Fixed heap-use-after-free on racter

2 files changed, 11 insertions, 0 deletions

diff --git a/gc.c b/gc.c
index 99c79fe10c..69cc2ba361 100644
--- a/gc.c
+++ b/gc.c
@@ -3597,6 +3597,8 @@ force_chain_object(st_data_t key, st_data_t val, st_data_t arg)
     return ST_CONTINUE;
 }
 
+bool rb_obj_is_main_ractor(VALUE gv);
+
 void
 rb_objspace_call_finalizer(rb_objspace_t *objspace)
 {
@@ -3652,6 +3654,7 @@ rb_objspace_call_finalizer(rb_objspace_t *objspace)
                 if (rb_obj_is_thread(vp)) break;
                 if (rb_obj_is_mutex(vp)) break;
                 if (rb_obj_is_fiber(vp)) break;
+                if (rb_obj_is_main_ractor(vp)) break;
                 if (RTYPEDDATA_P(vp)) {
 		    RDATA(p)->dfree = RANY(p)->as.typeddata.type->function.dfree;
 		}
diff --git a/ractor.c b/ractor.c
index 9a8146e3d8..5ea02570d0 100644
--- a/ractor.c
+++ b/ractor.c
@@ -1434,6 +1434,14 @@ rb_ractor_main_p_(void)
     return rb_ec_ractor_ptr(ec) == rb_ec_vm_ptr(ec)->ractor.main_ractor;
 }
 
+bool
+rb_obj_is_main_ractor(VALUE gv)
+{
+    if (!rb_ractor_p(gv)) return false;
+    rb_ractor_t *r = DATA_PTR(gv);
+    return r == GET_VM()->ractor.main_ractor;
+}
+
 rb_global_vm_lock_t *
 rb_ractor_gvl(rb_ractor_t *r)
 {