<feed xmlns='http://www.w3.org/2005/Atom'>
<title>ruby.git/iseq.c, branch v3_4_9</title>
<subtitle>The Ruby Programming Language</subtitle>
<link rel='alternate' type='text/html' href='https://git.ruby-lang.org/ruby.git/'/>
<entry>
<title>More write barriers to local_iseq and parent_iseq</title>
<updated>2025-09-05T16:05:06+00:00</updated>
<author>
<name>John Hawthorn</name>
<email>john@hawthorn.email</email>
</author>
<published>2025-06-09T17:09:10+00:00</published>
<link rel='alternate' type='text/html' href='https://git.ruby-lang.org/ruby.git/commit/?id=4c0a2764b6634e6f2c11494fc015afd5c71537c2'/>
<id>4c0a2764b6634e6f2c11494fc015afd5c71537c2</id>
<content type='text'>
Found by wbcheck
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Found by wbcheck
</pre>
</div>
</content>
</entry>
<entry>
<title>merge revision(s) b42afa1dbcbb91e89852b3b3bc72484d7f0a5528, f1f0cc14cc7d3f9be35b203e5583f9224b1e2387, 543e3a1896ae2fe3b5b954f6497d261ab5663a15, ed2806117a0b76e4439ce1a061fae21d9e116d69, 46e4c8673747de96838d2c5dec37446d23d99d88: [Backport #21500]</title>
<updated>2025-07-14T21:50:56+00:00</updated>
<author>
<name>Takashi Kokubun</name>
<email>takashikkbn@gmail.com</email>
</author>
<published>2025-07-14T21:50:56+00:00</published>
<link rel='alternate' type='text/html' href='https://git.ruby-lang.org/ruby.git/commit/?id=596126ee5aa35a65bcaca60b92b5547ef1a9d2da'/>
<id>596126ee5aa35a65bcaca60b92b5547ef1a9d2da</id>
<content type='text'>
	Suppress gcc 15 unterminated-string-initialization warnings

	Separate `__has_attribute` from `defined(__has_attribute)`

	Fix Visual C warnings:
	```
	regenc.h(121): warning C4067: unexpected tokens following preprocessor directive - expected a newline
	```

	Cast up `int` instruction code to `VALUE`

	Fix Visual C warnings:
	```
	iseq.c(3793): warning C4312: 'type cast': conversion from 'int' to 'void *' of greater size
	iseq.c(3794): warning C4312: 'type cast': conversion from 'int' to 'void *' of greater size
	```

	Do not let files depend on a phony target

	Detect `clock_gettime` and `clock_getres` for winpthreads
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
	Suppress gcc 15 unterminated-string-initialization warnings

	Separate `__has_attribute` from `defined(__has_attribute)`

	Fix Visual C warnings:
	```
	regenc.h(121): warning C4067: unexpected tokens following preprocessor directive - expected a newline
	```

	Cast up `int` instruction code to `VALUE`

	Fix Visual C warnings:
	```
	iseq.c(3793): warning C4312: 'type cast': conversion from 'int' to 'void *' of greater size
	iseq.c(3794): warning C4312: 'type cast': conversion from 'int' to 'void *' of greater size
	```

	Do not let files depend on a phony target

	Detect `clock_gettime` and `clock_getres` for winpthreads
</pre>
</div>
</content>
</entry>
<entry>
<title>merge revision(s) 34b407a4a89e69dd04f692e2b29efa2816d4664a: [Backport #21394]</title>
<updated>2025-07-14T20:55:05+00:00</updated>
<author>
<name>Takashi Kokubun</name>
<email>takashikkbn@gmail.com</email>
</author>
<published>2025-07-14T20:55:05+00:00</published>
<link rel='alternate' type='text/html' href='https://git.ruby-lang.org/ruby.git/commit/?id=c397c2d177a0b7fd13b69c5109418fbe1f9eccd1'/>
<id>c397c2d177a0b7fd13b69c5109418fbe1f9eccd1</id>
<content type='text'>
	Fix memory leak in Prism's RubyVM::InstructionSequence.new

	[Bug #21394]

	There are two ways to make RubyVM::InstructionSequence.new raise which
	would cause the options-&gt;scopes to leak memory:

	1. Passing in any (non T_FILE) object where the to_str raises.
	2. Passing in a T_FILE object where String#initialize_dup raises. This is
	   because rb_io_path dups the string.

