ruby-core

Issue #20577 has been updated by mdalessio (Mike Dalessio).


I can also reproduce this by running ruby_memcheck's tests with ruby master.

----------------------------------------
Bug #20577: FREE_AT_EXIT segfaulting after 32683aa1
https://bugs.ruby-lang.org/issues/20577#change-108812

* Author: mdalessio (Mike Dalessio)
* Status: Open
* ruby -v: ruby 3.4.0dev (2024-06-11T14:33:51Z master 32683aa18d) [x86_64-linux]
* Backport: 3.1: UNKNOWN, 3.2: UNKNOWN, 3.3: UNKNOWN
----------------------------------------
After commit 32683aa1 on master, using `RUBY_FREE_AT_EXIT` results in a segfault. When run with valgrind, many invalid reads are reported.

Repro with

```
RUBY_FREE_AT_EXIT=1 bundle exec /path/to/ruby -e 'puts RUBY_DESCRIPTION'
```

or for valgrind details

```
RUBY_FREE_AT_EXIT=1 bundle exec valgrind /path/to/ruby -e 'puts RUBY_DESCRIPTION'
```

Typical example valgrind error is:

```
==441955== Invalid read of size 4
==441955==    at 0x2C6F97: hash_table_index (id_table.c:132)
==441955==    by 0x2C6F97: rb_id_table_lookup (id_table.c:230)
==441955==    by 0x31AB50: cached_callable_method_entry (vm_method.c:1415)
==441955==    by 0x31AB50: callable_method_entry_or_negative (vm_method.c:1485)
==441955==    by 0x31C4EE: callable_method_entry (vm_method.c:1522)
==441955==    by 0x31C4EE: rb_callable_method_entry (vm_method.c:1529)
==441955==    by 0x18F370: obj_any_hash (hash.c:222)
==441955==    by 0x19F444: any_hash (hash.c:204)
==441955==    by 0x19F444: rb_any_hash (hash.c:260)
==441955==    by 0x19F444: ar_do_hash (hash.c:418)
==441955==    by 0x19F444: ar_delete (hash.c:1093)
==441955==    by 0x19F444: rb_hash_stlike_delete (hash.c:2385)
==441955==    by 0x1A0CCB: rb_hash_delete_entry (hash.c:2402)
==441955==    by 0x2C59B6: rb_gc_free_dsymbol (symbol.c:851)
==441955==    by 0x17AC53: obj_free (gc.c:3460)
==441955==    by 0x17D045: rb_objspace_call_finalizer_i (gc.c:4352)
==441955==    by 0x17D045: gc_each_object (gc.c:4302)
==441955==    by 0x17D045: rb_objspace_call_finalizer (gc.c:4401)
==441955==    by 0x162719: rb_ec_finalize (eval.c:164)
==441955==    by 0x162719: rb_ec_cleanup (eval.c:255)
==441955==    by 0x15CE09: rb_main (main.c:40)
==441955==    by 0x15CE09: main (main.c:59)
==441955==  Address 0x4ec4610 is 0 bytes inside a block of size 24 free'd
==441955==    at 0x484988F: free (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so)
==441955==    by 0x175BD1: objspace_xfree (gc.c:12153)
==441955==    by 0x175BD1: objspace_xfree (gc.c:12084)
==441955==    by 0x175BD1: ruby_sized_xfree.constprop.0 (gc.c:12257)
==441955==    by 0x17A9A0: obj_free (gc.c:3293)
==441955==    by 0x17D045: rb_objspace_call_finalizer_i (gc.c:4352)
==441955==    by 0x17D045: gc_each_object (gc.c:4302)
==441955==    by 0x17D045: rb_objspace_call_finalizer (gc.c:4401)
==441955==    by 0x162719: rb_ec_finalize (eval.c:164)
==441955==    by 0x162719: rb_ec_cleanup (eval.c:255)
==441955==    by 0x15CE09: rb_main (main.c:40)
==441955==    by 0x15CE09: main (main.c:59)
==441955==  Block was alloc'd at
==441955==    at 0x4846828: malloc (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so)
==441955==    by 0x189B0A: objspace_xmalloc0 (gc.c:11938)
==441955==    by 0x2C6EA6: rb_id_table_create (id_table.c:98)
==441955==    by 0x31AD99: cache_callable_method_entry (vm_method.c:1444)
==441955==    by 0x31AD99: callable_method_entry_or_negative (vm_method.c:1502)
==441955==    by 0x32A7DE: callable_method_entry (vm_method.c:1522)
==441955==    by 0x32A7DE: vm_respond_to (vm_method.c:2878)
==441955==    by 0x3305E3: check_funcall_respond_to (vm_eval.c:602)
==441955==    by 0x3305E3: rb_check_funcall_default_kw (vm_eval.c:676)
==441955==    by 0x20E896: convert_type_with_id (object.c:3131)
==441955==    by 0x20E896: rb_check_convert_type_with_id (object.c:3223)
==441955==    by 0x1672A7: rb_stat (file.c:1299)
==441955==    by 0x16E15E: rb_file_exist_p (file.c:1805)
==441955==    by 0x16E15E: rb_check_realpath_internal (file.c:4567)
==441955==    by 0x1D6639: get_loaded_features_index (load.c:415)
==441955==    by 0x1D6FB7: rb_provide_feature (load.c:703)
==441955==    by 0x1A2629: rb_call_inits (inits.c:64)
==441955==    by 0x162B67: ruby_setup (eval.c:86)
==441955==    by 0x162C1C: ruby_init (eval.c:98)
==441955==    by 0x15CDF7: rb_main (main.c:39)
==441955==    by 0x15CDF7: main (main.c:59)
```

I'm attaching a full log from my system. cc @peterzhu2118


---Files--------------------------------
bug.log (238 KB)


-- 
https://bugs.ruby-lang.org/

Thread

Prev Next

In This Thread

Prev Next