matz	2008-03-01 12:36:33 +0900 (Sat, 01 Mar 2008)

  New Revision: 15654

  Modified files:
    trunk/ChangeLog
    trunk/bootstraptest/test_knownbug.rb
    trunk/eval_method.c
    trunk/thread.c

  Log:
    * eval_method.c (rb_get_method_body): ent->method may be freed by
      GC.  [ruby-dev:31819]
    
    * thread.c (remove_event_hook): should not access freed memory.
      [ruby-dev:31820]

  http://svn.ruby-lang.org/cgi-bin/viewvc.cgi/trunk/eval_method.c?r1=15654&r2=15653&diff_format=u
  http://svn.ruby-lang.org/cgi-bin/viewvc.cgi/trunk/ChangeLog?r1=15654&r2=15653&diff_format=u
  http://svn.ruby-lang.org/cgi-bin/viewvc.cgi/trunk/thread.c?r1=15654&r2=15653&diff_format=u
  http://svn.ruby-lang.org/cgi-bin/viewvc.cgi/trunk/bootstraptest/test_knownbug.rb?r1=15654&r2=15653&diff_format=u

Index: ChangeLog
===================================================================
--- ChangeLog	(revision 15653)
+++ ChangeLog	(revision 15654)
@@ -1,3 +1,11 @@
+Sat Mar  1 12:15:42 2008  Yukihiro Matsumoto  <matz@r...>
+
+	* eval_method.c (rb_get_method_body): ent->method may be freed by
+	  GC.  [ruby-dev:31819]
+
+	* thread.c (remove_event_hook): should not access freed memory.
+	  [ruby-dev:31820]
+
 Sat Mar 01 10:31:19 2008  NARUSE, Yui  <naruse@r...>
 
 	* io.c (read_all, rb_io_getline_fast): encoding is io_input_encoding.
Index: bootstraptest/test_knownbug.rb
===================================================================
--- bootstraptest/test_knownbug.rb	(revision 15653)
+++ bootstraptest/test_knownbug.rb	(revision 15654)
@@ -29,11 +29,6 @@
   C.new.foo
 }, '[ruby-core:14813]'
 
-# test is not written...
-flunk '[ruby-dev:31819] rb_clear_cache_by_class'
-flunk '[ruby-dev:31820] valgrind set_trace_func'
-flunk '[ruby-dev:32746] Invalid read of size 1'
-
 assert_equal 'ok', %q{
   class X < RuntimeError;end
   x = [X]
Index: thread.c
===================================================================
--- thread.c	(revision 15653)
+++ thread.c	(revision 15654)
@@ -2757,9 +2757,10 @@
 static int
 remove_event_hook(rb_event_hook_t **root, rb_event_hook_func_t func)
 {
-    rb_event_hook_t *prev = NULL, *hook = *root;
+    rb_event_hook_t *prev = NULL, *hook = *root, *next;
 
     while (hook) {
+	next = hook->next;
 	if (func == 0 || hook->func == func) {
 	    if (prev) {
 		prev->next = hook->next;
@@ -2769,8 +2770,10 @@
 	    }
 	    xfree(hook);
 	}
-	prev = hook;
-	hook = hook->next;
+	else {
+	    prev = hook;
+	}
+	hook = next;
     }
     return -1;
 }
Index: eval_method.c
===================================================================
--- eval_method.c	(revision 15653)
+++ eval_method.c	(revision 15654)
@@ -11,6 +11,7 @@
     ID mid;			/* method's id */
     ID mid0;			/* method's original id */
     VALUE klass;		/* receiver's class */
+    VALUE oklass;		/* original's class */
     NODE *method;
 };
 
@@ -46,7 +47,7 @@
     ent = cache;
     end = ent + CACHE_SIZE;
     while (ent < end) {
-	if (ent->method && ent->method->nd_clss == klass && ent->mid == id) {
+	if (ent->oklass == klass && ent->mid == id) {
 	    ent->mid = 0;
 	}
 	ent++;
@@ -84,8 +85,7 @@
     ent = cache;
     end = ent + CACHE_SIZE;
     while (ent < end) {
-	if ((ent->klass == klass) ||
-	    (ent->method && ent->method->nd_clss == klass)) {
+	if (ent->klass == klass || ent->oklass == klass) {
 	    ent->mid = 0;
 	}
 	ent++;
@@ -250,6 +250,7 @@
 	ent->klass = klass;
 	ent->mid = ent->mid0 = id;
 	ent->method = 0;
+	ent->oklass = 0;
 	return 0;
     }
 
@@ -263,6 +264,7 @@
 	ent->mid = id;
 	ent->mid0 = fbody->nd_oid;
 	ent->method = body = method;
+	ent->oklass = method->nd_clss;
     }
     else {
 	body = method;

--
ML: ruby-changes@q...
Info: http://www.atdot.net/~ko1/quickml/