	Example 1:

	    10.times do
	      100_000.times do
	        RubyVM::InstructionSequence.new(nil)
	      rescue TypeError
	      end

	      puts `ps -o rss= -p #{$$}`
	    end

	Before:

	    13392
	    17104
	    20256
	    23920
	    27264
	    30432
	    33584
	    36752
	    40032
	    43232

	After:

	    9392
	    11072
	    11648
	    11648
	    11648
	    11712
	    11712
	    11712
	    11744
	    11744

	Example 2:

	    require "tempfile"

	    MyError = Class.new(StandardError)
	    String.prepend(Module.new do
	      def initialize_dup(_)
	        if $raise_on_dup
	          raise MyError
	        else
	          super
	        end
	      end
	    end)

	    Tempfile.create do |f|
	      10.times do
	        100_000.times do
	          $raise_on_dup = true
	          RubyVM::InstructionSequence.new(f)
	        rescue MyError
	        else
	          raise "MyError was not raised during RubyVM::InstructionSequence.new"
	        end

	        puts `ps -o rss= -p #{$$}`
	      ensure
	        $raise_on_dup = false
	      end
	    end

	Before:

	    14080
	    18512
	    22000
	    25184
	    28320
	    31600
	    34736
	    37904
	    41088
	    44256

	After:

	    12016
	    12464
	    12880
	    12880
	    12880
	    12912
	    12912
	    12912
	    12912
	    12912
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
	Fix memory leak in Prism's RubyVM::InstructionSequence.new

	[Bug #21394]

	There are two ways to make RubyVM::InstructionSequence.new raise which
	would cause the options-&gt;scopes to leak memory:

	1. Passing in any (non T_FILE) object where the to_str raises.
	2. Passing in a T_FILE object where String#initialize_dup raises. This is
	   because rb_io_path dups the string.

	Example 1:

	    10.times do
	      100_000.times do
	        RubyVM::InstructionSequence.new(nil)
	      rescue TypeError
	      end

	      puts `ps -o rss= -p #{$$}`
	    end

	Before:

	    13392
	    17104
	    20256
	    23920
	    27264
	    30432
	    33584
	    36752
	    40032
	    43232

	After:

	    9392
	    11072
	    11648
	    11648
	    11648
	    11712
	    11712
	    11712
	    11744
	    11744

	Example 2:

	    require "tempfile"

	    MyError = Class.new(StandardError)
	    String.prepend(Module.new do
	      def initialize_dup(_)
	        if $raise_on_dup
	          raise MyError
	        else
	          super
	        end
	      end
	    end)

	    Tempfile.create do |f|
	      10.times do
	        100_000.times do
	          $raise_on_dup = true
	          RubyVM::InstructionSequence.new(f)
	        rescue MyError
	        else
	          raise "MyError was not raised during RubyVM::InstructionSequence.new"
	        end

	        puts `ps -o rss= -p #{$$}`
	      ensure
	        $raise_on_dup = false
	      end
	    end

	Before:

	    14080
	    18512
	    22000
	    25184
	    28320
	    31600
	    34736
	    37904
	    41088
	    44256

	After:

	    12016
	    12464
	    12880
	    12880
	    12880
	    12912
	    12912
	    12912
	    12912
	    12912
</pre>
</div>
</content>
</entry>
<entry>
<title>Push a real iseq in rb_vm_push_frame_fname()</title>
<updated>2025-03-14T19:04:25+00:00</updated>
<author>
<name>Alan Wu</name>
<email>XrXr@users.noreply.github.com</email>
</author>
<published>2025-03-11T02:37:44+00:00</published>
<link rel='alternate' type='text/html' href='https://git.ruby-lang.org/ruby.git/commit/?id=6ca43e9b16ded4f884e9a54e9f8f6f6c4e5f0f73'/>
<id>6ca43e9b16ded4f884e9a54e9f8f6f6c4e5f0f73</id>
<content type='text'>
Previously, vm_make_env_each() (used during proc
creation and for the debug inspector C API) picked up the
non-GC-allocated iseq that rb_vm_push_frame_fname() creates,
which led to a SEGV when the GC tried to mark the non GC object.

