Introduce rb_gc_remove_weak

If we're during incremental marking, then Ruby code can execute that
deallocates certain memory buffers that have been called with
rb_gc_mark_weak, which can cause use-after-free bugs.

1 files changed, 6 insertions, 1 deletions

diff --git a/weakmap.c b/weakmap.c
index 92aed105b1..d79f5b3f94 100644
--- a/weakmap.c
+++ b/weakmap.c
@@ -380,7 +380,7 @@ wmap_aset_replace(st_data_t *key, st_data_t *val, st_data_t new_key_ptr, int exi
     VALUE new_val = *(((VALUE *)new_key_ptr) + 1);
 
     if (existing) {
-        assert(orig_pair[0] == *(VALUE *)new_key);
+        assert(*(VALUE *)*key == new_key);
     }
     else {
         VALUE *pair = xmalloc(sizeof(VALUE) * 2);
@@ -450,6 +450,9 @@ wmap_delete(VALUE self, VALUE key)
     if (st_delete(w->table, &orig_key_data, &orig_val_data)) {
         VALUE orig_val = *(VALUE *)orig_val_data;
 
+        rb_gc_remove_weak(self, (VALUE *)orig_key_data);
+        rb_gc_remove_weak(self, (VALUE *)orig_val_data);
+
         wmap_free_entry((VALUE *)orig_key_data, (VALUE *)orig_val_data);
 
         if (wmap_live_p(orig_val)) {
@@ -776,6 +779,8 @@ wkmap_delete(VALUE self, VALUE key)
     if (st_delete(w->table, &orig_key_data, &orig_val_data)) {
         VALUE orig_val = (VALUE)orig_val_data;
 
+        rb_gc_remove_weak(self, (VALUE *)orig_key_data);
+
         ruby_sized_xfree((VALUE *)orig_key_data, sizeof(VALUE));
 
         return orig_val;