https://git.ruby-lang.org/ruby.git/commit/?id=8cf01dd25c

From 8cf01dd25c126cf19b9146b71992b53c4541382e Mon Sep 17 00:00:00 2001
From: Alan Wu <XrXr@u...>
Date: Mon, 26 Jul 2021 20:17:49 -0400
Subject: Revert "Fix use-after-free on USE_EMBED_CI=0"

This reverts commit 1e0f2e4b09ca9443524acf4b50ffd50a80f330f3.
---
 compile.c | 19 +++++++------------
 1 file changed, 7 insertions(+), 12 deletions(-)

diff --git a/compile.c b/compile.c
index 823d6b5718..ecc123f0a2 100644
--- a/compile.c
+++ b/compile.c
@@ -3452,20 +3452,15 @@ iseq_peephole_optimize(rb_iseq_t *iseq, LINK_ELEMENT *list, const int do_tailcal https://github.com/ruby/ruby/blob/trunk/compile.c#L3452
 static int
 insn_set_specialized_instruction(rb_iseq_t *iseq, INSN *iobj, int insn_id)
 {
-    if (insn_id == BIN(opt_neq)) {
-        // Be careful to not write to iobj before allocating so the old operand stays alive.
-        VALUE original_ci = iobj->operands[0];
-        VALUE *new_operands = compile_data_calloc2(iseq, 2, sizeof(VALUE));
-        new_operands[0] = (VALUE)new_callinfo(iseq, idEq, 1, 0, NULL, FALSE);
-        new_operands[1] = original_ci;
+    iobj->insn_id = insn_id;
+    iobj->operand_size = insn_len(insn_id) - 1;
 
-        iobj->insn_id = insn_id;
+    if (insn_id == BIN(opt_neq)) {
+	VALUE *old_operands = iobj->operands;
         iobj->operand_size = 2;
-        iobj->operands = new_operands;
-    }
-    else {
-        iobj->insn_id = insn_id;
-        iobj->operand_size = insn_len(insn_id) - 1;
+        iobj->operands = compile_data_calloc2(iseq, iobj->operand_size, sizeof(VALUE));
+        iobj->operands[0] = (VALUE)new_callinfo(iseq, idEq, 1, 0, NULL, FALSE);
+        iobj->operands[1] = old_operands[0];
     }
 
     return COMPILE_OK;
-- 
cgit v1.2.1


--
ML: ruby-changes@q...
Info: http://www.atdot.net/~ko1/quickml/