Put a real iseq imemo instead. Speed should be about the same since
the old code also did a imemo allocation and a malloc allocation.

Real iseq allows ironing out the special-casing of dummy frames in
rb_execution_context_mark() and rb_execution_context_update(). A check
is added to RubyVM::ISeq#eval, though, to stop attempts to run dummy
iseqs.

[Bug #21180]

Co-authored-by: Aaron Patterson &lt;tenderlove@ruby-lang.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Previously, vm_make_env_each() (used during proc
creation and for the debug inspector C API) picked up the
non-GC-allocated iseq that rb_vm_push_frame_fname() creates,
which led to a SEGV when the GC tried to mark the non GC object.

Put a real iseq imemo instead. Speed should be about the same since
the old code also did a imemo allocation and a malloc allocation.

Real iseq allows ironing out the special-casing of dummy frames in
rb_execution_context_mark() and rb_execution_context_update(). A check
is added to RubyVM::ISeq#eval, though, to stop attempts to run dummy
iseqs.

[Bug #21180]

Co-authored-by: Aaron Patterson &lt;tenderlove@ruby-lang.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>Have `ast` live longer in ISeq.compile_file to fix GC stress crash</title>
<updated>2025-03-14T19:04:25+00:00</updated>
<author>
<name>Alan Wu</name>
<email>XrXr@users.noreply.github.com</email>
</author>
<published>2025-03-11T17:14:13+00:00</published>
<link rel='alternate' type='text/html' href='https://git.ruby-lang.org/ruby.git/commit/?id=31502b0d8569b806d723a0e49a919921bf5d6e2c'/>
<id>31502b0d8569b806d723a0e49a919921bf5d6e2c</id>
<content type='text'>
Previously, live range of `ast_value` ended on the call right before
rb_ast_dispose(), which led to premature collection and use-after-free.

We observed this crashing on -O3, -DVM_CHECK_MODE, with GCC 11.4.0 on
Ubuntu.

Co-authored-by: Aaron Patterson &lt;tenderlove@ruby-lang.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Previously, live range of `ast_value` ended on the call right before
rb_ast_dispose(), which led to premature collection and use-after-free.

We observed this crashing on -O3, -DVM_CHECK_MODE, with GCC 11.4.0 on
Ubuntu.

Co-authored-by: Aaron Patterson &lt;tenderlove@ruby-lang.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>merge revision(s) 63723c8d5908569918fb27e070ae5bc9de33c8bd: [Backport #21014]</title>
<updated>2025-02-14T01:54:21+00:00</updated>
<author>
<name>Takashi Kokubun</name>
<email>takashikkbn@gmail.com</email>
</author>
<published>2025-02-14T01:54:21+00:00</published>
<link rel='alternate' type='text/html' href='https://git.ruby-lang.org/ruby.git/commit/?id=9240f01b1fbe5ea4f6a2017d35f8f605f84f0039'/>
<id>9240f01b1fbe5ea4f6a2017d35f8f605f84f0039</id>
<content type='text'>
	Correctly set node_id on iseq location

	The iseq location object has a slot for node ids.  parse.y was correctly
	populating that field but Prism was not. This commit populates the field
	with the ast node id for that iseq

	[Bug #21014]
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
	Correctly set node_id on iseq location

	The iseq location object has a slot for node ids.  parse.y was correctly
	populating that field but Prism was not. This commit populates the field
	with the ast node id for that iseq

	[Bug #21014]
</pre>
</div>
</content>
</entry>
<entry>
<title>Prefix asan_poison_object with rb</title>
<updated>2024-12-19T14:14:34+00:00</updated>
<author>
<name>Peter Zhu</name>
<email>peter@peterzhu.ca</email>
</author>
<published>2024-12-18T17:01:09+00:00</published>
<link rel='alternate' type='text/html' href='https://git.ruby-lang.org/ruby.git/commit/?id=a58675386c10f4183116056bc0cf289548883ac0'/>
<id>a58675386c10f4183116056bc0cf289548883ac0</id>
<content type='text'>
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
</pre>
</div>
</content>
</entry>
<entry>
<title>Fix use-after-free in constant cache</title>
<updated>2024-11-29T15:46:43+00:00</updated>
<author>
<name>Peter Zhu</name>
<email>peter@peterzhu.ca</email>
</author>
<published>2024-11-28T19:04:01+00:00</published>
<link rel='alternate' type='text/html' href='https://git.ruby-lang.org/ruby.git/commit/?id=f65a6c090c229de1665af49f2e51fc1d6397ab72'/>
<id>f65a6c090c229de1665af49f2e51fc1d6397ab72</id>
<content type='text'>
[Bug #20921]

