rb_vm_search_method_slowpath: skip vm_empty_cc

Now that vm_empty_cc is statically allocated outside of the object
space.  It shall not be GCed.  Here, because vm_search_cc can return
that.  Must not be blindly passed to RB_OBJ_WRITE, unless assertions
fail on RGENGC_CHECK_MODE, like this:

-- C level backtrace information
-------------------------------------------
ruby(rb_print_backtrace+0x19) [0x5555557fd579] vm_dump.c:757
ruby(rb_vm_bugreport+0x151) [0x5555557fd6f1] vm_dump.c:955
ruby(rb_bug+0x1d6) [0x5555558d6396] error.c:660
ruby(check_rvalue_consistency_force+0x707) [0x5555555adb97] gc.c:1289
ruby(check_rvalue_consistency+0x1a) [0x555555598a0a] gc.c:1305
ruby(RVALUE_OLD_P+0x15) [0x5555555975d5] gc.c:1382
ruby(rb_gc_writebarrier+0x9f) [0x55555559753f] gc.c:6882
ruby(rb_obj_written+0x3a) [0x5555557a025a] include/ruby/internal/rgengc.h:180
ruby(rb_obj_write+0x41) [0x5555557a1a81] include/ruby/internal/rgengc.h:195
ruby(rb_vm_search_method_slowpath+0x5a) [0x5555557a125a] vm_insnhelper.c:1603
ruby(vm_search_method_fastpath+0x197) [0x5555557d8027] vm_insnhelper.c:1638
ruby(vm_search_method+0xea) [0x5555557d7d2a] vm_insnhelper.c:1650
ruby(vm_search_method_wrap+0x29) [0x5555557dbaf9] vm_insnhelper.c:4091
ruby(vm_sendish+0xa9) [0x5555557dba39] vm_insnhelper.c:4143
ruby(vm_exec_core+0xe357) [0x5555557b0757] insns.def:801
ruby(rb_vm_exec+0x12c) [0x5555557d17cc] vm.c:1942
ruby(invoke_block+0xea) [0x5555557f42fa] vm.c:1058
ruby(invoke_iseq_block_from_c+0x16e) [0x5555557f3eae] vm.c:1130
ruby(invoke_block_from_c_bh) vm.c:1148
ruby(vm_yield+0x71) [0x5555557f3c41] vm.c:1193
ruby(rb_yield_0+0x25) [0x5555557ca615] vm_eval.c:1141
ruby(rb_yield_1+0x27) [0x5555557ca5c7] vm_eval.c:1147
ruby(rb_yield+0x34) [0x5555557ca654] vm_eval.c:1157
ruby(rb_ary_collect+0xb0) [0x555555828320] array.c:3186
ruby(call_cfunc_0+0x29) [0x5555557f0f39] vm_insnhelper.c:2385
ruby(vm_call_cfunc_with_frame+0x278) [0x5555557eca98] vm_insnhelper.c:2553
ruby(vm_sendish+0xd0) [0x5555557dba60] vm_insnhelper.c:4146
ruby(vm_exec_core+0xe0f8) [0x5555557b04f8] insns.def:782
ruby(rb_vm_exec+0x12c) [0x5555557d17cc] vm.c:1942
ruby(invoke_block+0xea) [0x5555557f42fa] vm.c:1058
ruby(invoke_iseq_block_from_c+0x16e) [0x5555557f3eae] vm.c:1130
ruby(invoke_block_from_c_bh) vm.c:1148
ruby(vm_yield+0x71) [0x5555557f3c41] vm.c:1193
ruby(rb_yield_0+0x25) [0x5555557ca615] vm_eval.c:1141
ruby(rb_yield_1+0x27) [0x5555557ca5c7] vm_eval.c:1147
ruby(rb_yield+0x34) [0x5555557ca654] vm_eval.c:1157
ruby(rb_ary_each+0xa5) [0x55555581c795] array.c:2242
ruby(call_cfunc_0+0x29) [0x5555557f0f39] vm_insnhelper.c:2385
ruby(vm_call_cfunc_with_frame+0x278) [0x5555557eca98] vm_insnhelper.c:2553
ruby(vm_sendish+0xd0) [0x5555557dba60] vm_insnhelper.c:4146
