* proc.c (struct METHOD), gc.c (gc_marks), vm_method.c

  (rb_gc_mark_unlinked_live_method_entries): fix SEGV bug.
  rb_method_entry_t was free'd even when the method is still on the
  stack if it is BMETHOD (i.e., Method#call).  This is because
  rb_method_entry_t is embedded in struct METHOD.  This commit
  separates them and marks the live method entries.
  See [ruby-core:38449] in detail.  fix [Bug #5047] [ruby-core:38171]

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@32669 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

1 files changed, 29 insertions, 27 deletions

diff --git a/proc.c b/proc.c
index 46296cc4c8..a45ebeaae4 100644
--- a/proc.c
+++ b/proc.c
@@ -18,7 +18,7 @@ struct METHOD {
     VALUE recv;
     VALUE rclass;
     ID id;
-    rb_method_entry_t me;
+    rb_method_entry_t *me;
 };
 
 VALUE rb_cUnboundMethod;
@@ -861,18 +861,14 @@ bm_mark(void *ptr)
     struct METHOD *data = ptr;
     rb_gc_mark(data->rclass);
     rb_gc_mark(data->recv);
-    rb_mark_method_entry(&data->me);
+    if (data->me) rb_mark_method_entry(data->me);
 }
 
 static void
 bm_free(void *ptr)
 {
     struct METHOD *data = ptr;
-    rb_method_definition_t *def = data->me.def;
-    if (def->alias_count == 0)
-	xfree(def);
-    else if (def->alias_count > 0)
-	def->alias_count--;
+    rb_unlink_method_entry(data->me);
     xfree(ptr);
 }
 
@@ -978,8 +974,9 @@ mnew(VALUE klass, VALUE obj, ID id, VALUE mclass, int scope)
     data->recv = obj;
     data->rclass = rclass;
     data->id = rid;
-    data->me = *me;
-    if (def) def->alias_count++;
+    data->me = ALLOC(rb_method_entry_t);
+    *data->me = *me;
+    data->me->def->alias_count++;
 
     OBJ_INFECT(method, klass);
 
@@ -1033,7 +1030,7 @@ method_eq(VALUE method, VALUE other)
     m1 = (struct METHOD *)DATA_PTR(method);
     m2 = (struct METHOD *)DATA_PTR(other);
 
-    if (!rb_method_entry_eq(&m1->me, &m2->me) ||
+    if (!rb_method_entry_eq(m1->me, m2->me) ||
 	m1->rclass != m2->rclass ||
 	m1->recv != m2->recv) {
 	return Qfalse;
@@ -1058,7 +1055,7 @@ method_hash(VALUE method)
     TypedData_Get_Struct(method, struct METHOD, &method_data_type, m);
     hash = rb_hash_start((st_index_t)m->rclass);
     hash = rb_hash_uint(hash, (st_index_t)m->recv);
-    hash = rb_hash_uint(hash, (st_index_t)m->me.def);
+    hash = rb_hash_uint(hash, (st_index_t)m->me->def);
     hash = rb_hash_end(hash);
 
     return INT2FIX(hash);
@@ -1084,8 +1081,9 @@ method_unbind(VALUE obj)
 				   &method_data_type, data);
     data->recv = Qundef;
     data->id = orig->id;
-    data->me = orig->me;
-    if (orig->me.def) orig->me.def->alias_count++;
+    data->me = ALLOC(rb_method_entry_t);
+    *data->me = *orig->me;
+    if (orig->me->def) orig->me->def->alias_count++;
     data->rclass = orig->rclass;
     OBJ_INFECT(method, obj);
 
@@ -1137,7 +1135,7 @@ method_owner(VALUE obj)
     struct METHOD *data;
 