When we create a cache entry for a constant, the following sequence of
events could happen:

- vm_track_constant_cache is called to insert a constant cache.
- In vm_track_constant_cache, we first look up the ST table for the ID
  of the constant. Assume the ST table exists because another iseq also
  holds a cache entry for this ID.
- We then insert into this ST table with the iseq_inline_constant_cache.
- However, while inserting into this ST table, it allocates memory, which
  could trigger a GC. Assume that it does trigger a GC.
- The GC frees the one and only other iseq that holds a cache entry for
  this ID.
- In remove_from_constant_cache, it will appear that the ST table is now
  empty because there are no more iseq with cache entries for this ID, so
  we free the ST table.
- We complete GC and continue our st_insert. However, this ST table has
  been freed so we now have a use-after-free.

This issue is very hard to reproduce, because it requires that the GC runs
at a very specific time. However, we can make it show up by applying this
patch which runs GC right before the st_insert to mimic the st_insert
triggering a GC:

    diff --git a/vm_insnhelper.c b/vm_insnhelper.c
    index 3cb23f06f0..a93998136a 100644
    --- a/vm_insnhelper.c
    +++ b/vm_insnhelper.c
    @@ -6338,6 +6338,10 @@ vm_track_constant_cache(ID id, void *ic)
            rb_id_table_insert(const_cache, id, (VALUE)ics);
        }

    +    if (id == rb_intern("MyConstant")) rb_gc();
    +
        st_insert(ics, (st_data_t) ic, (st_data_t) Qtrue);
    }

And if we run this script:

    Object.const_set("MyConstant", "Hello!")

    my_proc = eval("-&gt; { MyConstant }")
    my_proc.call

    my_proc = eval("-&gt; { MyConstant }")
    my_proc.call

We can see that ASAN outputs a use-after-free error:

    ==36540==ERROR: AddressSanitizer: heap-use-after-free on address 0x606000049528 at pc 0x000102f3ceac bp 0x00016d607a70 sp 0x00016d607a68
    READ of size 8 at 0x606000049528 thread T0
        #0 0x102f3cea8 in do_hash st.c:321
        #1 0x102f3ddd0 in rb_st_insert st.c:1132
        #2 0x103140700 in vm_track_constant_cache vm_insnhelper.c:6345
        #3 0x1030b91d8 in vm_ic_track_const_chain vm_insnhelper.c:6356
        #4 0x1030b8cf8 in rb_vm_opt_getconstant_path vm_insnhelper.c:6424
        #5 0x1030bc1e0 in vm_exec_core insns.def:263
        #6 0x1030b55fc in rb_vm_exec vm.c:2585
        #7 0x1030fe0ac in rb_iseq_eval_main vm.c:2851
        #8 0x102a82588 in rb_ec_exec_node eval.c:281
        #9 0x102a81fe0 in ruby_run_node eval.c:319
        #10 0x1027f3db4 in rb_main main.c:43
        #11 0x1027f3bd4 in main main.c:68
        #12 0x183900270  (&lt;unknown module&gt;)

