k0kubun	2018-11-22 22:29:44 +0900 (Thu, 22 Nov 2018)

  New Revision: 65928

  https://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revision&revision=65928

  Log:
    mjit.c: avoid running copy job handler after ISeq GC
    
    like this http://ci.rvm.jp/results/trunk-mjit@silicon-docker/1471633

  Modified files:
    trunk/mjit.c
    trunk/mjit_worker.c
Index: mjit_worker.c
===================================================================
--- mjit_worker.c	(revision 65927)
+++ mjit_worker.c	(revision 65928)
@@ -1121,7 +1121,7 @@ convert_unit_to_func(struct rb_mjit_unit https://github.com/ruby/ruby/blob/trunk/mjit_worker.c#L1121
 }
 
 struct mjit_copy_job {
-    const struct rb_iseq_constant_body *body;
+    struct rb_mjit_unit *unit;
     struct rb_call_cache *cc_entries;
     union iseq_inline_storage_entry *is_entries;
     int finish_p;
@@ -1197,14 +1197,15 @@ mjit_worker(void) https://github.com/ruby/ruby/blob/trunk/mjit_worker.c#L1197
 
         if (unit) {
             mjit_func_t func;
+            const struct rb_iseq_constant_body *body = unit->iseq->body;
 
-            job.body = unit->iseq->body;
+            job.unit = unit;
             job.cc_entries = NULL;
-            if (job.body->ci_size > 0 || job.body->ci_kw_size > 0)
-                job.cc_entries = alloca(sizeof(struct rb_call_cache) * (job.body->ci_size + job.body->ci_kw_size));
+            if (body->ci_size > 0 || body->ci_kw_size > 0)
+                job.cc_entries = alloca(sizeof(struct rb_call_cache) * (body->ci_size + body->ci_kw_size));
             job.is_entries = NULL;
-            if (job.body->is_size > 0)
-                job.is_entries = alloca(sizeof(union iseq_inline_storage_entry) * job.body->is_size);
+            if (body->is_size > 0)
+                job.is_entries = alloca(sizeof(union iseq_inline_storage_entry) * body->is_size);
 
             /* Copy ISeq's inline caches values to avoid race condition. */
             if (job.cc_entries != NULL || job.is_entries != NULL) {
Index: mjit.c
===================================================================
--- mjit.c	(revision 65927)
+++ mjit.c	(revision 65928)
@@ -25,7 +25,7 @@ static void https://github.com/ruby/ruby/blob/trunk/mjit.c#L25
 mjit_copy_job_handler(void *data)
 {
     struct mjit_copy_job *job = data;
-    int finish_p;
+    const struct rb_iseq_constant_body *body;
     if (stop_worker_p) {
         /* `copy_cache_from_main_thread()` stops to wait for this job. Then job data which is
            allocated by `alloca()` could be expired and we might not be able to access that.
@@ -34,20 +34,20 @@ mjit_copy_job_handler(void *data) https://github.com/ruby/ruby/blob/trunk/mjit.c#L34
     }
 
     CRITICAL_SECTION_START(3, "in mjit_copy_job_handler");
-    finish_p = job->finish_p;
-    CRITICAL_SECTION_FINISH(3, "in mjit_copy_job_handler");
-    if (finish_p) {
-        return; /* make sure that this job is never executed while job is being modified. */
+    /* Make sure that this job is never executed while job is being modified or ISeq is GC-ed */
+    if (job->finish_p || job->unit->iseq == NULL) {
+        CRITICAL_SECTION_FINISH(3, "in mjit_copy_job_handler");
+        return;
     }
 
+    body = job->unit->iseq->body;
     if (job->cc_entries) {
-        memcpy(job->cc_entries, job->body->cc_entries, sizeof(struct rb_call_cache) * (job->body->ci_size + job->body->ci_kw_size));
+        memcpy(job->cc_entries, body->cc_entries, sizeof(struct rb_call_cache) * (body->ci_size + body->ci_kw_size));
     }
     if (job->is_entries) {
-        memcpy(job->is_entries, job->body->is_entries, sizeof(union iseq_inline_storage_entry) * job->body->is_size);
+        memcpy(job->is_entries, body->is_entries, sizeof(union iseq_inline_storage_entry) * body->is_size);
     }
 
-    CRITICAL_SECTION_START(3, "in mjit_copy_job_handler");
     job->finish_p = TRUE;
     rb_native_cond_broadcast(&mjit_worker_wakeup);
     CRITICAL_SECTION_FINISH(3, "in mjit_copy_job_handler");

--
ML: ruby-changes@q...
Info: http://www.atdot.net/~ko1/quickml/