

dump_page_rvalue obj

* lldb: highlight the slot when using dump_page_rvalue

* Fix Monitor to lock per Fiber, like Mutex [Bug #17827]

* * 2021-04-28 [ci skip]

* test/ruby/test_fiber.rb: reduce the count of object creation to cause GC

... on Solaris. This is the same as 5478871.

http://rubyci.s3.amazonaws.com/solaris10-gcc/ruby-master/log/20210427T160003Z.fail.html.gz
```
[ 7667/20965] TestFiber#test_fork_from_fiber/export/home/users/chkbuild/cb-gcc/tmp/build/20210427T160003Z/ruby/test/ruby/test_fiber.rb:397:in `transfer': can't alloc machine stack to fiber (1 x 139264 bytes): Not enough space (FiberError)
	from /export/home/users/chkbuild/cb-gcc/tmp/build/20210427T160003Z/ruby/test/ruby/test_fiber.rb:397:in `block (6 levels) in test_fork_from_fiber'
	from /export/home/users/chkbuild/cb-gcc/tmp/build/20210427T160003Z/ruby/test/ruby/test_fiber.rb:396:in `times'
	from /export/home/users/chkbuild/cb-gcc/tmp/build/20210427T160003Z/ruby/test/ruby/test_fiber.rb:396:in `block (5 levels) in test_fork_from_fiber'
	from /export/home/users/chkbuild/cb-gcc/tmp/build/20210427T160003Z/ruby/test/ruby/test_fiber.rb:392:in `fork'
	from /export/home/users/chkbuild/cb-gcc/tmp/build/20210427T160003Z/ruby/test/ruby/test_fiber.rb:392:in `block (4 levels) in test_fork_from_fiber'
 = 0.88 s

...

  1) Failure:
TestFiber#test_fork_from_fiber [/export/home/users/chkbuild/cb-gcc/tmp/build/20210427T160003Z/ruby/test/ruby/test_fiber.rb:409]:
[ruby-core:41456].
<0> expected but was
<1>.
```

* test/net/ftp/test_ftp.rb: remove unused variable

* test/net/ftp/test_ftp.rb: reduce the size of a long response

"9" * 999999999 (about 1 GB) was too large for some CI servers.
This commit changes the size to 999999 (about 1 MB).

http://rubyci.s3.amazonaws.com/scw-9d6766/ruby-master/log/20210427T141707Z.fail.html.gz
http://rubyci.s3.amazonaws.com/raspbian10-aarch64/ruby-master/log/20210427T145408Z.fail.html.gz

* test/net/ftp/test_ftp.rb: Use RubyVM::JIT instead of RubyVM::MJIT

* [ruby/net-smtp] Net::SMTP.start() and #start() accepts ssl_context_params keyword argument

	Additional params are passed to OpenSSL::SSL::SSLContext#set_params.

	For example, `Net::SMTP#start(ssl_context_params: { cert_store: my_store, timeout: 123 })`
	calls `set_params({ cert_store: my_store, timeout: 123 })`.

ruby/net-smtp@4213389c21

* [ruby/net-smtp] Replace Timeout.timeout with socket timeout

Timeout.timeout is inefficient since it spins up a new thread for
each invocation, use Socket.tcp's connect_timeout option instead

ruby/net-smtp@6ae4a59f05

* [ruby/net-smtp] Removed needless files from Gem::Specification#files

ruby/net-smtp@69bba6b125

* [ruby/net-smtp] mod: bump to a new VERSION that could be checked for testings >0.2.1

ruby/net-smtp@8f2c9323e2

Co-authored-by: Jeremy Evans <code@jeremyevans.net>
Co-authored-by: git <svn-admin@ruby-lang.org>
Co-authored-by: Koichi Sasada <ko1@atdot.net>
Co-authored-by: Kir Shatrov <shatrov@me.com>
Co-authored-by: pavel <pavel.rosicky@easy.cz>
Co-authored-by: Olle Jonsson <olle.jonsson@gmail.com>
Co-authored-by: Keith Bennett <keithrbennett@gmail.com>
Co-authored-by: Hiroshi SHIBATA <hsbt@ruby-lang.org>
Co-authored-by: Duncan MacGregor <duncan.macgregor@oracle.com>
Co-authored-by: Charles Oliver Nutter <headius@headius.com>
Co-authored-by: Shugo Maeda <shugo@ruby-lang.org>
Co-authored-by: Lukas Zapletal <lzap+git@redhat.com>
Co-authored-by: Felix Wong <felix@waf.hk>
Co-authored-by: Steven Harman <steven@harmanly.com>
Co-authored-by: Kazuhiro NISHIYAMA <zn@mbf.nifty.com>
Co-authored-by: S-H-GAMELINKS <gamelinks007@gmail.com>
Co-authored-by: Yusuke Endoh <mame@ruby-lang.org>
Co-authored-by: romainsalles <romainsalles@users.noreply.github.com>
Co-authored-by: Alan Wu <XrXr@users.noreply.github.com>
Co-authored-by: wonda-tea-coffee <rikita.ishikawa@crowdworks.co.jp>
Co-authored-by: wonda-tea-coffee <lagrange.resolvent@gmail.com>
Co-authored-by: Ryuta Kamizono <kamipo@gmail.com>
Co-authored-by: Nobuyoshi Nakada <nobu@ruby-lang.org>
Co-authored-by: Peter Zhu <peter@peterzhu.ca>
Co-authored-by: ebrohman <ericbrohman@gmail.com>
Co-authored-by: Lars Kanis <kanis@comcard.de>
Co-authored-by: Marc-Andre Lafortune <github@marc-andre.ca>
Co-authored-by: mohamed <mohamed.m.m.hafez@gmail.com>
Co-authored-by: Gannon McGibbon <gannon.mcgibbon@gmail.com>
Co-authored-by: Matt Valentine-House <matt@eightbitraptor.com>
Co-authored-by: Benoit Daloze <eregontp@gmail.com>
Co-authored-by: Tom Freudenberg <tom.freudenberg@4commerce.de>
eileencodes pushed a commit to eileencodes/ruby that referenced this pull request Jul 27, 2021
@maximecb @jeremyevans
@matzbot @ko1 @kirs @ahorek @olleolleolle @keithrbennett @hsbt @aardvark179 @headius @shugo @lzap @fawaf @stevenharman @znz @S-H-GAMELINKS @mame @romainsalles @XrXr @wonda-tea-coffee @kamipo @nobu @peterzhu2118 @ebrohman @larskanis @marcandre @mohamedhafez @gmcgibbon @eightbitraptor @eregon @TomFreudenberg @leipert @byroot @AlexWayfer @k0kubun @BurdetteLamar @ima1zumi @xtkoba @nickkelley42 @adam12 @tenderlove @MSP-Greg @nevans @rhenium @kachick
Merge upstream Ruby (ruby#25)
42efcf3 
* Evaluate multiple assignment left hand side before right hand side

In regular assignment, Ruby evaluates the left hand side before
the right hand side.  For example:

```ruby
foo[0] = bar
```

Calls `foo`, then `bar`, then `[]=` on the result of `foo`.

Previously, multiple assignment didn't work this way.  If you did:

```ruby
abc.def, foo[0] = bar, baz
```

Ruby would previously call `bar`, then `baz`, then `abc`, then
`def=` on the result of `abc`, then `foo`, then `[]=` on the
result of `foo`.

This change makes multiple assignment similar to single assignment,
changing the evaluation order of the above multiple assignment code
to calling `abc`, then `foo`, then `bar`, then `baz`, then `def=` on
the result of `abc`, then `[]=` on the result of `foo`.

Implementing this is challenging with the stack-based virtual machine.
We need to keep track of all of the left hand side attribute setter
receivers and setter arguments, and then keep track of the stack level
while handling the assignment processing, so we can issue the
appropriate topn instructions to get the receiver.  Here's an example
of how the multiple assignment is executed, showing the stack and
instructions:

```
self                                      # putself
abc                                       # send
abc, self                                 # putself
abc, foo                                  # send
abc, foo, 0                               # putobject 0
abc, foo, 0, [bar, baz]                   # evaluate RHS
abc, foo, 0, [bar, baz], baz, bar         # expandarray
abc, foo, 0, [bar, baz], baz, bar, abc    # topn 5
abc, foo, 0, [bar, baz], baz, abc, bar    # swap
abc, foo, 0, [bar, baz], baz, def=        # send
abc, foo, 0, [bar, baz], baz              # pop
abc, foo, 0, [bar, baz], baz, foo         # topn 3
abc, foo, 0, [bar, baz], baz, foo, 0      # topn 3
abc, foo, 0, [bar, baz], baz, foo, 0, baz # topn 2
abc, foo, 0, [bar, baz], baz, []=         # send
abc, foo, 0, [bar, baz], baz              # pop
abc, foo, 0, [bar, baz]                   # pop
[bar, baz], foo, 0, [bar, baz]            # setn 3
[bar, baz], foo, 0                        # pop
[bar, baz], foo                           # pop
[bar, baz]                                # pop
```

As multiple assignment must deal with splats, post args, and any level
of nesting, it gets quite a bit more complex than this in non-trivial
cases. To handle this, struct masgn_state is added to keep
track of the overall state of the mass assignment, which stores a linked
list of struct masgn_attrasgn, one for each assigned attribute.

This adds a new optimization that replaces a topn 1/pop instruction
combination with a single swap instruction for multiple assignment
to non-aref attributes.

This new approach isn't compatible with one of the optimizations
previously used, in the case where the multiple assignment return value
was not needed, there was no lhs splat, and one of the left hand side
used an attribute setter.  This removes that optimization. Removing
the optimization allowed for removing the POP_ELEMENT and adjust_stack
functions.

This adds a benchmark to measure how much slower multiple
assignment is with the correct evaluation order.

This benchmark shows:

* 4-9% decrease for attribute sets
* 14-23% decrease for array member sets
* Basically same speed for local variable sets

Importantly, it shows no significant difference between the popped
(where return value of the multiple assignment is not needed) and
!popped (where return value of the multiple assignment is needed)
cases for attribute and array member sets.  This indicates the
previous optimization, which was dropped in the evaluation
order fix and only affected the popped case, is not important to
performance.

Fixes [Bug ruby#4443]

* * 2021-04-22 [ci skip]

* Remove reverse VM instruction

This was previously only used by the multiple assignment code, but
is no longer needed after the multiple assignment execution order
fix.

* fix raise in exception with jump

add_ensure_iseq() adds ensure block to the end of
jump such as next/redo/return. However, if the rescue
cause are in the body, this rescue catches the exception
in ensure clause.

  iter do
    next
  rescue
    R
  ensure
    raise
  end

In this case, R should not be executed, but executed without this patch.

Fixes [Bug #13930]
Fixes [Bug #16618]

A part of tests are written by @jeremyevans ruby#4291

* [ruby/time] Make Time friendly to Ractor

ruby/time@c784e4f166

* [ruby/cgi] handle invalid encoding

ruby/cgi@2b1c2e21a4

* [ruby/cgi] Add test for escapeHTML/unescapeHTML invalid encoding fix in pure ruby version

Also, remove pointless assert_nothing_raised(ArgumentError) while
here.

ruby/cgi@c05edf5608

* [ruby/cgi] gemspec: Explicitly empty executables list

The gem exposes no executables

ruby/cgi@cd7106ad97

* [ruby/benchmark] Add comment about terminating newline in captions; fix test method name.

ruby/benchmark@02ce298d3e

* [ruby/benchmark] gemspec: Explicitly have 0 executables

This gem exposes no executables.

ruby/benchmark@ff1ef7ae06

* Ignore JRuby files on io-console

* [ruby/io-console] Enable building the C extension on TruffleRuby.

ruby/io-console@c17b8cf3a9

* [ruby/io-console] Move FFI console under lib

Having the separate dir makes testing difficult and doesn't
reflect the structure the gem will eventually have. We can filter
these files out if necessary when building the CRuby gem.

ruby/io-console@881010447c

* Separate test used by test_ractor for Ractor in test_time.rb

* Merge net-imap-0.2.0

* [ruby/net-imap] Set timeout for IDLE responses

Fixes ruby#14

ruby/net-imap@39d39ff9bb

* [ruby/net-imap] Bump version to 0.2.1

ruby/net-imap@31f96ea884

* [ruby/uri] Upstream Java proxy property checks from JRuby

These Java properties, retrieved from JRuby's "Java env" ENV_JAVA,
allow JRuby users to use the same proxy properties the rest of the
Java platform uses.

This resolves https://bugs.ruby-lang.org/issues/11194

ruby/uri@3bd2bcc95a

* [ruby/uri] Optimize URI#hostname and URI#hostname=

ruby/uri@3b7ccfd835

* [ruby/uri] Add tests for URI::RFC{2396,3986}_Parser#inspect

ruby/uri@d47dae2f8e

* [ruby/uri] Only use UnboundMethod#bind_call if it is available

This allows tests to pass on Ruby 2.4-2.6.

Fixes ruby#19

ruby/uri@67ca99ca87

* [ruby/uri] Set required_ruby_version to 2.4 in gemspec

Tests pass on Ruby 2.4, but not on Ruby 2.3.

ruby/uri@594418079a

* [ruby/uri] remove comment about URI::escape as it is removed

ruby/uri@0f0057e1b2

* [ruby/uri] Use Regexp#match? to avoid extra allocations

`#=~` builds `MatchData`, requiring extra allocations as compared to
`#match?`, which returns a boolean w/o having to build the `MatchData`.

ruby/uri@158f58a9cc

* Update bundled_gems

* Suppress warnings for unsued variable

* * 2021-04-23 [ci skip]

* Remove unneeded comment

* test/ruby/test_assignment.rb: Avoid "assigned but unused variable"

* Fix wrong documentation

It doesn't return `nil` but raises an exception, as explained a few lines after

* * 2021-04-24 [ci skip]

* Fix setting method visibility for a refinement without an origin class

If a class has been refined but does not have an origin class,
there is a single method entry marked with VM_METHOD_TYPE_REFINED,
but it contains the original method entry.  If the original method
entry is present, we shouldn't skip the method when searching even
when skipping refined methods.