     TypedData_Get_Struct(obj, struct METHOD, &method_data_type, data);
-    return data->me.klass;
+    return data->me->klass;
 }
 
 static void
@@ -1351,7 +1349,7 @@ rb_mod_define_method(int argc, VALUE *argv, VALUE mod)
 			 rb_class2name(rclass));
 	    }
 	}
-	rb_method_entry_set(mod, id, &method->me, noex);
+	rb_method_entry_set(mod, id, method->me, noex);
     }
     else if (rb_obj_is_proc(body)) {
 	rb_proc_t *proc;
@@ -1422,7 +1420,9 @@ method_clone(VALUE self)
     clone = TypedData_Make_Struct(CLASS_OF(self), struct METHOD, &method_data_type, data);
     CLONESETUP(clone, self);
     *data = *orig;
-    if (data->me.def) data->me.def->alias_count++;
+    data->me = ALLOC(rb_method_entry_t);
+    *data->me = *orig->me;
+    if (data->me->def) data->me->def->alias_count++;
 
     return clone;
 }
@@ -1463,7 +1463,7 @@ rb_method_call(int argc, VALUE *argv, VALUE method)
 	rb_thread_t *th = GET_THREAD();
 
 	PASS_PASSED_BLOCK_TH(th);
-	result = rb_vm_call(th, data->recv, data->id,  argc, argv, &data->me);
+	result = rb_vm_call(th, data->recv, data->id,  argc, argv, data->me);
     }
     POP_TAG();
     if (safe >= 0)
@@ -1584,7 +1584,9 @@ umethod_bind(VALUE method, VALUE recv)
 
     method = TypedData_Make_Struct(rb_cMethod, struct METHOD, &method_data_type, bound);
     *bound = *data;
-    if (bound->me.def) bound->me.def->alias_count++;
+    bound->me = ALLOC(rb_method_entry_t);
+    *bound->me = *data->me;
+    if (bound->me->def) bound->me->def->alias_count++;
     bound->recv = recv;
     bound->rclass = CLASS_OF(recv);
 
@@ -1681,7 +1683,7 @@ method_arity(VALUE method)
     struct METHOD *data;
 
     TypedData_Get_Struct(method, struct METHOD, &method_data_type, data);
-    return rb_method_entry_arity(&data->me);
+    return rb_method_entry_arity(data->me);
 }
 
 int
@@ -1703,7 +1705,7 @@ method_get_def(VALUE method)
     struct METHOD *data;
 
     TypedData_Get_Struct(method, struct METHOD, &method_data_type, data);
-    return data->me.def;
+    return data->me->def;
 }
 
 static rb_iseq_t *
@@ -1786,11 +1788,11 @@ method_inspect(VALUE method)
     rb_str_buf_cat2(str, s);
     rb_str_buf_cat2(str, ": ");
 
-    if (FL_TEST(data->me.klass, FL_SINGLETON)) {
-	VALUE v = rb_ivar_get(data->me.klass, attached);
+    if (FL_TEST(data->me->klass, FL_SINGLETON)) {
+	VALUE v = rb_ivar_get(data->me->klass, attached);
 
 	if (data->recv == Qundef) {
-	    rb_str_buf_append(str, rb_inspect(data->me.klass));
+	    rb_str_buf_append(str, rb_inspect(data->me->klass));
 	}
 	else if (data->recv == v) {
 	    rb_str_buf_append(str, rb_inspect(v));
@@ -1806,15 +1808,15 @@ method_inspect(VALUE method)
     }
     else {
 	rb_str_buf_cat2(str, rb_class2name(data->rclass));
-	if (data->rclass != data->me.klass) {
+	if (data->rclass != data->me->klass) {
 	    rb_str_buf_cat2(str, "(");
-	    rb_str_buf_cat2(str, rb_class2name(data->me.klass));
+	    rb_str_buf_cat2(str, rb_class2name(data->me->klass));
 	    rb_str_buf_cat2(str, ")");
 	}
     }
     rb_str_buf_cat2(str, sharp);
-    rb_str_append(str, rb_id2str(data->me.def->original_id));
-    if (data->me.def->type == VM_METHOD_TYPE_NOTIMPLEMENTED) {
+    rb_str_append(str, rb_id2str(data->me->def->original_id));
+    if (data->me->def->type == VM_METHOD_TYPE_NOTIMPLEMENTED) {
         rb_str_buf_cat2(str, " (not-implemented)");
     }
     rb_str_buf_cat2(str, ">");