    0x606000049528 is located 8 bytes inside of 56-byte region [0x606000049520,0x606000049558)
    freed by thread T0 here:
        #0 0x104174d40 in free+0x98 (libclang_rt.asan_osx_dynamic.dylib:arm64e+0x54d40)
        #1 0x102ada89c in rb_gc_impl_free default.c:8183
        #2 0x102ada7dc in ruby_sized_xfree gc.c:4507
        #3 0x102ac4d34 in ruby_xfree gc.c:4518
        #4 0x102f3cb34 in rb_st_free_table st.c:663
        #5 0x102bd52d8 in remove_from_constant_cache iseq.c:119
        #6 0x102bbe2cc in iseq_clear_ic_references iseq.c:153
        #7 0x102bbd2a0 in rb_iseq_free iseq.c:166
        #8 0x102b32ed0 in rb_imemo_free imemo.c:564
        #9 0x102ac4b44 in rb_gc_obj_free gc.c:1407
        #10 0x102af4290 in gc_sweep_plane default.c:3546
        #11 0x102af3bdc in gc_sweep_page default.c:3634
        #12 0x102aeb140 in gc_sweep_step default.c:3906
        #13 0x102aeadf0 in gc_sweep_rest default.c:3978
        #14 0x102ae4714 in gc_sweep default.c:4155
        #15 0x102af8474 in gc_start default.c:6484
        #16 0x102afbe30 in garbage_collect default.c:6363
        #17 0x102ad37f0 in rb_gc_impl_start default.c:6816
        #18 0x102ad3634 in rb_gc gc.c:3624
        #19 0x1031406ec in vm_track_constant_cache vm_insnhelper.c:6342
        #20 0x1030b91d8 in vm_ic_track_const_chain vm_insnhelper.c:6356
        #21 0x1030b8cf8 in rb_vm_opt_getconstant_path vm_insnhelper.c:6424
        #22 0x1030bc1e0 in vm_exec_core insns.def:263
        #23 0x1030b55fc in rb_vm_exec vm.c:2585
        #24 0x1030fe0ac in rb_iseq_eval_main vm.c:2851
        #25 0x102a82588 in rb_ec_exec_node eval.c:281
        #26 0x102a81fe0 in ruby_run_node eval.c:319
        #27 0x1027f3db4 in rb_main main.c:43
        #28 0x1027f3bd4 in main main.c:68
        #29 0x183900270  (&lt;unknown module&gt;)

    previously allocated by thread T0 here:
        #0 0x104174c04 in malloc+0x94 (libclang_rt.asan_osx_dynamic.dylib:arm64e+0x54c04)
        #1 0x102ada0ec in rb_gc_impl_malloc default.c:8198
        #2 0x102acee44 in ruby_xmalloc gc.c:4438
        #3 0x102f3c85c in rb_st_init_table_with_size st.c:571
        #4 0x102f3c900 in rb_st_init_table st.c:600
        #5 0x102f3c920 in rb_st_init_numtable st.c:608
        #6 0x103140698 in vm_track_constant_cache vm_insnhelper.c:6337
        #7 0x1030b91d8 in vm_ic_track_const_chain vm_insnhelper.c:6356
        #8 0x1030b8cf8 in rb_vm_opt_getconstant_path vm_insnhelper.c:6424
        #9 0x1030bc1e0 in vm_exec_core insns.def:263
        #10 0x1030b55fc in rb_vm_exec vm.c:2585
        #11 0x1030fe0ac in rb_iseq_eval_main vm.c:2851
        #12 0x102a82588 in rb_ec_exec_node eval.c:281
        #13 0x102a81fe0 in ruby_run_node eval.c:319
        #14 0x1027f3db4 in rb_main main.c:43
        #15 0x1027f3bd4 in main main.c:68
        #16 0x183900270  (&lt;unknown module&gt;)

This commit fixes this bug by adding a inserting_constant_cache_id field
to the VM, which stores the ID that is currently being inserted and, in
remove_from_constant_cache, we don't free the ST table for ID equal to
this one.

Co-Authored-By: Alan Wu &lt;alanwu@ruby-lang.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
[Bug #20921]

When we create a cache entry for a constant, the following sequence of
events could happen:

- vm_track_constant_cache is called to insert a constant cache.
- In vm_track_constant_cache, we first look up the ST table for the ID
  of the constant. Assume the ST table exists because another iseq also
  holds a cache entry for this ID.
- We then insert into this ST table with the iseq_inline_constant_cache.
- However, while inserting into this ST table, it allocates memory, which
  could trigger a GC. Assume that it does trigger a GC.
- The GC frees the one and only other iseq that holds a cache entry for
  this ID.
- In remove_from_constant_cache, it will appear that the ST table is now
  empty because there are no more iseq with cache entries for this ID, so
  we free the ST table.
- We complete GC and continue our st_insert. However, this ST table has
  been freed so we now have a use-after-free.

