summaryrefslogtreecommitdiff
path: root/test/ruby
AgeCommit message (Collapse)Author
2024-11-04merge revision(s) 6118e8a47394409b53164b60e79fadf348b97db3: [Backport #20716]Takashi Kokubun
Fix method caching bug when including/prepend module A that prepends module B Fix by always adding the generated iclass to the subclasses list, otherwise the method cache for the iclass is not cleared when the method in the module is overwritten. Fixes [Bug #20716]
2024-11-04merge revision(s) 35e124832e29b65c84d4e0e4e434616859f9bdf5: [Backport #20755]Takashi Kokubun
[Bug #20755] Frozen string should not be writable via IO::Buffer
2024-11-04merge revision(s) 637067440f74043c6d79fc649ab8acf1afea25a5: [Backport #20752]Takashi Kokubun
[Bug #20752] Slice of readonly `IO::Buffer` also should be readonly
2024-11-04merge revision(s) c1862cbb89a6bf42dcd07d92fe4f4bfeebca5775: [Backport #20719]Takashi Kokubun
[Bug #20719] `Float` argument must be ASCII compatible
2024-11-04merge revision(s) d33e3d47b84a73b38644f2a3d41881ce9be6ef18: [Backport #20704]Takashi Kokubun
[Bug #20704] Win32: Fix chdir to non-ASCII path On Windows, `chdir` in compilers' runtime libraries uses the active code page, but command line arguments in ruby are always UTF-8, since commit:33ea2646b98adb49ae2e1781753bf22d33729ac0.
2024-11-04merge revision(s) 76ea5cde2a0f4834a5228104249b6b3346ddfc94: [Backport #20777]Takashi Kokubun
Refactor RUBY_DESCRIPTION assertions in test_rubyoptions
2024-09-02merge revision(s) a3562c2a0abf1c2bdd1d50377b4f929580782594: [Backport #20701]Takashi Kokubun
Remove incorrect setting of KW_SPLAT_MUT flag Fixes [Bug #20701] Co-authored-by: Pablo Herrero <pablodherrero@gmail.com>
2024-09-02merge revision(s) 992596fb7af18a7f472589a607d0eb3fbb03b49a: [Backport #20344]Takashi Kokubun
Fix next inside block argument stack underflow [Bug #20344] Fix compile_next adding removable adjust label
2024-09-02merge revision(s) 1870505f478cc75993b296b7144a45137ace6937: [Backport #20651]Takashi Kokubun
Fix wrong unreachable chunk remove when jump destination label is unremovable
2024-08-23[Backport 3.3] [Bug #20691] Fix use-after-free in WeakKeyMap#clear (#11443)Peter Zhu
Fix use-after-free in WeakKeyMap#clear [Bug #20691] If the WeakKeyMap has been marked but sweeping hasn't started yet and we cann WeakKeyMap#clear, then there could be a use-after-free because we do not call rb_gc_remove_weak to remove the key from the GC. For example, the following code triggers use-after-free errors in Valgrind: map = ObjectSpace::WeakKeyMap.new 1_000.times do 1_000.times do map[Object.new] = nil end map.clear end Output from Valgrind: ==61230== Invalid read of size 8 ==61230== at 0x25CAF8: gc_update_weak_references (default.c:5593) ==61230== by 0x25CAF8: gc_marks_finish (default.c:5641) ==61230== by 0x26031C: gc_marks_continue (default.c:5987) ==61230== by 0x26031C: gc_continue (default.c:2255) ==61230== by 0x2605FC: newobj_cache_miss (default.c:2589) ==61230== by 0x26111F: newobj_alloc (default.c:2622) ==61230== by 0x26111F: rb_gc_impl_new_obj (default.c:2701) ==61230== by 0x26111F: newobj_of (gc.c:890) ==61230== by 0x26111F: rb_wb_protected_newobj_of (gc.c:917) ==61230== by 0x2DE218: rb_class_allocate_instance (object.c:131) ==61230== by 0x2E32A8: class_call_alloc_func (object.c:2141) ==61230== by 0x2E32A8: rb_class_alloc (object.c:2113) ==61230== by 0x2E32A8: rb_class_new_instance_pass_kw (object.c:2172) ==61230== by 0x4296BC: vm_call_cfunc_with_frame_ (vm_insnhelper.c:3788) ==61230== by 0x44A9CD: vm_sendish (vm_insnhelper.c:5955) ==61230== by 0x44A9CD: vm_exec_core (insns.def:898) ==61230== by 0x43A0E4: rb_vm_exec (vm.c:2564) ==61230== by 0x2341B4: rb_ec_exec_node (eval.c:281) ==61230== by 0x236258: ruby_run_node (eval.c:319) ==61230== by 0x15D665: rb_main (main.c:43) ==61230== by 0x15D665: main (main.c:62) ==61230== Address 0x2159cb00 is 0 bytes inside a block of size 8 free'd ==61230== at 0x4849B2C: free (vg_replace_malloc.c:989) ==61230== by 0x248EF1: rb_gc_impl_free (default.c:8512) ==61230== by 0x248EF1: rb_gc_impl_free (default.c:8493) ==61230== by 0x248EF1: ruby_sized_xfree.constprop.0 (gc.c:4178) ==61230== by 0x4627EC: wkmap_free_table_i (weakmap.c:652) ==61230== by 0x3A54AF: apply_functor (st.c:1633) ==61230== by 0x3A54AF: st_general_foreach (st.c:1543) ==61230== by 0x3A54AF: rb_st_foreach (st.c:1640) ==61230== by 0x46203C: wkmap_clear (weakmap.c:973) ==61230== by 0x4296BC: vm_call_cfunc_with_frame_ (vm_insnhelper.c:3788) ==61230== by 0x44A9CD: vm_sendish (vm_insnhelper.c:5955) ==61230== by 0x44A9CD: vm_exec_core (insns.def:898) ==61230== by 0x43A0E4: rb_vm_exec (vm.c:2564) ==61230== by 0x2341B4: rb_ec_exec_node (eval.c:281) ==61230== by 0x236258: ruby_run_node (eval.c:319) ==61230== by 0x15D665: rb_main (main.c:43) ==61230== by 0x15D665: main (main.c:62) ==61230== Block was alloc'd at ==61230== at 0x484680F: malloc (vg_replace_malloc.c:446) ==61230== by 0x25C68E: rb_gc_impl_malloc (default.c:8527) ==61230== by 0x4622E9: wkmap_aset_replace (weakmap.c:817) ==61230== by 0x3A4D02: rb_st_update (st.c:1487) ==61230== by 0x4623E4: wkmap_aset (weakmap.c:854) ==61230== by 0x4296BC: vm_call_cfunc_with_frame_ (vm_insnhelper.c:3788) ==61230== by 0x44A9CD: vm_sendish (vm_insnhelper.c:5955) ==61230== by 0x44A9CD: vm_exec_core (insns.def:898) ==61230== by 0x43A0E4: rb_vm_exec (vm.c:2564) ==61230== by 0x2341B4: rb_ec_exec_node (eval.c:281) ==61230== by 0x236258: ruby_run_node (eval.c:319) ==61230== by 0x15D665: rb_main (main.c:43) ==61230== by 0x15D665: main (main.c:62) ==61230== ==61230== Invalid write of size 8 ==61230== at 0x25CB3B: gc_update_weak_references (default.c:5598) ==61230== by 0x25CB3B: gc_marks_finish (default.c:5641) ==61230== by 0x26031C: gc_marks_continue (default.c:5987) ==61230== by 0x26031C: gc_continue (default.c:2255) ==61230== by 0x2605FC: newobj_cache_miss (default.c:2589) ==61230== by 0x26111F: newobj_alloc (default.c:2622) ==61230== by 0x26111F: rb_gc_impl_new_obj (default.c:2701) ==61230== by 0x26111F: newobj_of (gc.c:890) ==61230== by 0x26111F: rb_wb_protected_newobj_of (gc.c:917) ==61230== by 0x2DE218: rb_class_allocate_instance (object.c:131) ==61230== by 0x2E32A8: class_call_alloc_func (object.c:2141) ==61230== by 0x2E32A8: rb_class_alloc (object.c:2113) ==61230== by 0x2E32A8: rb_class_new_instance_pass_kw (object.c:2172) ==61230== by 0x4296BC: vm_call_cfunc_with_frame_ (vm_insnhelper.c:3788) ==61230== by 0x44A9CD: vm_sendish (vm_insnhelper.c:5955) ==61230== by 0x44A9CD: vm_exec_core (insns.def:898) ==61230== by 0x43A0E4: rb_vm_exec (vm.c:2564) ==61230== by 0x2341B4: rb_ec_exec_node (eval.c:281) ==61230== by 0x236258: ruby_run_node (eval.c:319) ==61230== by 0x15D665: rb_main (main.c:43) ==61230== by 0x15D665: main (main.c:62) ==61230== Address 0x2159cb00 is 0 bytes inside a block of size 8 