Fixes [Bug #17519]

* Remove unnecessary checks for empty kw splat

These two checks are surrounded by an if that ensures the
call site is not a kw splat call site.

* Remove part of comment that is no longer accurate

In Ruby 2.7, empty keyword splats could be added back for backwards
compatibility.  However, that stopped in Ruby 3.0.

* Add back checks for empty kw splat with tests (ruby#4405)

This reverts commit a224ce8.
Turns out the checks are needed to handle splatting an array with an
empty ruby2 keywords hash.

* [Doc] Fix a typo s/invokations/invocations/

* * 2021-04-25 [ci skip]

* [Doc] Fix a typo s/evel/eval/

* [Doc] Fix a typo s/oher/other/

* [Doc] Fix a typo s/visilibity/visibility/

* [Doc] Fix a typo s/arround/around/

* [Doc] Fix a typo s/daguten/dakuten/

* [ci skip] Fix a typo s/certificiate/certificate/

* [Doc] Fix a typo s/algorthm/algorithm/

* Fix some typos by spell checker

* * 2021-04-26 [ci skip]

* Remove test of removed reverse VM instruction

since 5512353

* spec/ruby/core/file/shared/read.rb: The behavior of FreeBSD was changed

http://rubyci.s3.amazonaws.com/freebsd12/ruby-master/log/20210426T003001Z.fail.html.gz#rubyspec

* disable shareable_constant_value for CI

To debug CI failures on FreeBSD, disable `shareable_constant_value`.

* [ruby/irb] Fix typo ture -> true [ci skip]

ruby/irb@783a0569e8

* [ruby/irb] Added assert_equal_with_term

ruby/irb@b690da96d8

* [ruby/irb] Added test_colorize

ruby/irb@10e290fc3a

* [ruby/irb] Assertions on non-tty

ruby/irb@ede12890d2

* [ruby/irb] Added `colorable` keyword option

Currently `IRB::Color.colorize` and `IRB::Color.colorize_code`
refer `$stdin.tty?` internally.
This patch adds `colorable` keyword option which overrides it.

ruby/irb@402e3f1907

* [ruby/irb] Added setup and teardown to TestIRB::TestInit

Not to be affected by existing rc files in all tests.

ruby/irb@bf434892b4

* node.c (rb_ast_new): imemo_ast is WB-unprotected

Previously imemo_ast was handled as WB-protected which caused a segfault
of the following code:

    # shareable_constant_value: literal
    M0 = {}
    M1 = {}
    ...
    M100000 = {}

My analysis is here: `shareable_constant_value: literal` creates many
Hash instances during parsing, and add them to node_buffer of imemo_ast.
However, the contents are missed because imemo_ast is incorrectly
WB-protected.

This changeset makes imemo_ast as WB-unprotected.

* Revert "disable shareable_constant_value for CI"

This reverts commit c647205.

Maybe the root issue was fixed by 7ac078e

* Document binding behavior for C call/return events for TracePoint/set_trace_func

C methods do not have bindings, so binding returns the binding of
the nearest C method.

Fixes [Bug ruby#9009]

* * 2021-04-27 [ci skip]

* Fix compiler warnings in objspace_dump.c when assertions are turned on

Example:

```
In file included from ../../../include/ruby/defines.h:72,
                 from ../../../include/ruby/ruby.h:23,
                 from ../../../gc.h:3,
                 from ../../../ext/objspace/objspace_dump.c:15:
../../../ext/objspace/objspace_dump.c: In function ‘dump_append_ld’:
../../../ext/objspace/objspace_dump.c:95:26: warning: comparison of integer expressions of different signedness: ‘long unsigned int’ and ‘int’ [-Wsign-compare]
   95 |     RUBY_ASSERT(required <= width);
      |                          ^~
```

* Fix type-o in insns.def

"redefine" -> "redefined"

* Partially revert 2c7d3b3

to make imemo_ast WB-protected again. Only the test is kept.

* Make imemo_ast WB-protected again

by firing the write barrier of imemo_ast after nd_lit is modified.
This will fix the issue of ruby#4416 more
gracefully.

* test/ruby/test_exception.rb: suppress "warning: statement not reached"

* [ruby/pathname] gemspec: Explicitly list 0 executables

This gem exposes no executables.

ruby/pathname@c401d97d58

* [ruby/gdbm] Add dependency to gdbm package on mingw

RubyInstaller2 supports metadata tags for installation of dependent
MSYS2/MINGW libraries. The openssl gem requires the mingw-openssl
package to be installed on the system, which the gem installer takes
care about, when this tag is set.

The feature is documented here:
https://github.com/oneclick/rubyinstaller2/wiki/For-gem-developers#msys2-library-dependency

Fixes oneclick/rubyinstaller2#163

ruby/gdbm@d95eed3e86

* [ruby/matrix] Use Gemfile instead of Gem::Specification#add_development_dependency.

ruby/matrix@1381fde5c1

* [ruby/matrix] v0.4.0

ruby/matrix@baea4b90d4

* [ruby/matrix] v0.4.1

ruby/matrix@f7c9981907

* [ruby/matrix] Guard for < Ruby 3.0

ruby/matrix@1ef660c627

* [ruby/net-ftp] Re-apply 827e471d438fdec1ae329afb5912b8e06d534823

ruby/net-ftp@3ca80368c4

* [ruby/net-ftp] Replace Timeout.timeout with socket timeout

Timeout.timeout is inefficient since it spins up a new thread for
each invocation, use Socket.tcp's connect_timeout option instead
when we aren't using SOCKS (we can't replace Timeout.timeout
for SOCKS yet since SOCKSSocket doesn't have a connect_timeout
option).

ruby/net-ftp@d65910132f

* [ruby/net-ftp] Close the passive connection data socket if there is an error setting up the transfer

Previously, the connection leaked in this case.  This uses
begin/ensure and checking for an error in the ensure block.

An alternative approach would be to not even perform the
connection until after the RETR (or other) command has been
sent.  However, I'm not sure all FTP servers support that.
The current behavior is:

* Send (PASV/EPSV)
* Connect to the host/port returned in 227/229 reply
* Send (RETR/other command)

Changing it to connect after the RETR could break things.
FTP servers might expect that the client has already
connected before sending the RETR.  The alternative
approach is more likely to introduce backwards compatibility
issues, compared to the begin/ensure approach taken here.

Fixes Ruby Bug 17027

ruby/net-ftp@6e8535f076

* [ruby/net-ftp] Reduce resource cosumption of Net::FTP::TIME_PARSER

Reported by Alexandr Savca as a DoS vulnerability, but Net::FTP is a
client library and the impact of the issue is low, so I have decided
to fix it as a normal issue.
Based on patch by nobu.

ruby/net-ftp@a93af636f8

* [ruby/net-ftp] Add test cases

ruby/net-ftp@865232bb2a

* [ruby/net-ftp] Replace "iff" with "if and only if"

iff means if and only if, but readers without that knowledge might
assume this to be a spelling mistake. To me, this seems like
exclusionary language that is unnecessary. Simply using "if and only if"
instead should suffice.

ruby/net-ftp@e920473618

* lldb: Add Freelist Index to dump_page output

* lldb: dump_page_rvalue - dump a heap page containing an RVALUE

rather than having to do this in a two step process:

1. heap_page obj
2. dump_page $2 (or whatever lldb variable heap_page set)

we can now just

dump_page_rvalue obj

* lldb: highlight the slot when using dump_page_rvalue

* Fix Monitor to lock per Fiber, like Mutex [Bug #17827]

* * 2021-04-28 [ci skip]

* test/ruby/test_fiber.rb: reduce the count of object creation to cause GC

... on Solaris. This is the same as 5478871.

http://rubyci.s3.amazonaws.com/solaris10-gcc/ruby-master/log/20210427T160003Z.fail.html.gz
```
[ 7667/20965] TestFiber#test_fork_from_fiber/export/home/users/chkbuild/cb-gcc/tmp/build/20210427T160003Z/ruby/test/ruby/test_fiber.rb:397:in `transfer': can't alloc machine stack to fiber (1 x 139264 bytes): Not enough space (FiberError)
	from /export/home/users/chkbuild/cb-gcc/tmp/build/20210427T160003Z/ruby/test/ruby/test_fiber.rb:397:in `block (6 levels) in test_fork_from_fiber'
	from /export/home/users/chkbuild/cb-gcc/tmp/build/20210427T160003Z/ruby/test/ruby/test_fiber.rb:396:in `times'
	from /export/home/users/chkbuild/cb-gcc/tmp/build/20210427T160003Z/ruby/test/ruby/test_fiber.rb:396:in `block (5 levels) in test_fork_from_fiber'
	from /export/home/users/chkbuild/cb-gcc/tmp/build/20210427T160003Z/ruby/test/ruby/test_fiber.rb:392:in `fork'
	from /export/home/users/chkbuild/cb-gcc/tmp/build/20210427T160003Z/ruby/test/ruby/test_fiber.rb:392:in `block (4 levels) in test_fork_from_fiber'
 = 0.88 s

...

  1) Failure:
TestFiber#test_fork_from_fiber [/export/home/users/chkbuild/cb-gcc/tmp/build/20210427T160003Z/ruby/test/ruby/test_fiber.rb:409]:
[ruby-core:41456].
<0> expected but was
<1>.
```

* test/net/ftp/test_ftp.rb: remove unused variable

* test/net/ftp/test_ftp.rb: reduce the size of a long response

"9" * 999999999 (about 1 GB) was too large for some CI servers.
This commit changes the size to 999999 (about 1 MB).

http://rubyci.s3.amazonaws.com/scw-9d6766/ruby-master/log/20210427T141707Z.fail.html.gz
http://rubyci.s3.amazonaws.com/raspbian10-aarch64/ruby-master/log/20210427T145408Z.fail.html.gz

* test/net/ftp/test_ftp.rb: Use RubyVM::JIT instead of RubyVM::MJIT

* [ruby/net-smtp] Net::SMTP.start() and #start() accepts ssl_context_params keyword argument

	Additional params are passed to OpenSSL::SSL::SSLContext#set_params.

	For example, `Net::SMTP#start(ssl_context_params: { cert_store: my_store, timeout: 123 })`
	calls `set_params({ cert_store: my_store, timeout: 123 })`.

ruby/net-smtp@4213389c21

* [ruby/net-smtp] Replace Timeout.timeout with socket timeout

Timeout.timeout is inefficient since it spins up a new thread for
each invocation, use Socket.tcp's connect_timeout option instead

ruby/net-smtp@6ae4a59f05

* [ruby/net-smtp] Removed needless files from Gem::Specification#files

ruby/net-smtp@69bba6b125

* [ruby/net-smtp] mod: bump to a new VERSION that could be checked for testings >0.2.1

ruby/net-smtp@8f2c9323e2

* [ruby/net-http] Replace Timeout.timeout in Net:HTTP#connect

Use Socket.tcp's connect_timeout option instead

ruby/net-http@753cae3bbc

* [ruby/net-http] Decode user and password from env configured proxy

If someone sets an env variable defining a http_proxy, containing a
username / password with percent-encoded characters, then the resulting
base64 encoded auth header will be wrong.

For example, suppose a username is `Y\X` and the password is `R%S] ?X`.
Properly URL encoded the proxy url would be:

    http://Y%5CX:R%25S%5D%20%3FX@proxy.example:8000

The resulting proxy auth header should be: `WVxYOlIlU10gP1g=`, but the
getters defined by ruby StdLib `URI` return a username `Y%5CX` and
password `R%25S%5D%20%3FX`, resulting in `WSU1Q1g6UiUyNVMlNUQlMjAlM0ZY`.
As a result the proxy will deny the request.

Please note that this is my first contribution to the ruby ecosystem, to
standard lib especially and I am not a ruby developer.

References:

- https://gitlab.com/gitlab-org/gitlab/-/issues/289836
- https://bugs.ruby-lang.org/projects/ruby-master/repository/trunk/revisions/58461
- https://bugs.ruby-lang.org/issues/17542

ruby/net-http@e57d4f38aa

* [ruby/net-http] Fix the regexp used to clean the host

Introduced in ruby@c1652035644

`/s` marks the regexp as encoded with Windows-31J which makes little
sense.

Nurse thinks the intent was to use `/m` for a multi-line regexp.

ruby/net-http@6c15342cdf

* [ruby/net-http] Initialize OpenSSL early before creating TCPSocket

OpenSSL make take some time to initialize, and it would be best
to take that time before connecting instead of after.

From joshc on Redmine.

Fixes Ruby Bug ruby#9459

ruby/net-http@14e09fba24

* [ruby/net-imap] Fix typo intentionaly -> intentionally [ci skip]

ruby/net-imap@4057c662e7

* [ruby/optparse] Add EditorConfig file

More info here: https://editorconfig.org/

For example, `ruby/ruby` has it: https://github.com/ruby/ruby/blob/05ebaee/.editorconfig

Also fix some offenses.

ruby/optparse@29402e7e0e

* [ruby/ostruct] Compatibility with Ruby 2.5

ruby/ostruct@ecd9fafdf8

* [ruby/ostruct] Add compatibility for to_h with block in Ruby 2.5

ruby/ostruct@da45de5068

* Guard for < Ruby 3.0

* NDEBUG is ignored since Ruby 3.0

* Removed unused macro HAVE_CONFIG_H

It seems like a vestige of ext/md5.

