https://git.ruby-lang.org/ruby.git/commit/?id=9a6c3355c5

From 9a6c3355c5c9541b9afb94d4ee770a7584c7ac15 Mon Sep 17 00:00:00 2001
From: Peter Zhu <peter@p...>
Date: Mon, 14 Nov 2022 15:40:47 -0500
Subject: Set array capacity/shared immediately after alloc

If auto-compaction is enabled, then we have to set the capacity/shared
immediately after allocating a heap array. If compaction runs before
capacity/shared is set then it could cause the array to be re-embedded,
which can cause crashes.
---
 array.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/array.c b/array.c
index a33c43bdbf..0b4998a47c 100644
--- a/array.c
+++ b/array.c
@@ -837,11 +837,11 @@ ary_new(VALUE klass, long capa) https://github.com/ruby/ruby/blob/trunk/array.c#L837
     }
     else {
         ary = ary_alloc_heap(klass);
+        ARY_SET_CAPA(ary, capa);
         assert(!ARY_EMBED_P(ary));
 
         ptr = ary_heap_alloc(ary, capa);
         ARY_SET_PTR(ary, ptr);
-        ARY_SET_CAPA(ary, capa);
         ARY_SET_HEAP_LEN(ary, 0);
     }
 
@@ -945,11 +945,11 @@ ec_ary_new(rb_execution_context_t *ec, VALUE klass, long capa) https://github.com/ruby/ruby/blob/trunk/array.c#L945
     }
     else {
         ary = ec_ary_alloc_heap(ec, klass);
+        ARY_SET_CAPA(ary, capa);
         assert(!ARY_EMBED_P(ary));
 
         ptr = ary_heap_alloc(ary, capa);
         ARY_SET_PTR(ary, ptr);
-        ARY_SET_CAPA(ary, capa);
         ARY_SET_HEAP_LEN(ary, 0);
     }
 
@@ -1056,6 +1056,7 @@ ary_make_shared(VALUE ary) https://github.com/ruby/ruby/blob/trunk/array.c#L1056
         /* Shared roots cannot be embedded because the reference count
          * (refcnt) is stored in as.heap.aux.capa. */
         VALUE shared = ary_alloc_heap(0);
+        FL_SET_SHARED_ROOT(shared);
 
         if (ARY_EMBED_P(ary)) {
             /* Cannot use ary_heap_alloc because we don't want to allocate
@@ -1074,7 +1075,6 @@ ary_make_shared(VALUE ary) https://github.com/ruby/ruby/blob/trunk/array.c#L1075
 
         ARY_SET_LEN(shared, capa);
         ary_mem_clear(shared, len, capa - len);
-        FL_SET_SHARED_ROOT(shared);
         ARY_SET_SHARED_ROOT_REFCNT(shared, 1);
         FL_SET_SHARED(ary);
         RB_DEBUG_COUNTER_INC(obj_ary_shared_create);
@@ -1348,11 +1348,11 @@ ary_make_partial(VALUE ary, VALUE klass, long offset, long len) https://github.com/ruby/ruby/blob/trunk/array.c#L1348
         return result;
     }
     else {
+        VALUE shared = ary_make_shared(ary);
+
         VALUE result = ary_alloc_heap(klass);
         assert(!ARY_EMBED_P(result));
 
-        VALUE shared = ary_make_shared(ary);
-
         ARY_SET_PTR(result, RARRAY_CONST_PTR_TRANSIENT(ary));
         ARY_SET_LEN(result, RARRAY_LEN(ary));
         rb_ary_set_shared(result, shared);
-- 
cgit v1.2.3


--
ML: ruby-changes@q...
Info: http://www.atdot.net/~ko1/quickml/