This issue is very hard to reproduce, because it requires that the GC runs
at a very specific time. However, we can make it show up by applying this
patch which runs GC right before the st_insert to mimic the st_insert
triggering a GC:

    diff --git a/vm_insnhelper.c b/vm_insnhelper.c
    index 3cb23f06f0..a93998136a 100644
    --- a/vm_insnhelper.c
    +++ b/vm_insnhelper.c
    @@ -6338,6 +6338,10 @@ vm_track_constant_cache(ID id, void *ic)
            rb_id_table_insert(const_cache, id, (VALUE)ics);
        }

    +    if (id == rb_intern("MyConstant")) rb_gc();
    +
        st_insert(ics, (st_data_t) ic, (st_data_t) Qtrue);
    }

And if we run this script:

    Object.const_set("MyConstant", "Hello!")

    my_proc = eval("-&gt; { MyConstant }")
    my_proc.call

    my_proc = eval("-&gt; { MyConstant }")
    my_proc.call

We can see that ASAN outputs a use-after-free error:

    ==36540==ERROR: AddressSanitizer: heap-use-after-free on address 0x606000049528 at pc 0x000102f3ceac bp 0x00016d607a70 sp 0x00016d607a68
    READ of size 8 at 0x606000049528 thread T0
        #0 0x102f3cea8 in do_hash st.c:321
        #1 0x102f3ddd0 in rb_st_insert st.c:1132
        #2 0x103140700 in vm_track_constant_cache vm_insnhelper.c:6345
        #3 0x1030b91d8 in vm_ic_track_const_chain vm_insnhelper.c:6356
        #4 0x1030b8cf8 in rb_vm_opt_getconstant_path vm_insnhelper.c:6424
        #5 0x1030bc1e0 in vm_exec_core insns.def:263
        #6 0x1030b55fc in rb_vm_exec vm.c:2585
        #7 0x1030fe0ac in rb_iseq_eval_main vm.c:2851
        #8 0x102a82588 in rb_ec_exec_node eval.c:281
        #9 0x102a81fe0 in ruby_run_node eval.c:319
        #10 0x1027f3db4 in rb_main main.c:43
        #11 0x1027f3bd4 in main main.c:68
        #12 0x183900270  (&lt;unknown module&gt;)

    0x606000049528 is located 8 bytes inside of 56-byte region [0x606000049520,0x606000049558)
    freed by thread T0 here:
        #0 0x104174d40 in free+0x98 (libclang_rt.asan_osx_dynamic.dylib:arm64e+0x54d40)
        #1 0x102ada89c in rb_gc_impl_free default.c:8183
        #2 0x102ada7dc in ruby_sized_xfree gc.c:4507
        #3 0x102ac4d34 in ruby_xfree gc.c:4518
        #4 0x102f3cb34 in rb_st_free_table st.c:663
        #5 0x102bd52d8 in remove_from_constant_cache iseq.c:119
        #6 0x102bbe2cc in iseq_clear_ic_references iseq.c:153
        #7 0x102bbd2a0 in rb_iseq_free iseq.c:166
        #8 0x102b32ed0 in rb_imemo_free imemo.c:564
        #9 0x102ac4b44 in rb_gc_obj_free gc.c:1407
        #10 0x102af4290 in gc_sweep_plane default.c:3546
        #11 0x102af3bdc in gc_sweep_page default.c:3634
        #12 0x102aeb140 in gc_sweep_step default.c:3906
        #13 0x102aeadf0 in gc_sweep_rest default.c:3978
        #14 0x102ae4714 in gc_sweep default.c:4155
        #15 0x102af8474 in gc_start default.c:6484
        #16 0x102afbe30 in garbage_collect default.c:6363
        #17 0x102ad37f0 in rb_gc_impl_start default.c:6816
        #18 0x102ad3634 in rb_gc gc.c:3624
        #19 0x1031406ec in vm_track_constant_cache vm_insnhelper.c:6342
        #20 0x1030b91d8 in vm_ic_track_const_chain vm_insnhelper.c:6356
        #21 0x1030b8cf8 in rb_vm_opt_getconstant_path vm_insnhelper.c:6424
        #22 0x1030bc1e0 in vm_exec_core insns.def:263
        #23 0x1030b55fc in rb_vm_exec vm.c:2585
        #24 0x1030fe0ac in rb_iseq_eval_main vm.c:2851
        #25 0x102a82588 in rb_ec_exec_node eval.c:281
        #26 0x102a81fe0 in ruby_run_node eval.c:319
        #27 0x1027f3db4 in rb_main main.c:43
        #28 0x1027f3bd4 in main main.c:68
        #29 0x183900270  (&lt;unknown module&gt;)