* Specify -c to emit pch with clang (ruby#4423)

[Bug #17836]

* * 2021-04-29 [ci skip]

* test/net/smtp/test_smtp.rb: wait a moment before socket is closed

On Solaris, Socket.tcp seems to fail with EINVAL if the server closes
the connection immediately after accpeted. I think this is a bug of
Socket.tcp, but seems difficult to fix soon.

http://rubyci.s3.amazonaws.com/solaris11-sunc/ruby-master/log/20210429T100007Z.fail.html.gz
```
  1) Failure:
Net::TestSMTP#test_eof_error_backtrace [/export/home/chkbuild/chkbuild-sunc/tmp/build/20210429T100007Z/ruby/test/net/smtp/test_smtp.rb:193]:
[ruby-core:78550] [Bug #13018].
[EOFError] exception expected, not #<Net::ReadTimeout: Net::ReadTimeout>.
```

* * 2021-04-30 [ci skip]

* lldb: Warn when attempting to dump invalid pages

* Update Time documentation

* [ruby/irb] Need reline >= 0.1.6

irb 1.3.5 need reline >= 0.1.6 because irb use `Reline::IOGate.in_pasting?`.
This method defined after reline 0.1.6.

fix ruby#228.

ruby/irb@6b7b8fc324

* Silence GCC 11 warnings

```
../strftime.c: In function 'rb_strftime_with_timespec':
../strftime.c:392:39: warning: comparison is always false due to limited range of data type [-Wtype-limits]
  392 |                         if (vtm->wday < 0 || vtm->wday > 6)
      |                                       ^
../strftime.c:403:39: warning: comparison is always false due to limited range of data type [-Wtype-limits]
  403 |                         if (vtm->wday < 0 || vtm->wday > 6)
      |                                       ^
```

* Correct documentation example on Hash#dig

Fixes [Misc #17842]. The current documentation suggests that:

        {foo: {bar: {baz: 2}}}.dig(:foo, :bar) # => {:bar=>{:baz=>2}}

when it should be:

        {foo: {bar: {baz: 2}}}.dig(:foo, :bar) # => {:baz=>2}

* * 2021-05-01 [ci skip]

* Fix example for custom warn method

Regexp has a match? method.

[ci skip]

* Adjust struct member offset for i386 Cygwin

Fixes [Bug #17606]

* Get rid of misleading indentation

* * 2021-05-03 [ci skip]

* Workaround failures on Windows

* * 2021-05-04 [ci skip]

* Eagerly allocate instance variable tables along with object

This allows us to allocate the right size for the object in advance,
meaning that we don't have to pay the cost of ivar table extension
later.  The idea is that if an object type ever became "extended" at
some point, then it is very likely it will become extended again.  So we
may as well allocate the ivar table up front.

* Fix test/net/http/test_https.rb host naming for Windows

* spec/ruby/library/net/http/http/fixtures/http_server.rb host naming for Windows

* Suppress maybe-uninitialized warning by mingw gcc 11

* test/net/imap/test_imap.rb: wait a moment before socket is closed

to try to suppress a failure on Solaris. This is the same as
19504d1

http://rubyci.s3.amazonaws.com/solaris11-sunc/ruby-master/log/20210504T070007Z.fail.html.gz
```
  1) Error:
IMAPTest#test_idle_done_not_during_idle:
Errno::EINVAL: Invalid argument - connect(2) for [::1]:33839
    /export/home/chkbuild/chkbuild-sunc/tmp/build/20210504T070007Z/ruby/.ext/common/socket.rb:1214:in `__connect_nonblock'
    /export/home/chkbuild/chkbuild-sunc/tmp/build/20210504T070007Z/ruby/.ext/common/socket.rb:1214:in `connect_nonblock'
    /export/home/chkbuild/chkbuild-sunc/tmp/build/20210504T070007Z/ruby/.ext/common/socket.rb:56:in `connect_internal'
    /export/home/chkbuild/chkbuild-sunc/tmp/build/20210504T070007Z/ruby/.ext/common/socket.rb:137:in `connect'
    /export/home/chkbuild/chkbuild-sunc/tmp/build/20210504T070007Z/ruby/.ext/common/socket.rb:642:in `block in tcp'
    /export/home/chkbuild/chkbuild-sunc/tmp/build/20210504T070007Z/ruby/.ext/common/socket.rb:227:in `each'
    /export/home/chkbuild/chkbuild-sunc/tmp/build/20210504T070007Z/ruby/.ext/common/socket.rb:227:in `foreach'
    /export/home/chkbuild/chkbuild-sunc/tmp/build/20210504T070007Z/ruby/.ext/common/socket.rb:632:in `tcp'
    /export/home/chkbuild/chkbuild-sunc/tmp/build/20210504T070007Z/ruby/lib/net/imap.rb:1223:in `tcp_socket'
    /export/home/chkbuild/chkbuild-sunc/tmp/build/20210504T070007Z/ruby/lib/net/imap.rb:1180:in `initialize'
    /export/home/chkbuild/chkbuild-sunc/tmp/build/20210504T070007Z/ruby/test/net/imap/test_imap.rb:289:in `new'
    /export/home/chkbuild/chkbuild-sunc/tmp/build/20210504T070007Z/ruby/test/net/imap/test_imap.rb:289:in `test_idle_done_not_during_idle'
```

* Add -Werror=undef to default warnflags for core

* See [Feature #17752]
* For external extensions it's transformed to just warn and not error (-Wundef)
  like other other -Werror in warnflags.

* vm_dump.c: rename HAVE_BACKTRACE to USE_BACKTRACE

* HAVE_ macros should only be defined or undefined, not used for their value.
* See [Feature #17752]

Co-authored-by: xtkoba (Tee KOBAYASHI) <xtkoba+ruby@gmail.com>

* Fix -Wundef warnings in coroutine/*/Context.h

* See [Feature #17752]

Co-authored-by: xtkoba (Tee KOBAYASHI) <xtkoba+ruby@gmail.com>

* Fix trivial -Wundef warnings

* See [Feature #17752]

Co-authored-by: xtkoba (Tee KOBAYASHI) <xtkoba+ruby@gmail.com>

* Add RBIMPL_RVALUE_EMBED_LEN_MAX neeeded by internal/bignum.h

* It evaluated to 0 before, revealed by -Wundef
* See [Feature #17752]

Co-authored-by: xtkoba (Tee KOBAYASHI) <xtkoba+ruby@gmail.com>

* Fix -Wundef warnings in core extensions

* See [Feature #17752]

* Fix -Wundef warnings for HAVE_RB_EXT_RACTOR_SAFE

* See [Feature #17752]

* Fix -Wundef warnings for patterns `#if HAVE`

* See [Feature #17752]
* Using this to detect them:
  git grep -P 'if\s+HAVE' | grep -Pv 'HAVE_LONG_LONG|/ChangeLog|HAVE_TYPEOF'

* HAVE_* macros should not be defined with value 0

* See [Feature #17752]

* Fix -Wundef warnings for RBIMPL_HAS_BUILTIN

* See [Feature #17752]
* Defining explicitly to 0 seems the best solution, see ruby#4428
* For example:
./include/ruby/internal/has/builtin.h:49:33: error: "RBIMPL_HAS_BUILTIN___builtin_assume" is not defined, evaluates to 0 [-Werror=undef]
   49 | # define RBIMPL_HAS_BUILTIN(_) (RBIMPL_HAS_BUILTIN_ ## _)
      |                                 ^~~~~~~~~~~~~~~~~~~
./include/ruby/internal/assume.h:75:7: note: in expansion of macro ‘RBIMPL_HAS_BUILTIN’
   75 | #elif RBIMPL_HAS_BUILTIN(__builtin_assume)
      |       ^~~~~~~~~~~~~~~~~~

* Correctly update array capacity after realloc

Reallocating to a smaller size in the transient heap may result in no
change in the actual capacity but the capacity of the array is still
updated to the smaller value.

This commit changes `ary_heap_realloc` to return the new capacity which
can be used by the caller to correctly update the capacity.

* * 2021-05-05 [ci skip]

* Fix documentation for IO#unget{byte,c}

Fixes [Bug #14400]

* What's Here for class IO (ruby#4440)

* What's Here for class IO

* test/net/ftp/test_ftp.rb - fix intermittent MinGW failure

Fixes intermittent error as below:

[242/838] 5316=test_ftp
#<Thread:0x0000020aa8733f20 D:/a/ruby/ruby/src/test/net/ftp/test_ftp.rb:2532 run> terminated with exception (report_on_exception is true):
D:/a/ruby/ruby/src/tool/lib/minitest/unit.rb:199:in `assert': Expected #<Errno::ECONNRESET: An existing connection was forcibly closed by the remote host.> to be nil. (MiniTest::Assertion)
	from D:/a/ruby/ruby/src/tool/lib/test/unit/core_assertions.rb:504:in `assert'
	from D:/a/ruby/ruby/src/tool/lib/minitest/unit.rb:299:in `assert_nil'
	from D:/a/ruby/ruby/src/test/net/ftp/test_ftp.rb:430:in `ensure in block in test_list_read_timeout_exceeded'
	from D:/a/ruby/ruby/src/test/net/ftp/test_ftp.rb:431:in `block in test_list_read_timeout_exceeded'
	from D:/a/ruby/ruby/src/test/net/ftp/test_ftp.rb:2539:in `block in create_ftp_server'
D:/a/ruby/ruby/src/test/net/ftp/test_ftp.rb:426:in `write': An existing connection was forcibly closed by the remote host. (Errno::ECONNRESET)
	from D:/a/ruby/ruby/src/test/net/ftp/test_ftp.rb:426:in `print'
	from D:/a/ruby/ruby/src/test/net/ftp/test_ftp.rb:426:in `block (2 levels) in test_list_read_timeout_exceeded'
	from D:/a/ruby/ruby/src/test/net/ftp/test_ftp.rb:420:in `each'
	from D:/a/ruby/ruby/src/test/net/ftp/test_ftp.rb:420:in `each_with_index'
	from D:/a/ruby/ruby/src/test/net/ftp/test_ftp.rb:420:in `block in test_list_read_timeout_exceeded'
	from D:/a/ruby/ruby/src/test/net/ftp/test_ftp.rb:2539:in `block in create_ftp_server'

* Fix compilation errors for c99

ENUM_OVER_INT is sometimes not defined. Use #ifdef instead if #if.

* Fix compilation error in mingw

__LITTLE_ENDIAN is not defined.

* Fix compilation errors in FreeBSD

__FreeBSD_version is defined in sys/param.h.

* Fix compilation error in thread_win32.c

USE_WIN32_MUTEX flag may not be defined.

* `_MSC_VER` may not be defined

* Workaround for gcc-4 bug

False positive `-Wundef` in `#elif` after `#if defined`.

* configure.ac: check if __builtin_expect is available or not

include/ruby/internal/has/builtin.h uses HAVE_BUILTIN___BUILTIN_EXPECT
for icc but previously it was not defined.

This is a follow up of 8b32de2 and this
will fix the following failures:

http://rubyci.s3.amazonaws.com/icc-x64/ruby-master/log/20210505T030003Z.fail.html.gz
```
  1) Failure:
TestMkmf::TestConvertible#test_typeof_builtin [/home/chkbuild/chkbuild/tmp/build/20210505T030003Z/ruby/test/mkmf/test_convertible.rb:9]:
convertible_int: checking for convertible type of short... -------------------- short

--------------------

convertible_int: checking for convertible type of int... -------------------- int

--------------------

convertible_int: checking for convertible type of long... -------------------- long

--------------------

convertible_int: checking for convertible type of signed short... -------------------- failed

"icc -std=gnu99 -o conftest -I. -I/home/chkbuild/chkbuild/tmp/build/20210505T030003Z/ruby/.ext/include/x86_64-linux -I/home/chkbuild/chkbuild/tmp/build/20210505T030003Z/ruby/include -I./test    -O3 -ggdb -Wall -Wextra -Wdeprecated-declarations -Wimplicit-function-declaration -Wimplicit-int -Wpointer-arith -Wshorten-64-to-32 -Wwrite-strings -Wno-long-long -Wno-missing-field-initializers -Wno-overlength-strings -Wno-unused-parameter -Wunused-variable -diag-disable=175,188,1684,2259,2312 -Wextra-tokens -Wundef conftest.c  -L. -L/home/chkbuild/chkbuild/tmp/build/20210505T030003Z/ruby -Wl,-rpath,/home/chkbuild/chkbuild/tmp/build/20210505T030003Z/ruby -L. -fstack-protector-strong -rdynamic -Wl,-export-dynamic     -Wl,-rpath,/home/chkbuild/chkbuild/tmp/build/20210505T030003Z/lib -L/home/chkbuild/chkbuild/tmp/build/20210505T030003Z/lib -lruby-static -lz -lpthread -lrt -lrt -ldl -lcrypt -lm   -lm   -lc"
In file included from /home/chkbuild/chkbuild/tmp/build/20210505T030003Z/ruby/include/ruby/defines.h(72),
                 from /home/chkbuild/chkbuild/tmp/build/20210505T030003Z/ruby/include/ruby/ruby.h(23),
                 from /home/chkbuild/chkbuild/tmp/build/20210505T030003Z/ruby/include/ruby.h(39),
                 from conftest.c(1):
/home/chkbuild/chkbuild/tmp/build/20210505T030003Z/ruby/include/ruby/backward/2/assume.h(34): warning ruby#193: zero used for undefined preprocessing identifier "HAVE_BUILTIN___BUILTIN_EXPECT"
  #if RBIMPL_HAS_BUILTIN(__builtin_expect)

...
```

* Fix compilation on M1 Mac

As PAGE_SIZE may not be a preprocessor constant, dispatch at
runtime in that case.

