k0kubun	2018-10-20 20:21:07 +0900 (Sat, 20 Oct 2018)

  New Revision: 65231

  https://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revision&revision=65231

  Log:
    mjit_worker.c: don't refer to freed value
    
    remove_from_list() frees node, but after that node->next could be used

  Modified files:
    trunk/mjit_worker.c
Index: mjit_worker.c
===================================================================
--- mjit_worker.c	(revision 65230)
+++ mjit_worker.c	(revision 65231)
@@ -499,13 +499,14 @@ mjit_valid_class_serial_p(rb_serial_t cl https://github.com/ruby/ruby/blob/trunk/mjit_worker.c#L499
 static struct rb_mjit_unit_node *
 get_from_list(struct rb_mjit_unit_list *list)
 {
-    struct rb_mjit_unit_node *node, *best = NULL;
+    struct rb_mjit_unit_node *node, *next, *best = NULL;
 
     if (list->head == NULL)
         return NULL;
 
     /* Find iseq with max total_calls */
-    for (node = list->head; node != NULL; node = node ? node->next : NULL) {
+    for (node = list->head; node != NULL; node = next) {
+        next = node->next;
         if (node->unit->iseq == NULL) { /* ISeq is GCed. */
             free_unit(node->unit);
             remove_from_list(node, list);

--
ML: ruby-changes@q...
Info: http://www.atdot.net/~ko1/quickml/