ruby(vm_exec_core+0xe0f8) [0x5555557b04f8] insns.def:782
ruby(rb_vm_exec+0x12c) [0x5555557d17cc] vm.c:1942
ruby(invoke_block+0xea) [0x5555557f42fa] vm.c:1058
ruby(invoke_iseq_block_from_c+0x16e) [0x5555557f3eae] vm.c:1130
ruby(invoke_block_from_c_bh) vm.c:1148
ruby(vm_yield+0x71) [0x5555557f3c41] vm.c:1193
ruby(rb_yield_0+0x25) [0x5555557ca615] vm_eval.c:1141
ruby(rb_yield_1+0x27) [0x5555557ca5c7] vm_eval.c:1147
ruby(rb_yield+0x34) [0x5555557ca654] vm_eval.c:1157
ruby(rb_ary_each+0xa5) [0x55555581c795] array.c:2242
ruby(call_cfunc_0+0x29) [0x5555557f0f39] vm_insnhelper.c:2385
ruby(vm_call_cfunc_with_frame+0x278) [0x5555557eca98] vm_insnhelper.c:2553
ruby(vm_sendish+0xd0) [0x5555557dba60] vm_insnhelper.c:4146
ruby(vm_exec_core+0xe0f8) [0x5555557b04f8] insns.def:782
ruby(rb_vm_exec+0x19f) [0x5555557d183f] vm.c:1951
ruby(rb_iseq_eval+0x30) [0x5555557d2530] vm.c:2190
ruby(load_iseq_eval+0xd6) [0x5555555fa7e6] load.c:592
ruby(require_internal+0x25e) [0x5555555f7f5e] load.c:1022
ruby(rb_require_string+0x27) [0x5555555f74e7] load.c:1094
ruby(rb_f_require_relative+0x5f) [0x5555555f758f] load.c:837
ruby(call_cfunc_1+0x30) [0x5555557f0f70] vm_insnhelper.c:2391
ruby(vm_call_cfunc_with_frame+0x278) [0x5555557eca98] vm_insnhelper.c:2553
ruby(vm_call_cfunc+0xad) [0x5555557e521d] vm_insnhelper.c:2574
ruby(vm_call_method_each_type+0xc7) [0x5555557e4af7] vm_insnhelper.c:3040
ruby(vm_call_method+0x19c) [0x5555557e45dc] vm_insnhelper.c:3144
ruby(vm_call_general+0x2d) [0x5555557c8c3d] vm_insnhelper.c:3176
ruby(vm_sendish+0xd0) [0x5555557dba60] vm_insnhelper.c:4146
ruby(vm_exec_core+0xe357) [0x5555557b0757] insns.def:801
ruby(rb_vm_exec+0x12c) [0x5555557d17cc] vm.c:1942
ruby(rb_iseq_eval_main+0x30) [0x5555557d2670] vm.c:2201
ruby(rb_ec_exec_node+0x16b) [0x55555557e39b] eval.c:296
ruby(ruby_run_node+0x72) [0x55555557e1f2] eval.c:354
ruby(main+0x78) [0x55555557a5d8] main.c:50

1 files changed, 10 insertions, 3 deletions

diff --git a/vm_insnhelper.c b/vm_insnhelper.c
index 5cb7f1687c..8b44a44420 100644
--- a/vm_insnhelper.c
+++ b/vm_insnhelper.c
@@ -1603,12 +1603,19 @@ rb_vm_search_method_slowpath(VALUE cd_owner, struct rb_call_data *cd, VALUE klas
 {
     const struct rb_callcache *cc = vm_search_cc(klass, cd->ci);
 
-    if (cd_owner) {
-        RB_OBJ_WRITE(cd_owner, &cd->cc, cc);
+    VM_ASSERT(cc);
+    VM_ASSERT(IMEMO_TYPE_P(cc, imemo_callcache));
+
+    if (! cd_owner) {
+        cd->cc = cc;
     }
-    else {
+    else if (cc == &vm_empty_cc) {
         cd->cc = cc;
     }
+    else {
+        VM_ASSERT(vm_cc_markable(cc));
+        RB_OBJ_WRITE(cd_owner, &cd->cc, cc);
+    }
 
     VM_ASSERT(cc == vm_cc_empty() || cc->klass == klass);
     VM_ASSERT(cc == vm_cc_empty() || callable_method_entry_p(vm_cc_cme(cc)));