* * 2021-05-06 [ci skip]

* PAGE_SIZE is used only when mmap is available

* Fix PAGE_SIZE macro detection in autoconf

The current fix for PAGE_SIZE macro detection in autoconf does not work
correctly. I see the following output with running configure on Linux:

```
checking PAGE_SIZE is defined... no
```

Linux has PAGE_SIZE macro. This is happening because the macro exists in
sys/user.h and not in the malloc headers.

* Fall back to sysconf to determine page size during runtime

On some platforms the PAGE_SIZE macro does not exist so we can fall back
to `sysconf` to determine the page size at runtime.

* Get rid of including sys/user.h on macOS

LIST_HEAD in ccan/list conflicts with sys/queue.h.

```
./ccan/list/list.h:75:9: warning: 'LIST_HEAD' macro redefined [-Wmacro-redefined]
        ^
/Library/Developer/CommandLineTools/SDKs/MacOSX.sdk/usr/include/sys/queue.h:465:9: note: previous definition is here
        ^
```

* Check only whether PAGE_SIZE is compile-time const

* Revised PAGE_MAX_SIZE case

* Reuse sysconf result

* [ruby/erb] Document that `<% #` doesn't work

[Bug #17846]

ruby/erb@b58b188

* [ruby/net-imap] Move each authenticator to its own file

Also updates rdoc with SASL specifications and deprecations.  Of these
four, only `PLAIN` isn't deprecated!

+@@Authenticators+ was changed to a class instance var
+@Authenticators+.  No one should have been using the class variable
directly, so that should be fine.

ruby/net-imap@23f241b081

* [ruby/net-imap] Update AUTH=PLAIN to be a little closer to RFC4616

* Add authzid support
* must not contain NULL chars
* improve rdoc

ruby/net-imap@a587fc71b7

* [ruby/net-imap] Clean up authenticators rdoc

Added RFC links to all SASL mechanism specifications.

ruby/net-imap@53ff4b0c09

* [ruby/net-imap] move ResponseParser to lib/net/imap/response_parser

Partially implements ruby#10.

ruby/net-imap@c2408aac9a

* [ruby/net-imap] move response data structs to net/imap/response_data

Partially implements ruby#10.

ruby/net-imap@746757b936

* [ruby/net-imap] move command data formatters to net/imap/command_data

Partially implements ruby#10.

ruby/net-imap@24e929fdd2

* [ruby/net-imap] Move UTF7 & datetime formatting to net/imap/data_encoding

Partially implements ruby#10.

ruby/net-imap@0d43c5e856

* [ruby/net-imap] Move flags to net/imap/flags

Partially implements ruby#10.

ruby/net-imap@2a9afa83bf

* [ruby/net-imap] Move send_*_data into net/imap/command_data

Partially implements ruby#10.

ruby/net-imap@64d1080d63

* [ruby/net-imap] Many documentation improvements

* updated obsoleted RFCs to current versions
* linked most references to their RFCs
* linked extension commands to their RFCs
* removed unidiomatic `()` from instance method links
* escaped `IMAP` in a few places
* converted all response structs to explicit classes: this makes much
  nicer rdoc output than listing them all under "constants"
* grouped flags constants into their own sections

ruby/net-imap@9cd562ac84

* Move net-imap.gemspec to under the lib/net/imap directory.

* Fixed the file path for net-imap.gemspec

* [ruby/net-http] Do not require stringio

It is not used in net/http library code since commit 15ccd0118c13
(r36473 in ruby svn trunk, 2012).

require's in test suite are also cleaned up.

ruby/net-http@996d18a43f

* Import from ruby/strscan#19

* Use Gemfile instead of Gem::Specification#add_development_dependency.

* Use pend instead of skip for test-unit.

* [ruby/strscan] Fix segmentation fault of `StringScanner#charpos` when `String#byteslice` returns non string value [Bug #17756] (#20)

ruby/strscan@92961cde2b

* [ruby/strscan] Replace "iff" with "if and only if" (ruby#18)

iff means if and only if, but readers without that knowledge might
assume this to be a spelling mistake. To me, this seems like
exclusionary language that is unnecessary. Simply using "if and only if"
instead should suffice.

ruby/strscan@066451c11e

* [ruby/timeout] Make Timeout::Error#exception with multiple arguments not ignore arguments

This makes:

  raise(Timeout::Error.new("hello"), "world")

raise a TimeoutError instance with "world" as the message instead
of "hello", for consistency with other Ruby exception classes.

This required some internal changes to keep the tests passing.

Fixes [Bug #17812]

ruby/timeout@952154dbf9

* [ruby/timeout] Avoid unnecessary object allocation

Idea from nobu.

ruby/timeout@aecdaa23b3

* [ruby/timeout] Only run timeout_after hook on fiber scheduler if scheduler exists

ruby/timeout@4893cde0ed

* Use assert_ractor for separating test processes

* net-http no longer requires stringio

* Allow newobj_of0 and newobj_slowpath to allocate into multiple heap slots

* Store rb_classext_t next to RClass slots on the heap

* lldb: teach rp about T_PAYLOAD

* Fix preprocessor warning/error

* Try to fix #if issue in vm.inc.erb

Co-authored-by: Jeremy Evans <code@jeremyevans.net>
Co-authored-by: git <svn-admin@ruby-lang.org>
Co-authored-by: Koichi Sasada <ko1@atdot.net>
Co-authored-by: Kir Shatrov <shatrov@me.com>
Co-authored-by: pavel <pavel.rosicky@easy.cz>
Co-authored-by: Olle Jonsson <olle.jonsson@gmail.com>
Co-authored-by: Keith Bennett <keithrbennett@gmail.com>
Co-authored-by: Hiroshi SHIBATA <hsbt@ruby-lang.org>
Co-authored-by: Duncan MacGregor <duncan.macgregor@oracle.com>
Co-authored-by: Charles Oliver Nutter <headius@headius.com>
Co-authored-by: Shugo Maeda <shugo@ruby-lang.org>
Co-authored-by: Lukas Zapletal <lzap+git@redhat.com>
Co-authored-by: Felix Wong <felix@waf.hk>
Co-authored-by: Steven Harman <steven@harmanly.com>
Co-authored-by: Kazuhiro NISHIYAMA <zn@mbf.nifty.com>
Co-authored-by: S-H-GAMELINKS <gamelinks007@gmail.com>
Co-authored-by: Yusuke Endoh <mame@ruby-lang.org>
Co-authored-by: romainsalles <romainsalles@users.noreply.github.com>
Co-authored-by: Alan Wu <XrXr@users.noreply.github.com>
Co-authored-by: wonda-tea-coffee <rikita.ishikawa@crowdworks.co.jp>
Co-authored-by: wonda-tea-coffee <lagrange.resolvent@gmail.com>
Co-authored-by: Ryuta Kamizono <kamipo@gmail.com>
Co-authored-by: Nobuyoshi Nakada <nobu@ruby-lang.org>
Co-authored-by: Peter Zhu <peter@peterzhu.ca>
Co-authored-by: ebrohman <ericbrohman@gmail.com>
Co-authored-by: Lars Kanis <kanis@comcard.de>
Co-authored-by: Marc-Andre Lafortune <github@marc-andre.ca>
Co-authored-by: mohamed <mohamed.m.m.hafez@gmail.com>
Co-authored-by: Gannon McGibbon <gannon.mcgibbon@gmail.com>
Co-authored-by: Matt Valentine-House <matt@eightbitraptor.com>
Co-authored-by: Benoit Daloze <eregontp@gmail.com>
Co-authored-by: Tom Freudenberg <tom.freudenberg@4commerce.de>
Co-authored-by: Lukas Eipert <leipert@gitlab.com>
Co-authored-by: Jean Boussier <jean.boussier@gmail.com>
Co-authored-by: Alexander Popov <alex.wayfer@gmail.com>
Co-authored-by: Takashi Kokubun <takashikkbn@gmail.com>
Co-authored-by: Burdette Lamar <BurdetteLamar@Yahoo.com>
Co-authored-by: ima1zumi <mariimaizumi5@gmail.com>
Co-authored-by: xtkoba <69125751+xtkoba@users.noreply.github.com>
Co-authored-by: Nick Kelley <nick@nickkelley.dev>
Co-authored-by: Adam Daniels <adam@mediadrive.ca>
Co-authored-by: Aaron Patterson <tenderlove@ruby-lang.org>
Co-authored-by: MSP-Greg <Greg.mpls@gmail.com>
Co-authored-by: xtkoba (Tee KOBAYASHI) <xtkoba+ruby@gmail.com>
Co-authored-by: nicholas a. evans <nicholas.evans@gmail.com>
Co-authored-by: Kazuki Yamaguchi <k@rhe.jp>
Co-authored-by: Kenichi Kamiya <kachick1@gmail.com>
tenderlove added a commit to tenderlove/ruby that referenced this pull request Oct 31, 2022
@tenderlove
Always lookup IV buffers when iterating
366e6fc 
Always look up instance variable buffers when iterating.  It is possible
for the instance variable buffer to change out from under the object
during iteration, so we cannot cache the buffer on the stack.

In the case of Bug #19095, the transient heap moved the buffer during
iteration:

```
Watchpoint 1 hit:
old value: 0x0000000107c00df8
new value: 0x00000001032743c0
Process 31720 stopped
* thread #1, queue = 'com.apple.main-thread', stop reason = watchpoint 1
    frame #0: 0x00000001006e5178 miniruby`rb_obj_transient_heap_evacuate(obj=0x000000010d6b94b0, promote=1) at variable.c:1361:5
   1358	        }
   1359	        MEMCPY(new_ptr, old_ptr, VALUE, len);
   1360	        ROBJECT(obj)->as.heap.ivptr = new_ptr;
-> 1361	    }
   1362	}
   1363	#endif
   1364
miniruby`rb_obj_transient_heap_evacuate:
->  0x1006e5178 <+328>: b      0x1006e517c               ; <+332> at variable.c:1362:1
    0x1006e517c <+332>: ldp    x29, x30, [sp, #0x50]
    0x1006e5180 <+336>: add    sp, sp, #0x60
    0x1006e5184 <+340>: ret
Target 0: (miniruby) stopped.
(lldb) bt
* thread #1, queue = 'com.apple.main-thread', stop reason = watchpoint 1
  * frame #0: 0x00000001006e5178 miniruby`rb_obj_transient_heap_evacuate(obj=0x000000010d6b94b0, promote=1) at variable.c:1361:5
    frame #1: 0x00000001006cb150 miniruby`transient_heap_block_evacuate(theap=0x0000000100b196c0, block=0x0000000107c00000) at transient_heap.c:734:17
    frame #2: 0x00000001006c854c miniruby`transient_heap_evacuate(dmy=0x0000000000000000) at transient_heap.c:808:17
    frame #3: 0x00000001007fe6c0 miniruby`rb_postponed_job_flush(vm=0x0000000104402900) at vm_trace.c:1773:21
    frame #4: 0x0000000100637a84 miniruby`rb_threadptr_execute_interrupts(th=0x0000000103803bc0, blocking_timing=0) at thread.c:2316:13
    frame #5: 0x000000010078b730 miniruby`rb_vm_check_ints(ec=0x00000001048038d0) at vm_core.h:2025:9
    frame #6: 0x00000001006fbd10 miniruby`vm_pop_frame(ec=0x00000001048038d0, cfp=0x0000000104a04440, ep=0x0000000104904a28) at vm_insnhelper.c:422:5
    frame ruby#7: 0x00000001006fbca0 miniruby`rb_vm_pop_frame(ec=0x00000001048038d0) at vm_insnhelper.c:431:5
    frame ruby#8: 0x00000001007d6420 miniruby`vm_call0_cfunc_with_frame(ec=0x00000001048038d0, calling=0x000000016fdcc6a0, argv=0x0000000000000000) at vm_eval.c:153:9
    frame ruby#9: 0x00000001007d44cc miniruby`vm_call0_cfunc(ec=0x00000001048038d0, calling=0x000000016fdcc6a0, argv=0x0000000000000000) at vm_eval.c:164:12
    frame ruby#10: 0x0000000100766e80 miniruby`vm_call0_body(ec=0x00000001048038d0, calling=0x000000016fdcc6a0, argv=0x0000000000000000) at vm_eval.c:210:15
    frame ruby#11: 0x00000001007d76f0 miniruby`vm_call0_cc(ec=0x00000001048038d0, recv=0x000000010d6b49d8, id=2769, argc=0, argv=0x0000000000000000, cc=0x000000010d6b2e58, kw_splat=0) at vm_eval.c:87:12
    frame ruby#12: 0x0000000100769e48 miniruby`rb_funcallv_scope(recv=0x000000010d6b49d8, mid=2769, argc=0, argv=0x0000000000000000, scope=CALL_FCALL) at vm_eval.c:1051:16
    frame ruby#13: 0x0000000100760a54 miniruby`rb_funcallv(recv=0x000000010d6b49d8, mid=2769, argc=0, argv=0x0000000000000000) at vm_eval.c:1066:12
    frame ruby#14: 0x000000010037513c miniruby`rb_inspect(obj=0x000000010d6b49d8) at object.c:633:34
    frame ruby#15: 0x000000010002c950 miniruby`inspect_ary(ary=0x000000010d6b4938, dummy=0x0000000000000000, recur=0) at array.c:3091:13
    frame ruby#16: 0x0000000100642020 miniruby`exec_recursive(func=(miniruby`inspect_ary at array.c:3084), obj=0x000000010d6b4938, pairid=0x0000000000000000, arg=0x0000000000000000, outer=0, mid=2769) at thread.c:5177:23
    frame ruby#17: 0x00000001006412fc miniruby`rb_exec_recursive(func=(miniruby`inspect_ary at array.c:3084), obj=0x000000010d6b4938, arg=0x0000000000000000) at thread.c:5205:12
    frame ruby#18: 0x00000001000127f0 miniruby`rb_ary_inspect(ary=0x000000010d6b4938) at array.c:3117:12
```

In general though, any calls back out to the interpreter could change
the IV buffer, so it's not safe to cache.

