ruby-changes:72609
From: Peter <ko1@a...>
Date: Wed, 20 Jul 2022 21:40:48 +0900 (JST)
Subject: [ruby-changes:72609] 86d061294d (master): [Bug #18928] Fix crash in WeakMap
https://git.ruby-lang.org/ruby.git/commit/?id=86d061294d From 86d061294d3cc1656e18d0e1fd4b4f290da16944 Mon Sep 17 00:00:00 2001 From: Peter Zhu <peter@p...> Date: Tue, 19 Jul 2022 15:51:39 -0400 Subject: [Bug #18928] Fix crash in WeakMap In wmap_live_p, if is_pointer_to_heap returns false, then the page is either in the tomb or has already been freed, so the object is dead. In this case, wmap_live_p should return false. --- gc.c | 21 +++++++++++---------- 1 file changed, 11 insertions(+), 10 deletions(-) diff --git a/gc.c b/gc.c index 6fbcd74eb1..84d9b706fa 100644 --- a/gc.c +++ b/gc.c @@ -12706,20 +12706,21 @@ static int https://github.com/ruby/ruby/blob/trunk/gc.c#L12706 wmap_live_p(rb_objspace_t *objspace, VALUE obj) { if (SPECIAL_CONST_P(obj)) return TRUE; - if (is_pointer_to_heap(objspace, (void *)obj)) { - void *poisoned = asan_unpoison_object_temporary(obj); + /* If is_pointer_to_heap returns false, the page could be in the tomb heap + * or have already been freed. */ + if (!is_pointer_to_heap(objspace, (void *)obj)) return FALSE; - enum ruby_value_type t = BUILTIN_TYPE(obj); - int ret = (!(t == T_NONE || t >= T_FIXNUM || t == T_ICLASS) && - is_live_object(objspace, obj)); + void *poisoned = asan_unpoison_object_temporary(obj); - if (poisoned) { - asan_poison_object(obj); - } + enum ruby_value_type t = BUILTIN_TYPE(obj); + int ret = (!(t == T_NONE || t >= T_FIXNUM || t == T_ICLASS) && + is_live_object(objspace, obj)); - return ret; + if (poisoned) { + asan_poison_object(obj); } - return TRUE; + + return ret; } static int -- cgit v1.2.1 -- ML: ruby-changes@q... Info: http://www.atdot.net/~ko1/quickml/