    previously allocated by thread T0 here:
        #0 0x104174c04 in malloc+0x94 (libclang_rt.asan_osx_dynamic.dylib:arm64e+0x54c04)
        #1 0x102ada0ec in rb_gc_impl_malloc default.c:8198
        #2 0x102acee44 in ruby_xmalloc gc.c:4438
        #3 0x102f3c85c in rb_st_init_table_with_size st.c:571
        #4 0x102f3c900 in rb_st_init_table st.c:600
        #5 0x102f3c920 in rb_st_init_numtable st.c:608
        #6 0x103140698 in vm_track_constant_cache vm_insnhelper.c:6337
        #7 0x1030b91d8 in vm_ic_track_const_chain vm_insnhelper.c:6356
        #8 0x1030b8cf8 in rb_vm_opt_getconstant_path vm_insnhelper.c:6424
        #9 0x1030bc1e0 in vm_exec_core insns.def:263
        #10 0x1030b55fc in rb_vm_exec vm.c:2585
        #11 0x1030fe0ac in rb_iseq_eval_main vm.c:2851
        #12 0x102a82588 in rb_ec_exec_node eval.c:281
        #13 0x102a81fe0 in ruby_run_node eval.c:319
        #14 0x1027f3db4 in rb_main main.c:43
        #15 0x1027f3bd4 in main main.c:68
        #16 0x183900270  (&lt;unknown module&gt;)

This commit fixes this bug by adding a inserting_constant_cache_id field
to the VM, which stores the ID that is currently being inserted and, in
remove_from_constant_cache, we don't free the ST table for ID equal to
this one.

Co-Authored-By: Alan Wu &lt;alanwu@ruby-lang.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>Avoid an operation on a pointer after free</title>
<updated>2024-11-28T05:49:37+00:00</updated>
<author>
<name>Yusuke Endoh</name>
<email>mame@ruby-lang.org</email>
</author>
<published>2024-11-28T04:57:56+00:00</published>
<link rel='alternate' type='text/html' href='https://git.ruby-lang.org/ruby.git/commit/?id=38f76cb57a3829653c0dbfc9b6c51d3501b92ca1'/>
<id>38f76cb57a3829653c0dbfc9b6c51d3501b92ca1</id>
<content type='text'>
A follow-up to ef59175a68c448fe334125824b477a9e1d5629bc. That commit
uses `&amp;body-&gt;local_table[...]` but `body-&gt;local_table` is already freed.
I think it is an undefined behavior to calculate a pointer that exceeds
the bound by more than 1.

This change moves the free of `body-&gt;local_table` after the calculation.

Coverity Scan found this issue.
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
A follow-up to ef59175a68c448fe334125824b477a9e1d5629bc. That commit
uses `&amp;body-&gt;local_table[...]` but `body-&gt;local_table` is already freed.
I think it is an undefined behavior to calculate a pointer that exceeds
the bound by more than 1.

This change moves the free of `body-&gt;local_table` after the calculation.

Coverity Scan found this issue.
</pre>
</div>
</content>
</entry>
<entry>
<title>Move Array#map to Ruby</title>
<updated>2024-11-13T20:27:26+00:00</updated>
<author>
<name>Takashi Kokubun</name>
<email>takashikkbn@gmail.com</email>
</author>
<published>2024-11-13T04:47:48+00:00</published>
<link rel='alternate' type='text/html' href='https://git.ruby-lang.org/ruby.git/commit/?id=01db456196e17eb067f70eb1d4fceba143a51c01'/>
<id>01db456196e17eb067f70eb1d4fceba143a51c01</id>
<content type='text'>
Co-Authored-By: Aaron Patterson &lt;tenderlove@ruby-lang.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Co-Authored-By: Aaron Patterson &lt;tenderlove@ruby-lang.org&gt;
</pre>
</div>
</content>
</entry>
</feed>