[Bug #19095]
tenderlove added a commit to tenderlove/ruby that referenced this pull request Oct 31, 2022
@tenderlove
Always lookup IV buffers when iterating
2d37d9d 
Always look up instance variable buffers when iterating.  It is possible
for the instance variable buffer to change out from under the object
during iteration, so we cannot cache the buffer on the stack.

In the case of Bug #19095, the transient heap moved the buffer during
iteration:

```
Watchpoint 1 hit:
old value: 0x0000000107c00df8
new value: 0x00000001032743c0
Process 31720 stopped
* thread #1, queue = 'com.apple.main-thread', stop reason = watchpoint 1
    frame #0: 0x00000001006e5178 miniruby`rb_obj_transient_heap_evacuate(obj=0x000000010d6b94b0, promote=1) at variable.c:1361:5
   1358	        }
   1359	        MEMCPY(new_ptr, old_ptr, VALUE, len);
   1360	        ROBJECT(obj)->as.heap.ivptr = new_ptr;
-> 1361	    }
   1362	}
   1363	#endif
   1364
miniruby`rb_obj_transient_heap_evacuate:
->  0x1006e5178 <+328>: b      0x1006e517c               ; <+332> at variable.c:1362:1
    0x1006e517c <+332>: ldp    x29, x30, [sp, #0x50]
    0x1006e5180 <+336>: add    sp, sp, #0x60
    0x1006e5184 <+340>: ret
Target 0: (miniruby) stopped.
(lldb) bt
* thread #1, queue = 'com.apple.main-thread', stop reason = watchpoint 1
  * frame #0: 0x00000001006e5178 miniruby`rb_obj_transient_heap_evacuate(obj=0x000000010d6b94b0, promote=1) at variable.c:1361:5
    frame #1: 0x00000001006cb150 miniruby`transient_heap_block_evacuate(theap=0x0000000100b196c0, block=0x0000000107c00000) at transient_heap.c:734:17
    frame #2: 0x00000001006c854c miniruby`transient_heap_evacuate(dmy=0x0000000000000000) at transient_heap.c:808:17
    frame #3: 0x00000001007fe6c0 miniruby`rb_postponed_job_flush(vm=0x0000000104402900) at vm_trace.c:1773:21
    frame #4: 0x0000000100637a84 miniruby`rb_threadptr_execute_interrupts(th=0x0000000103803bc0, blocking_timing=0) at thread.c:2316:13
    frame #5: 0x000000010078b730 miniruby`rb_vm_check_ints(ec=0x00000001048038d0) at vm_core.h:2025:9
    frame #6: 0x00000001006fbd10 miniruby`vm_pop_frame(ec=0x00000001048038d0, cfp=0x0000000104a04440, ep=0x0000000104904a28) at vm_insnhelper.c:422:5
    frame ruby#7: 0x00000001006fbca0 miniruby`rb_vm_pop_frame(ec=0x00000001048038d0) at vm_insnhelper.c:431:5
    frame ruby#8: 0x00000001007d6420 miniruby`vm_call0_cfunc_with_frame(ec=0x00000001048038d0, calling=0x000000016fdcc6a0, argv=0x0000000000000000) at vm_eval.c:153:9
    frame ruby#9: 0x00000001007d44cc miniruby`vm_call0_cfunc(ec=0x00000001048038d0, calling=0x000000016fdcc6a0, argv=0x0000000000000000) at vm_eval.c:164:12
    frame ruby#10: 0x0000000100766e80 miniruby`vm_call0_body(ec=0x00000001048038d0, calling=0x000000016fdcc6a0, argv=0x0000000000000000) at vm_eval.c:210:15
    frame ruby#11: 0x00000001007d76f0 miniruby`vm_call0_cc(ec=0x00000001048038d0, recv=0x000000010d6b49d8, id=2769, argc=0, argv=0x0000000000000000, cc=0x000000010d6b2e58, kw_splat=0) at vm_eval.c:87:12
    frame ruby#12: 0x0000000100769e48 miniruby`rb_funcallv_scope(recv=0x000000010d6b49d8, mid=2769, argc=0, argv=0x0000000000000000, scope=CALL_FCALL) at vm_eval.c:1051:16
    frame ruby#13: 0x0000000100760a54 miniruby`rb_funcallv(recv=0x000000010d6b49d8, mid=2769, argc=0, argv=0x0000000000000000) at vm_eval.c:1066:12
    frame ruby#14: 0x000000010037513c miniruby`rb_inspect(obj=0x000000010d6b49d8) at object.c:633:34
    frame ruby#15: 0x000000010002c950 miniruby`inspect_ary(ary=0x000000010d6b4938, dummy=0x0000000000000000, recur=0) at array.c:3091:13
    frame ruby#16: 0x0000000100642020 miniruby`exec_recursive(func=(miniruby`inspect_ary at array.c:3084), obj=0x000000010d6b4938, pairid=0x0000000000000000, arg=0x0000000000000000, outer=0, mid=2769) at thread.c:5177:23
    frame ruby#17: 0x00000001006412fc miniruby`rb_exec_recursive(func=(miniruby`inspect_ary at array.c:3084), obj=0x000000010d6b4938, arg=0x0000000000000000) at thread.c:5205:12
    frame ruby#18: 0x00000001000127f0 miniruby`rb_ary_inspect(ary=0x000000010d6b4938) at array.c:3117:12
```

In general though, any calls back out to the interpreter could change
the IV buffer, so it's not safe to cache.

[Bug #19095]
tenderlove added a commit that referenced this pull request Nov 1, 2022
@tenderlove
Always lookup IV buffers when iterating
2d86e79 
Always look up instance variable buffers when iterating.  It is possible
for the instance variable buffer to change out from under the object
during iteration, so we cannot cache the buffer on the stack.

In the case of Bug #19095, the transient heap moved the buffer during
iteration:

```
Watchpoint 1 hit:
old value: 0x0000000107c00df8
new value: 0x00000001032743c0
Process 31720 stopped
* thread #1, queue = 'com.apple.main-thread', stop reason = watchpoint 1
    frame #0: 0x00000001006e5178 miniruby`rb_obj_transient_heap_evacuate(obj=0x000000010d6b94b0, promote=1) at variable.c:1361:5
   1358	        }
   1359	        MEMCPY(new_ptr, old_ptr, VALUE, len);
   1360	        ROBJECT(obj)->as.heap.ivptr = new_ptr;
-> 1361	    }
   1362	}
   1363	#endif
   1364
miniruby`rb_obj_transient_heap_evacuate:
->  0x1006e5178 <+328>: b      0x1006e517c               ; <+332> at variable.c:1362:1
    0x1006e517c <+332>: ldp    x29, x30, [sp, #0x50]
    0x1006e5180 <+336>: add    sp, sp, #0x60
    0x1006e5184 <+340>: ret
Target 0: (miniruby) stopped.
(lldb) bt
* thread #1, queue = 'com.apple.main-thread', stop reason = watchpoint 1
  * frame #0: 0x00000001006e5178 miniruby`rb_obj_transient_heap_evacuate(obj=0x000000010d6b94b0, promote=1) at variable.c:1361:5
    frame #1: 0x00000001006cb150 miniruby`transient_heap_block_evacuate(theap=0x0000000100b196c0, block=0x0000000107c00000) at transient_heap.c:734:17
    frame #2: 0x00000001006c854c miniruby`transient_heap_evacuate(dmy=0x0000000000000000) at transient_heap.c:808:17
    frame #3: 0x00000001007fe6c0 miniruby`rb_postponed_job_flush(vm=0x0000000104402900) at vm_trace.c:1773:21
    frame #4: 0x0000000100637a84 miniruby`rb_threadptr_execute_interrupts(th=0x0000000103803bc0, blocking_timing=0) at thread.c:2316:13
    frame #5: 0x000000010078b730 miniruby`rb_vm_check_ints(ec=0x00000001048038d0) at vm_core.h:2025:9
    frame #6: 0x00000001006fbd10 miniruby`vm_pop_frame(ec=0x00000001048038d0, cfp=0x0000000104a04440, ep=0x0000000104904a28) at vm_insnhelper.c:422:5
    frame #7: 0x00000001006fbca0 miniruby`rb_vm_pop_frame(ec=0x00000001048038d0) at vm_insnhelper.c:431:5
    frame #8: 0x00000001007d6420 miniruby`vm_call0_cfunc_with_frame(ec=0x00000001048038d0, calling=0x000000016fdcc6a0, argv=0x0000000000000000) at vm_eval.c:153:9
    frame #9: 0x00000001007d44cc miniruby`vm_call0_cfunc(ec=0x00000001048038d0, calling=0x000000016fdcc6a0, argv=0x0000000000000000) at vm_eval.c:164:12
    frame #10: 0x0000000100766e80 miniruby`vm_call0_body(ec=0x00000001048038d0, calling=0x000000016fdcc6a0, argv=0x0000000000000000) at vm_eval.c:210:15
    frame #11: 0x00000001007d76f0 miniruby`vm_call0_cc(ec=0x00000001048038d0, recv=0x000000010d6b49d8, id=2769, argc=0, argv=0x0000000000000000, cc=0x000000010d6b2e58, kw_splat=0) at vm_eval.c:87:12
    frame #12: 0x0000000100769e48 miniruby`rb_funcallv_scope(recv=0x000000010d6b49d8, mid=2769, argc=0, argv=0x0000000000000000, scope=CALL_FCALL) at vm_eval.c:1051:16
    frame #13: 0x0000000100760a54 miniruby`rb_funcallv(recv=0x000000010d6b49d8, mid=2769, argc=0, argv=0x0000000000000000) at vm_eval.c:1066:12
    frame #14: 0x000000010037513c miniruby`rb_inspect(obj=0x000000010d6b49d8) at object.c:633:34
    frame #15: 0x000000010002c950 miniruby`inspect_ary(ary=0x000000010d6b4938, dummy=0x0000000000000000, recur=0) at array.c:3091:13
    frame #16: 0x0000000100642020 miniruby`exec_recursive(func=(miniruby`inspect_ary at array.c:3084), obj=0x000000010d6b4938, pairid=0x0000000000000000, arg=0x0000000000000000, outer=0, mid=2769) at thread.c:5177:23
    frame #17: 0x00000001006412fc miniruby`rb_exec_recursive(func=(miniruby`inspect_ary at array.c:3084), obj=0x000000010d6b4938, arg=0x0000000000000000) at thread.c:5205:12
    frame #18: 0x00000001000127f0 miniruby`rb_ary_inspect(ary=0x000000010d6b4938) at array.c:3117:12
```

In general though, any calls back out to the interpreter could change
the IV buffer, so it's not safe to cache.

[Bug #19095]
KJTsanaktsidis added a commit to KJTsanaktsidis/ruby that referenced this pull request Feb 18, 2024
@KJTsanaktsidis
Fix heap-buffer-overflow read in set_number_literal
8455786 
It appears that tok(p) is not NULL terminated here, so we need to use
strndup to copy only the correct number of bytes.

[1/1] TestRubyLiteral#test_integer=================================================================
==484771==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x5060001ab1fc at pc 0x5597fe21d8e1 bp 0x7ffdc6fb0a50 sp 0x7ffdc6fb0210
READ of size 61 at 0x5060001ab1fc thread T0
    #0 0x5597fe21d8e0 in strlen.part.0 /home/kj/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:391:5
    #1 0x5597fe6b2feb in ruby_strdup /home/kj/ruby/build/../util.c:538:18
    ruby#2 0x5597fe4cb1c5 in set_number_literal /home/kj/ruby/build/parse.y:9694:9
    ruby#3 0x5597fe4cab3d in no_digits /home/kj/ruby/build/parse.y:10409:12
    ruby#4 0x5597fe4b9de9 in parse_numeric /home/kj/ruby/build/parse.y
    ruby#5 0x5597fe4a8adf in parser_yylex /home/kj/ruby/build/parse.y
    ruby#6 0x5597fe45c5cd in yylex /home/kj/ruby/build/parse.y:11916:9
    ruby#7 0x5597fe45c5cd in ruby_yyparse /home/kj/ruby/build/parse.c:11200:16
    ruby#8 0x5597fe49dc00 in yycompile0 /home/kj/ruby/build/parse.y:8121:9
    ruby#9 0x5597fe76db1b in rb_suppress_tracing /home/kj/ruby/build/../vm_trace.c:487:18
    ruby#10 0x5597fe494416 in yycompile /home/kj/ruby/build/parse.y:8177:5
    ruby#11 0x5597fe494416 in parser_compile_string /home/kj/ruby/build/parse.y:8240:12
    ruby#12 0x5597fe494416 in rb_ruby_parser_compile_string_path /home/kj/ruby/build/parse.y:8247:12
    ruby#13 0x5597fe498858 in rb_parser_compile_string_path /home/kj/ruby/build/parse.y:16663:12
    ruby#14 0x5597fe75688c in eval_make_iseq /home/kj/ruby/build/../vm_eval.c:1799:11
    ruby#15 0x5597fe70c8fa in eval_string_with_cref /home/kj/ruby/build/../vm_eval.c:1837:12
    ruby#16 0x5597fe70c396 in rb_f_eval /home/kj/ruby/build/../vm_eval.c:1912:16
    ruby#17 0x5597fe73f5e2 in vm_call_cfunc_with_frame_ /home/kj/ruby/build/../vm_insnhelper.c:3492:11
    ruby#18 0x5597fe6dca64 in vm_sendish /home/kj/ruby/build/../vm_callinfo.h
    ruby#19 0x5597fe6e64fa in vm_exec_core /home/kj/ruby/build/../insns.def:867:11
    #20 0x5597fe6dde00 in vm_exec_loop /home/kj/ruby/build/../vm.c:2578:22
    ruby#21 0x5597fe6dde00 in rb_vm_exec /home/kj/ruby/build/../vm.c:2557:18
    ruby#22 0x5597fe758bc4 in invoke_block /home/kj/ruby/build/../vm.c:1515:12
    ruby#23 0x5597fe758bc4 in invoke_iseq_block_from_c /home/kj/ruby/build/../vm.c:1585:16
    ruby#24 0x5597fe758bc4 in invoke_block_from_c_bh /home/kj/ruby/build/../vm.c:1603:20
    ruby#25 0x5597fe70e4b7 in vm_yield_with_cref /home/kj/ruby/build/../vm.c:1640:12
    ruby#26 0x5597fe709861 in vm_yield /home/kj/ruby/build/../vm.c:1648:12
    ruby#27 0x5597fe709861 in rb_yield_0 /home/kj/ruby/build/../vm_eval.c:1366:12
    ruby#28 0x5597fe709861 in rb_yield /home/kj/ruby/build/../vm_eval.c
    ruby#29 0x5597fec0eff9 in rb_ary_collect /home/kj/ruby/build/../array.c:3601:30
    ruby#30 0x5597fe73f5e2 in vm_call_cfunc_with_frame_ /home/kj/ruby/build/../vm_insnhelper.c:3492:11
    ruby#31 0x5597fe6dca64 in vm_sendish /home/kj/ruby/build/../vm_callinfo.h
    ruby#32 0x5597fe6e2d8f in vm_exec_core /home/kj/ruby/build/../insns.def:847:11
    ruby#33 0x5597fe6dde00 in vm_exec_loop /home/kj/ruby/build/../vm.c:2578:22
    ruby#34 0x5597fe6dde00 in rb_vm_exec /home/kj/ruby/build/../vm.c:2557:18
    ruby#35 0x5597fe3ffe9e in load_iseq_eval /home/kj/ruby/build/../load.c:778:5
    ruby#36 0x5597fe3fb498 in require_internal /home/kj/ruby/build/../load.c:1284:21
    ruby#37 0x5597fe3f9bf3 in rb_require_string_internal /home/kj/ruby/build/../load.c:1383:18
    ruby#38 0x5597fe73f5e2 in vm_call_cfunc_with_frame_ /home/kj/ruby/build/../vm_insnhelper.c:3492:11
    ruby#39 0x5597fe6dca64 in vm_sendish /home/kj/ruby/build/../vm_callinfo.h
    ruby#40 0x5597fe6e64fa in vm_exec_core /home/kj/ruby/build/../insns.def:867:11
    ruby#41 0x5597fe6dda82 in rb_vm_exec /home/kj/ruby/build/../vm.c:2551:22
    ruby#42 0x5597fe30a753 in rb_ec_exec_node /home/kj/ruby/build/../eval.c:283:9
    ruby#43 0x5597fe30a43d in ruby_run_node /home/kj/ruby/build/../eval.c:323:30
    ruby#44 0x5597fe3059b0 in rb_main /home/kj/ruby/build/../main.c:40:12
    ruby#45 0x5597fe3059b0 in main /home/kj/ruby/build/../main.c:59:12
    ruby#46 0x7f1a93141149 in __libc_start_call_main /usr/src/debug/glibc-2.38-16.fc39.x86_64/csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    ruby#47 0x7f1a9314120a in __libc_start_main@GLIBC_2.2.5 /usr/src/debug/glibc-2.38-16.fc39.x86_64/csu/../csu/libc-start.c:360:3
    ruby#48 0x5597fe1d3e34 in _start (/home/kj/ruby/build/ruby+0x38ae34)

0x5060001ab1fc is located 0 bytes after 60-byte region [0x5060001ab1c0,0x5060001ab1fc)
allocated by thread T0 here:
    #0 0x5597fe2bde4f in malloc /home/kj/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:68:3
    #1 0x5597fe3491a9 in objspace_xmalloc0 /home/kj/ruby/build/../gc.c:12605:5
    ruby#2 0x5597fe4a8adf in parser_yylex /home/kj/ruby/build/parse.y
    ruby#3 0x5597fe45c5cd in yylex /home/kj/ruby/build/parse.y:11916:9
    ruby#4 0x5597fe45c5cd in ruby_yyparse /home/kj/ruby/build/parse.c:11200:16
    ruby#5 0x5597fe49dc00 in yycompile0 /home/kj/ruby/build/parse.y:8121:9

SUMMARY: AddressSanitizer: heap-buffer-overflow /home/kj/ruby/build/../util.c:538:18 in ruby_strdup
Shadow bytes around the buggy address:
  0x5060001aaf00: fa fa fa fa fd fd fd fd fd fd fd fd fa fa fa fa
  0x5060001aaf80: 00 00 00 00 00 00 00 04 fa fa fa fa 00 00 00 00
  0x5060001ab000: 00 00 00 fa fa fa fa fa 00 00 00 00 00 00 00 fa
  0x5060001ab080: fa fa fa fa 00 00 00 00 00 00 00 00 fa fa fa fa
  0x5060001ab100: 00 00 00 00 00 00 00 00 fa fa fa fa 00 00 00 00
=>0x5060001ab180: 00 00 00 00 fa fa fa fa 00 00 00 00 00 00 00[04]
  0x5060001ab200: fa fa fa fa fd fd fd fd fd fd fd fd fa fa fa fa
  0x5060001ab280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x5060001ab300: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x5060001ab380: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x5060001ab400: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==484771==ABORTING
KJTsanaktsidis added a commit to KJTsanaktsidis/ruby that referenced this pull request Feb 18, 2024
@KJTsanaktsidis
Add some missing RB_GC_GUARDs to openssl r/w functions
c01aa5b 
The string passed to openssl seems to be poisoned, and adding a guard
somewhere where the compiler can't optimize it away fixes it.

I'm honestly not 100% sure why this is nescessary in the write case;
the str str is clearly still used. But, shrug.
[3/76] OpenSSL::TestSSL#test_parallel=================================================================
==552674==ERROR: AddressSanitizer: use-after-poison on address 0x7fbba354def0 at pc 0x7fbba3694bb1 bp 0x7fbba29fe830 sp 0x7fbba29fe828
READ of size 8 at 0x7fbba354def0 thread T13
    #0 0x7fbba3694bb0 in RB_BUILTIN_TYPE /home/kj/ruby/build/ext/openssl/../../../include/ruby/internal/value_type.h:190:30
    #1 0x7fbba3694bb0 in rbimpl_RB_TYPE_P_fastpath /home/kj/ruby/build/ext/openssl/../../../include/ruby/internal/value_type.h:351:19
    ruby#2 0x7fbba3694bb0 in Check_Type /home/kj/ruby/build/ext/openssl/../../../include/ruby/internal/value_type.h:434:9
    ruby#3 0x7fbba3694bb0 in rbimpl_rstring_getmem /home/kj/ruby/build/ext/openssl/../../../include/ruby/internal/core/rstring.h:391:5
    ruby#4 0x7fbba3694bb0 in RSTRING_PTR /home/kj/ruby/build/ext/openssl/../../../include/ruby/internal/core/rstring.h:418:17
    ruby#5 0x7fbba3694bb0 in ossl_ssl_read_internal /home/kj/ruby/build/ext/openssl/../../../ext/openssl/ossl_ssl.c:1969:35
    ruby#6 0x55ea9dfe76d2 in vm_call_cfunc_with_frame_ /home/kj/ruby/build/../vm_insnhelper.c:3492:11
    ruby#7 0x55ea9df84b54 in vm_sendish /home/kj/ruby/build/../vm_callinfo.h
    ruby#8 0x55ea9df8e5ea in vm_exec_core /home/kj/ruby/build/../insns.def:867:11
    ruby#9 0x55ea9df85b72 in rb_vm_exec /home/kj/ruby/build/../vm.c:2551:22
    ruby#10 0x55ea9dffa326 in vm_call0_body /home/kj/ruby/build/../vm_eval.c:229:20
    ruby#11 0x55ea9dfad48e in vm_call0_cc /home/kj/ruby/build/../vm_eval.c:110:12
    ruby#12 0x55ea9dfadae0 in rb_vm_call0 /home/kj/ruby/build/../vm_eval.c:70:12
    ruby#13 0x55ea9dfadae0 in rb_vm_call_kw /home/kj/ruby/build/../vm_eval.c:330:12
    ruby#14 0x55ea9dd8a22c in call_method_data /home/kj/ruby/build/../proc.c:2469:12
    ruby#15 0x55ea9dd8a22c in rb_method_call_with_block_kw /home/kj/ruby/build/../proc.c:2483:12
    ruby#16 0x55ea9dfe76d2 in vm_call_cfunc_with_frame_ /home/kj/ruby/build/../vm_insnhelper.c:3492:11
    ruby#17 0x55ea9df84b54 in vm_sendish /home/kj/ruby/build/../vm_callinfo.h
    ruby#18 0x55ea9df8e5ea in vm_exec_core /home/kj/ruby/build/../insns.def:867:11
    ruby#19 0x55ea9df85b72 in rb_vm_exec /home/kj/ruby/build/../vm.c:2551:22
    #20 0x55ea9dfbfb3f in invoke_block /home/kj/ruby/build/../vm.c:1515:12
    ruby#21 0x55ea9dfbfb3f in invoke_iseq_block_from_c /home/kj/ruby/build/../vm.c:1585:16
    ruby#22 0x55ea9dfbfb3f in invoke_block_from_c_proc /home/kj/ruby/build/../vm.c:1683:16
    ruby#23 0x55ea9dfbfb3f in vm_invoke_proc /home/kj/ruby/build/../vm.c:1713:12
    ruby#24 0x55ea9dfbf4fd in rb_vm_invoke_proc /home/kj/ruby/build/../vm.c:1734:16
    ruby#25 0x55ea9df21e5b in thread_do_start_proc /home/kj/ruby/build/../thread.c:595:16
    ruby#26 0x55ea9df20163 in thread_do_start /home/kj/ruby/build/../thread.c:614:18
    ruby#27 0x55ea9df20163 in thread_start_func_2 /home/kj/ruby/build/../thread.c:668:9
    ruby#28 0x55ea9df1f62a in call_thread_start_func_2 /home/kj/ruby/build/../thread_pthread.c:2234:5
    ruby#29 0x55ea9df1f62a in nt_start /home/kj/ruby/build/../thread_pthread.c:2279:13
    ruby#30 0x55ea9daa32a4 in asan_thread_start(void*) /home/kj/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:239:43
    ruby#31 0x7fbbbac8d896 in start_thread /usr/src/debug/glibc-2.38-16.fc39.x86_64/nptl/pthread_create.c:444:8
    ruby#32 0x7fbbbad1480b in __GI___clone3 ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

Address 0x7fbba354def0 is a wild pointer inside of access range of size 0x000000000008.
SUMMARY: AddressSanitizer: use-after-poison /home/kj/ruby/build/ext/openssl/../../../include/ruby/internal/value_type.h:190:30 in RB_BUILTIN_TYPE
Shadow bytes around the buggy address:
  0x7fbba354dc00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7fbba354dc80: 00 00 00 00 00 00 00 00 00 00 00 00 f7 00 00 00
  0x7fbba354dd00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7fbba354dd80: 00 00 00 00 f7 00 00 00 00 00 00 00 00 00 00 00
  0x7fbba354de00: 00 00 00 00 00 00 f7 00 00 00 00 00 f7 00 00 00
=>0x7fbba354de80: 00 00 00 00 00 00 00 00 f7 00 00 00 00 00[f7]00
  0x7fbba354df00: 00 00 00 00 00 00 00 00 00 00 f7 00 00 00 00 00
  0x7fbba354df80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7fbba354e000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7fbba354e080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7fbba354e100: 00 00 00 00 00 00 f7 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
Thread T13 created by T11 here:
    #0 0x55ea9db5d8fd in pthread_create /home/kj/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:250:3
    #1 0x55ea9df037b8 in native_thread_create0 /home/kj/ruby/build/../thread_pthread.c:2151:11
    ruby#2 0x55ea9df037b8 in native_thread_create_dedicated /home/kj/ruby/build/../thread_pthread.c:2218:12
    ruby#3 0x55ea9df037b8 in native_thread_create /home/kj/ruby/build/../thread_pthread.c:2392:16
    ruby#4 0x55ea9df037b8 in thread_create_core /home/kj/ruby/build/../thread.c:847:11
    ruby#5 0x55ea9df15a39 in thread_initialize /home/kj/ruby/build/../thread.c:955:16
    ruby#6 0x55ea9dfad48e in vm_call0_cc /home/kj/ruby/build/../vm_eval.c:110:12
    ruby#7 0x55ea9dffd34e in rb_call0 /home/kj/ruby/build/../vm_eval.c:573:12
    ruby#8 0x55ea9dfb0362 in rb_call /home/kj/ruby/build/../vm_eval.c:899:12
    ruby#9 0x55ea9dfb0362 in rb_funcallv_kw /home/kj/ruby/build/../vm_eval.c:1092:12

Thread T11 created by T0 here:
    #0 0x55ea9db5d8fd in pthread_create /home/kj/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:250:3
    #1 0x55ea9df037b8 in native_thread_create0 /home/kj/ruby/build/../thread_pthread.c:2151:11
    ruby#2 0x55ea9df037b8 in native_thread_create_dedicated /home/kj/ruby/build/../thread_pthread.c:2218:12
    ruby#3 0x55ea9df037b8 in native_thread_create /home/kj/ruby/build/../thread_pthread.c:2392:16
    ruby#4 0x55ea9df037b8 in thread_create_core /home/kj/ruby/build/../thread.c:847:11
    ruby#5 0x55ea9df15a39 in thread_initialize /home/kj/ruby/build/../thread.c:955:16
    ruby#6 0x55ea9dfad48e in vm_call0_cc /home/kj/ruby/build/../vm_eval.c:110:12
    ruby#7 0x55ea9dffd34e in rb_call0 /home/kj/ruby/build/../vm_eval.c:573:12
    ruby#8 0x55ea9dfb0362 in rb_call /home/kj/ruby/build/../vm_eval.c:899:12
    ruby#9 0x55ea9dfb0362 in rb_funcallv_kw /home/kj/ruby/build/../vm_eval.c:1092:12

==552674==ABORTING
KJTsanaktsidis added a commit to KJTsanaktsidis/ruby that referenced this pull request Feb 28, 2024
@KJTsanaktsidis
Fix heap-buffer-overflow read in set_number_literal
c3666eb 
It appears that tok(p) is not NULL terminated here, so we need to use
strndup to copy only the correct number of bytes.

[1/1] TestRubyLiteral#test_integer=================================================================
==484771==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x5060001ab1fc at pc 0x5597fe21d8e1 bp 0x7ffdc6fb0a50 sp 0x7ffdc6fb0210
READ of size 61 at 0x5060001ab1fc thread T0
    #0 0x5597fe21d8e0 in strlen.part.0 /home/kj/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:391:5
    #1 0x5597fe6b2feb in ruby_strdup /home/kj/ruby/build/../util.c:538:18
    ruby#2 0x5597fe4cb1c5 in set_number_literal /home/kj/ruby/build/parse.y:9694:9
    ruby#3 0x5597fe4cab3d in no_digits /home/kj/ruby/build/parse.y:10409:12
    ruby#4 0x5597fe4b9de9 in parse_numeric /home/kj/ruby/build/parse.y
    ruby#5 0x5597fe4a8adf in parser_yylex /home/kj/ruby/build/parse.y
    ruby#6 0x5597fe45c5cd in yylex /home/kj/ruby/build/parse.y:11916:9
    ruby#7 0x5597fe45c5cd in ruby_yyparse /home/kj/ruby/build/parse.c:11200:16
    ruby#8 0x5597fe49dc00 in yycompile0 /home/kj/ruby/build/parse.y:8121:9
    ruby#9 0x5597fe76db1b in rb_suppress_tracing /home/kj/ruby/build/../vm_trace.c:487:18
    ruby#10 0x5597fe494416 in yycompile /home/kj/ruby/build/parse.y:8177:5
    ruby#11 0x5597fe494416 in parser_compile_string /home/kj/ruby/build/parse.y:8240:12
    ruby#12 0x5597fe494416 in rb_ruby_parser_compile_string_path /home/kj/ruby/build/parse.y:8247:12
    ruby#13 0x5597fe498858 in rb_parser_compile_string_path /home/kj/ruby/build/parse.y:16663:12
    ruby#14 0x5597fe75688c in eval_make_iseq /home/kj/ruby/build/../vm_eval.c:1799:11
    ruby#15 0x5597fe70c8fa in eval_string_with_cref /home/kj/ruby/build/../vm_eval.c:1837:12
    ruby#16 0x5597fe70c396 in rb_f_eval /home/kj/ruby/build/../vm_eval.c:1912:16
    ruby#17 0x5597fe73f5e2 in vm_call_cfunc_with_frame_ /home/kj/ruby/build/../vm_insnhelper.c:3492:11
    ruby#18 0x5597fe6dca64 in vm_sendish /home/kj/ruby/build/../vm_callinfo.h
    ruby#19 0x5597fe6e64fa in vm_exec_core /home/kj/ruby/build/../insns.def:867:11
    #20 0x5597fe6dde00 in vm_exec_loop /home/kj/ruby/build/../vm.c:2578:22
    ruby#21 0x5597fe6dde00 in rb_vm_exec /home/kj/ruby/build/../vm.c:2557:18
    ruby#22 0x5597fe758bc4 in invoke_block /home/kj/ruby/build/../vm.c:1515:12
    ruby#23 0x5597fe758bc4 in invoke_iseq_block_from_c /home/kj/ruby/build/../vm.c:1585:16
    ruby#24 0x5597fe758bc4 in invoke_block_from_c_bh /home/kj/ruby/build/../vm.c:1603:20
    ruby#25 0x5597fe70e4b7 in vm_yield_with_cref /home/kj/ruby/build/../vm.c:1640:12
    ruby#26 0x5597fe709861 in vm_yield /home/kj/ruby/build/../vm.c:1648:12
    ruby#27 0x5597fe709861 in rb_yield_0 /home/kj/ruby/build/../vm_eval.c:1366:12
    ruby#28 0x5597fe709861 in rb_yield /home/kj/ruby/build/../vm_eval.c
    ruby#29 0x5597fec0eff9 in rb_ary_collect /home/kj/ruby/build/../array.c:3601:30
    ruby#30 0x5597fe73f5e2 in vm_call_cfunc_with_frame_ /home/kj/ruby/build/../vm_insnhelper.c:3492:11
    ruby#31 0x5597fe6dca64 in vm_sendish /home/kj/ruby/build/../vm_callinfo.h
    ruby#32 0x5597fe6e2d8f in vm_exec_core /home/kj/ruby/build/../insns.def:847:11
    ruby#33 0x5597fe6dde00 in vm_exec_loop /home/kj/ruby/build/../vm.c:2578:22
    ruby#34 0x5597fe6dde00 in rb_vm_exec /home/kj/ruby/build/../vm.c:2557:18
    ruby#35 0x5597fe3ffe9e in load_iseq_eval /home/kj/ruby/build/../load.c:778:5
    ruby#36 0x5597fe3fb498 in require_internal /home/kj/ruby/build/../load.c:1284:21
    ruby#37 0x5597fe3f9bf3 in rb_require_string_internal /home/kj/ruby/build/../load.c:1383:18
    ruby#38 0x5597fe73f5e2 in vm_call_cfunc_with_frame_ /home/kj/ruby/build/../vm_insnhelper.c:3492:11
    ruby#39 0x5597fe6dca64 in vm_sendish /home/kj/ruby/build/../vm_callinfo.h
    ruby#40 0x5597fe6e64fa in vm_exec_core /home/kj/ruby/build/../insns.def:867:11
    ruby#41 0x5597fe6dda82 in rb_vm_exec /home/kj/ruby/build/../vm.c:2551:22
    ruby#42 0x5597fe30a753 in rb_ec_exec_node /home/kj/ruby/build/../eval.c:283:9
    ruby#43 0x5597fe30a43d in ruby_run_node /home/kj/ruby/build/../eval.c:323:30
    ruby#44 0x5597fe3059b0 in rb_main /home/kj/ruby/build/../main.c:40:12
    ruby#45 0x5597fe3059b0 in main /home/kj/ruby/build/../main.c:59:12
    ruby#46 0x7f1a93141149 in __libc_start_call_main /usr/src/debug/glibc-2.38-16.fc39.x86_64/csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    ruby#47 0x7f1a9314120a in __libc_start_main@GLIBC_2.2.5 /usr/src/debug/glibc-2.38-16.fc39.x86_64/csu/../csu/libc-start.c:360:3
    ruby#48 0x5597fe1d3e34 in _start (/home/kj/ruby/build/ruby+0x38ae34)

0x5060001ab1fc is located 0 bytes after 60-byte region [0x5060001ab1c0,0x5060001ab1fc)
allocated by thread T0 here:
    #0 0x5597fe2bde4f in malloc /home/kj/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:68:3
    #1 0x5597fe3491a9 in objspace_xmalloc0 /home/kj/ruby/build/../gc.c:12605:5
    ruby#2 0x5597fe4a8adf in parser_yylex /home/kj/ruby/build/parse.y
    ruby#3 0x5597fe45c5cd in yylex /home/kj/ruby/build/parse.y:11916:9
    ruby#4 0x5597fe45c5cd in ruby_yyparse /home/kj/ruby/build/parse.c:11200:16
    ruby#5 0x5597fe49dc00 in yycompile0 /home/kj/ruby/build/parse.y:8121:9

SUMMARY: AddressSanitizer: heap-buffer-overflow /home/kj/ruby/build/../util.c:538:18 in ruby_strdup
Shadow bytes around the buggy address:
  0x5060001aaf00: fa fa fa fa fd fd fd fd fd fd fd fd fa fa fa fa
  0x5060001aaf80: 00 00 00 00 00 00 00 04 fa fa fa fa 00 00 00 00
  0x5060001ab000: 00 00 00 fa fa fa fa fa 00 00 00 00 00 00 00 fa
  0x5060001ab080: fa fa fa fa 00 00 00 00 00 00 00 00 fa fa fa fa
  0x5060001ab100: 00 00 00 00 00 00 00 00 fa fa fa fa 00 00 00 00
=>0x5060001ab180: 00 00 00 00 fa fa fa fa 00 00 00 00 00 00 00[04]
  0x5060001ab200: fa fa fa fa fd fd fd fd fd fd fd fd fa fa fa fa
  0x5060001ab280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x5060001ab300: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x5060001ab380: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x5060001ab400: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==484771==ABORTING
KJTsanaktsidis added a commit to KJTsanaktsidis/ruby that referenced this pull request Mar 28, 2024
@KJTsanaktsidis
Fix heap-buffer-overflow read in set_number_literal
55c6dd2 
It appears that tok(p) is not NULL terminated here, so we need to use
strndup to copy only the correct number of bytes.

[1/1] TestRubyLiteral#test_integer=================================================================
==484771==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x5060001ab1fc at pc 0x5597fe21d8e1 bp 0x7ffdc6fb0a50 sp 0x7ffdc6fb0210
READ of size 61 at 0x5060001ab1fc thread T0
    #0 0x5597fe21d8e0 in strlen.part.0 /home/kj/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:391:5
    #1 0x5597fe6b2feb in ruby_strdup /home/kj/ruby/build/../util.c:538:18
    ruby#2 0x5597fe4cb1c5 in set_number_literal /home/kj/ruby/build/parse.y:9694:9
    ruby#3 0x5597fe4cab3d in no_digits /home/kj/ruby/build/parse.y:10409:12
    ruby#4 0x5597fe4b9de9 in parse_numeric /home/kj/ruby/build/parse.y
    ruby#5 0x5597fe4a8adf in parser_yylex /home/kj/ruby/build/parse.y
    ruby#6 0x5597fe45c5cd in yylex /home/kj/ruby/build/parse.y:11916:9
    ruby#7 0x5597fe45c5cd in ruby_yyparse /home/kj/ruby/build/parse.c:11200:16
    ruby#8 0x5597fe49dc00 in yycompile0 /home/kj/ruby/build/parse.y:8121:9
    ruby#9 0x5597fe76db1b in rb_suppress_tracing /home/kj/ruby/build/../vm_trace.c:487:18
    ruby#10 0x5597fe494416 in yycompile /home/kj/ruby/build/parse.y:8177:5
    ruby#11 0x5597fe494416 in parser_compile_string /home/kj/ruby/build/parse.y:8240:12
    ruby#12 0x5597fe494416 in rb_ruby_parser_compile_string_path /home/kj/ruby/build/parse.y:8247:12
    ruby#13 0x5597fe498858 in rb_parser_compile_string_path /home/kj/ruby/build/parse.y:16663:12
    ruby#14 0x5597fe75688c in eval_make_iseq /home/kj/ruby/build/../vm_eval.c:1799:11
    ruby#15 0x5597fe70c8fa in eval_string_with_cref /home/kj/ruby/build/../vm_eval.c:1837:12
    ruby#16 0x5597fe70c396 in rb_f_eval /home/kj/ruby/build/../vm_eval.c:1912:16
    ruby#17 0x5597fe73f5e2 in vm_call_cfunc_with_frame_ /home/kj/ruby/build/../vm_insnhelper.c:3492:11
    ruby#18 0x5597fe6dca64 in vm_sendish /home/kj/ruby/build/../vm_callinfo.h
    ruby#19 0x5597fe6e64fa in vm_exec_core /home/kj/ruby/build/../insns.def:867:11
    #20 0x5597fe6dde00 in vm_exec_loop /home/kj/ruby/build/../vm.c:2578:22
    ruby#21 0x5597fe6dde00 in rb_vm_exec /home/kj/ruby/build/../vm.c:2557:18
    ruby#22 0x5597fe758bc4 in invoke_block /home/kj/ruby/build/../vm.c:1515:12
    ruby#23 0x5597fe758bc4 in invoke_iseq_block_from_c /home/kj/ruby/build/../vm.c:1585:16
    ruby#24 0x5597fe758bc4 in invoke_block_from_c_bh /home/kj/ruby/build/../vm.c:1603:20
    ruby#25 0x5597fe70e4b7 in vm_yield_with_cref /home/kj/ruby/build/../vm.c:1640:12
    ruby#26 0x5597fe709861 in vm_yield /home/kj/ruby/build/../vm.c:1648:12
    ruby#27 0x5597fe709861 in rb_yield_0 /home/kj/ruby/build/../vm_eval.c:1366:12
    ruby#28 0x5597fe709861 in rb_yield /home/kj/ruby/build/../vm_eval.c
    ruby#29 0x5597fec0eff9 in rb_ary_collect /home/kj/ruby/build/../array.c:3601:30
    ruby#30 0x5597fe73f5e2 in vm_call_cfunc_with_frame_ /home/kj/ruby/build/../vm_insnhelper.c:3492:11
    ruby#31 0x5597fe6dca64 in vm_sendish /home/kj/ruby/build/../vm_callinfo.h
    ruby#32 0x5597fe6e2d8f in vm_exec_core /home/kj/ruby/build/../insns.def:847:11
    ruby#33 0x5597fe6dde00 in vm_exec_loop /home/kj/ruby/build/../vm.c:2578:22
    ruby#34 0x5597fe6dde00 in rb_vm_exec /home/kj/ruby/build/../vm.c:2557:18
    ruby#35 0x5597fe3ffe9e in load_iseq_eval /home/kj/ruby/build/../load.c:778:5
    ruby#36 0x5597fe3fb498 in require_internal /home/kj/ruby/build/../load.c:1284:21
    ruby#37 0x5597fe3f9bf3 in rb_require_string_internal /home/kj/ruby/build/../load.c:1383:18
    ruby#38 0x5597fe73f5e2 in vm_call_cfunc_with_frame_ /home/kj/ruby/build/../vm_insnhelper.c:3492:11
    ruby#39 0x5597fe6dca64 in vm_sendish /home/kj/ruby/build/../vm_callinfo.h
    ruby#40 0x5597fe6e64fa in vm_exec_core /home/kj/ruby/build/../insns.def:867:11
    ruby#41 0x5597fe6dda82 in rb_vm_exec /home/kj/ruby/build/../vm.c:2551:22
    ruby#42 0x5597fe30a753 in rb_ec_exec_node /home/kj/ruby/build/../eval.c:283:9
    ruby#43 0x5597fe30a43d in ruby_run_node /home/kj/ruby/build/../eval.c:323:30
    ruby#44 0x5597fe3059b0 in rb_main /home/kj/ruby/build/../main.c:40:12
    ruby#45 0x5597fe3059b0 in main /home/kj/ruby/build/../main.c:59:12
    ruby#46 0x7f1a93141149 in __libc_start_call_main /usr/src/debug/glibc-2.38-16.fc39.x86_64/csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    ruby#47 0x7f1a9314120a in __libc_start_main@GLIBC_2.2.5 /usr/src/debug/glibc-2.38-16.fc39.x86_64/csu/../csu/libc-start.c:360:3
    ruby#48 0x5597fe1d3e34 in _start (/home/kj/ruby/build/ruby+0x38ae34)

0x5060001ab1fc is located 0 bytes after 60-byte region [0x5060001ab1c0,0x5060001ab1fc)
allocated by thread T0 here:
    #0 0x5597fe2bde4f in malloc /home/kj/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:68:3
    #1 0x5597fe3491a9 in objspace_xmalloc0 /home/kj/ruby/build/../gc.c:12605:5
    ruby#2 0x5597fe4a8adf in parser_yylex /home/kj/ruby/build/parse.y
    ruby#3 0x5597fe45c5cd in yylex /home/kj/ruby/build/parse.y:11916:9
    ruby#4 0x5597fe45c5cd in ruby_yyparse /home/kj/ruby/build/parse.c:11200:16
    ruby#5 0x5597fe49dc00 in yycompile0 /home/kj/ruby/build/parse.y:8121:9

SUMMARY: AddressSanitizer: heap-buffer-overflow /home/kj/ruby/build/../util.c:538:18 in ruby_strdup
Shadow bytes around the buggy address:
  0x5060001aaf00: fa fa fa fa fd fd fd fd fd fd fd fd fa fa fa fa
  0x5060001aaf80: 00 00 00 00 00 00 00 04 fa fa fa fa 00 00 00 00
  0x5060001ab000: 00 00 00 fa fa fa fa fa 00 00 00 00 00 00 00 fa
  0x5060001ab080: fa fa fa fa 00 00 00 00 00 00 00 00 fa fa fa fa
  0x5060001ab100: 00 00 00 00 00 00 00 00 fa fa fa fa 00 00 00 00
=>0x5060001ab180: 00 00 00 00 fa fa fa fa 00 00 00 00 00 00 00[04]
  0x5060001ab200: fa fa fa fa fd fd fd fd fd fd fd fd fa fa fa fa
  0x5060001ab280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x5060001ab300: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x5060001ab380: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x5060001ab400: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==484771==ABORTING

[Bug #20398]
@KJTsanaktsidis KJTsanaktsidis mentioned this pull request Mar 28, 2024
Closed
KJTsanaktsidis added a commit to KJTsanaktsidis/ruby that referenced this pull request Mar 28, 2024
@KJTsanaktsidis
Fix heap-buffer-overflow read in set_number_literal
f5f9a02 
It appears that tok(p) is not NULL terminated here, so we need to use
strndup to copy only the correct number of bytes.

[1/1] TestRubyLiteral#test_integer=================================================================
==484771==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x5060001ab1fc at pc 0x5597fe21d8e1 bp 0x7ffdc6fb0a50 sp 0x7ffdc6fb0210
READ of size 61 at 0x5060001ab1fc thread T0
    #0 0x5597fe21d8e0 in strlen.part.0 /home/kj/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:391:5
    #1 0x5597fe6b2feb in ruby_strdup /home/kj/ruby/build/../util.c:538:18
    ruby#2 0x5597fe4cb1c5 in set_number_literal /home/kj/ruby/build/parse.y:9694:9
    ruby#3 0x5597fe4cab3d in no_digits /home/kj/ruby/build/parse.y:10409:12
    ruby#4 0x5597fe4b9de9 in parse_numeric /home/kj/ruby/build/parse.y
    ruby#5 0x5597fe4a8adf in parser_yylex /home/kj/ruby/build/parse.y
    ruby#6 0x5597fe45c5cd in yylex /home/kj/ruby/build/parse.y:11916:9
    ruby#7 0x5597fe45c5cd in ruby_yyparse /home/kj/ruby/build/parse.c:11200:16
    ruby#8 0x5597fe49dc00 in yycompile0 /home/kj/ruby/build/parse.y:8121:9
    ruby#9 0x5597fe76db1b in rb_suppress_tracing /home/kj/ruby/build/../vm_trace.c:487:18
    ruby#10 0x5597fe494416 in yycompile /home/kj/ruby/build/parse.y:8177:5
    ruby#11 0x5597fe494416 in parser_compile_string /home/kj/ruby/build/parse.y:8240:12
    ruby#12 0x5597fe494416 in rb_ruby_parser_compile_string_path /home/kj/ruby/build/parse.y:8247:12
    ruby#13 0x5597fe498858 in rb_parser_compile_string_path /home/kj/ruby/build/parse.y:16663:12
    ruby#14 0x5597fe75688c in eval_make_iseq /home/kj/ruby/build/../vm_eval.c:1799:11
    ruby#15 0x5597fe70c8fa in eval_string_with_cref /home/kj/ruby/build/../vm_eval.c:1837:12
    ruby#16 0x5597fe70c396 in rb_f_eval /home/kj/ruby/build/../vm_eval.c:1912:16
    ruby#17 0x5597fe73f5e2 in vm_call_cfunc_with_frame_ /home/kj/ruby/build/../vm_insnhelper.c:3492:11
    ruby#18 0x5597fe6dca64 in vm_sendish /home/kj/ruby/build/../vm_callinfo.h
    ruby#19 0x5597fe6e64fa in vm_exec_core /home/kj/ruby/build/../insns.def:867:11
    #20 0x5597fe6dde00 in vm_exec_loop /home/kj/ruby/build/../vm.c:2578:22
    ruby#21 0x5597fe6dde00 in rb_vm_exec /home/kj/ruby/build/../vm.c:2557:18
    ruby#22 0x5597fe758bc4 in invoke_block /home/kj/ruby/build/../vm.c:1515:12
    ruby#23 0x5597fe758bc4 in invoke_iseq_block_from_c /home/kj/ruby/build/../vm.c:1585:16
    ruby#24 0x5597fe758bc4 in invoke_block_from_c_bh /home/kj/ruby/build/../vm.c:1603:20
    ruby#25 0x5597fe70e4b7 in vm_yield_with_cref /home/kj/ruby/build/../vm.c:1640:12
    ruby#26 0x5597fe709861 in vm_yield /home/kj/ruby/build/../vm.c:1648:12
    ruby#27 0x5597fe709861 in rb_yield_0 /home/kj/ruby/build/../vm_eval.c:1366:12
    ruby#28 0x5597fe709861 in rb_yield /home/kj/ruby/build/../vm_eval.c
    ruby#29 0x5597fec0eff9 in rb_ary_collect /home/kj/ruby/build/../array.c:3601:30
    ruby#30 0x5597fe73f5e2 in vm_call_cfunc_with_frame_ /home/kj/ruby/build/../vm_insnhelper.c:3492:11
    ruby#31 0x5597fe6dca64 in vm_sendish /home/kj/ruby/build/../vm_callinfo.h
    ruby#32 0x5597fe6e2d8f in vm_exec_core /home/kj/ruby/build/../insns.def:847:11
    ruby#33 0x5597fe6dde00 in vm_exec_loop /home/kj/ruby/build/../vm.c:2578:22
    ruby#34 0x5597fe6dde00 in rb_vm_exec /home/kj/ruby/build/../vm.c:2557:18
    ruby#35 0x5597fe3ffe9e in load_iseq_eval /home/kj/ruby/build/../load.c:778:5
    ruby#36 0x5597fe3fb498 in require_internal /home/kj/ruby/build/../load.c:1284:21
    ruby#37 0x5597fe3f9bf3 in rb_require_string_internal /home/kj/ruby/build/../load.c:1383:18
    ruby#38 0x5597fe73f5e2 in vm_call_cfunc_with_frame_ /home/kj/ruby/build/../vm_insnhelper.c:3492:11
    ruby#39 0x5597fe6dca64 in vm_sendish /home/kj/ruby/build/../vm_callinfo.h
    ruby#40 0x5597fe6e64fa in vm_exec_core /home/kj/ruby/build/../insns.def:867:11
    ruby#41 0x5597fe6dda82 in rb_vm_exec /home/kj/ruby/build/../vm.c:2551:22
    ruby#42 0x5597fe30a753 in rb_ec_exec_node /home/kj/ruby/build/../eval.c:283:9
    ruby#43 0x5597fe30a43d in ruby_run_node /home/kj/ruby/build/../eval.c:323:30
    ruby#44 0x5597fe3059b0 in rb_main /home/kj/ruby/build/../main.c:40:12
    ruby#45 0x5597fe3059b0 in main /home/kj/ruby/build/../main.c:59:12
    ruby#46 0x7f1a93141149 in __libc_start_call_main /usr/src/debug/glibc-2.38-16.fc39.x86_64/csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    ruby#47 0x7f1a9314120a in __libc_start_main@GLIBC_2.2.5 /usr/src/debug/glibc-2.38-16.fc39.x86_64/csu/../csu/libc-start.c:360:3
    ruby#48 0x5597fe1d3e34 in _start (/home/kj/ruby/build/ruby+0x38ae34)

0x5060001ab1fc is located 0 bytes after 60-byte region [0x5060001ab1c0,0x5060001ab1fc)
allocated by thread T0 here:
    #0 0x5597fe2bde4f in malloc /home/kj/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:68:3
    #1 0x5597fe3491a9 in objspace_xmalloc0 /home/kj/ruby/build/../gc.c:12605:5
    ruby#2 0x5597fe4a8adf in parser_yylex /home/kj/ruby/build/parse.y
    ruby#3 0x5597fe45c5cd in yylex /home/kj/ruby/build/parse.y:11916:9
    ruby#4 0x5597fe45c5cd in ruby_yyparse /home/kj/ruby/build/parse.c:11200:16
    ruby#5 0x5597fe49dc00 in yycompile0 /home/kj/ruby/build/parse.y:8121:9

SUMMARY: AddressSanitizer: heap-buffer-overflow /home/kj/ruby/build/../util.c:538:18 in ruby_strdup
Shadow bytes around the buggy address:
  0x5060001aaf00: fa fa fa fa fd fd fd fd fd fd fd fd fa fa fa fa
  0x5060001aaf80: 00 00 00 00 00 00 00 04 fa fa fa fa 00 00 00 00
  0x5060001ab000: 00 00 00 fa fa fa fa fa 00 00 00 00 00 00 00 fa
  0x5060001ab080: fa fa fa fa 00 00 00 00 00 00 00 00 fa fa fa fa
  0x5060001ab100: 00 00 00 00 00 00 00 00 fa fa fa fa 00 00 00 00
=>0x5060001ab180: 00 00 00 00 fa fa fa fa 00 00 00 00 00 00 00[04]
  0x5060001ab200: fa fa fa fa fd fd fd fd fd fd fd fd fa fa fa fa
  0x5060001ab280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x5060001ab300: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x5060001ab380: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x5060001ab400: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==484771==ABORTING

[Bug #20398]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Milestone
No milestone
3 participants
@tinco @shyouhei @nurse