free'd ==61230== at 0x4849B2C: free (vg_replace_malloc.c:989) ==61230== by 0x248EF1: rb_gc_impl_free (default.c:8512) ==61230== by 0x248EF1: rb_gc_impl_free (default.c:8493) ==61230== by 0x248EF1: ruby_sized_xfree.constprop.0 (gc.c:4178) ==61230== by 0x4627EC: wkmap_free_table_i (weakmap.c:652) ==61230== by 0x3A54AF: apply_functor (st.c:1633) ==61230== by 0x3A54AF: st_general_foreach (st.c:1543) ==61230== by 0x3A54AF: rb_st_foreach (st.c:1640) ==61230== by 0x46203C: wkmap_clear (weakmap.c:973) ==61230== by 0x4296BC: vm_call_cfunc_with_frame_ (vm_insnhelper.c:3788) ==61230== by 0x44A9CD: vm_sendish (vm_insnhelper.c:5955) ==61230== by 0x44A9CD: vm_exec_core (insns.def:898) ==61230== by 0x43A0E4: rb_vm_exec (vm.c:2564) ==61230== by 0x2341B4: rb_ec_exec_node (eval.c:281) ==61230== by 0x236258: ruby_run_node (eval.c:319) ==61230== by 0x15D665: rb_main (main.c:43) ==61230== by 0x15D665: main (main.c:62) ==61230== Block was alloc'd at ==61230== at 0x484680F: malloc (vg_replace_malloc.c:446) ==61230== by 0x25C68E: rb_gc_impl_malloc (default.c:8527) ==61230== by 0x4622E9: wkmap_aset_replace (weakmap.c:817) ==61230== by 0x3A4D02: rb_st_update (st.c:1487) ==61230== by 0x4623E4: wkmap_aset (weakmap.c:854) ==61230== by 0x4296BC: vm_call_cfunc_with_frame_ (vm_insnhelper.c:3788) ==61230== by 0x44A9CD: vm_sendish (vm_insnhelper.c:5955) ==61230== by 0x44A9CD: vm_exec_core (insns.def:898) ==61230== by 0x43A0E4: rb_vm_exec (vm.c:2564) ==61230== by 0x2341B4: rb_ec_exec_node (eval.c:281) ==61230== by 0x236258: ruby_run_node (eval.c:319) ==61230== by 0x15D665: rb_main (main.c:43) ==61230== by 0x15D665: main (main.c:62) Co-authored-by: Jean Boussier <byroot@ruby-lang.org>
2024-08-22[Backport 3.3] [Bug #20688] Fix use-after-free for WeakMap and WeakKeyMap ↵Peter Zhu
(#11439) * Add struct weakmap_entry for WeakMap entries * Refactor wmap_foreach to pass weakmap_entry * Use wmap_foreach for wmap_mark * Refactor wmap_compact to use wmap_foreach * Remove wmap_free_entry * Fix WeakMap use-after-free [Bug #20688] We cannot free the weakmap_entry before the ST_DELETE because it could hash the key which would read the weakmap_entry and would cause a use-after-free. Instead, we store the entry and free it on the next iteration. For example, the following script triggers a use-after-free in Valgrind: weakmap = ObjectSpace::WeakMap.new 10_000.times { weakmap[Object.new] = Object.new } ==25795== Invalid read of size 8 ==25795== at 0x462297: wmap_cmp (weakmap.c:165) ==25795== by 0x3A2B1C: find_table_bin_ind (st.c:930) ==25795== by 0x3A5EAA: st_general_foreach (st.c:1599) ==25795== by 0x3A5EAA: rb_st_foreach (st.c:1640) ==25795== by 0x25C991: gc_mark_children (default.c:4870) ==25795== by 0x25C991: gc_marks_wb_unprotected_objects_plane (default.c:5565) ==25795== by 0x25C991: rgengc_rememberset_mark_plane (default.c:5557) ==25795== by 0x25C991: rgengc_rememberset_mark (default.c:6233) ==25795== by 0x25C991: gc_marks_start (default.c:6057) ==25795== by 0x25C991: gc_marks (default.c:6077) ==25795== by 0x25C991: gc_start (default.c:6723) ==25795== by 0x260F96: heap_prepare (default.c:2282) ==25795== by 0x260F96: heap_next_free_page (default.c:2489) ==25795== by 0x260F96: newobj_cache_miss (default.c:2598) ==25795== by 0x26197F: newobj_alloc (default.c:2622) ==25795== by 0x26197F: rb_gc_impl_new_obj (default.c:2701) ==25795== by 0x26197F: newobj_of (gc.c:890) ==25795== by 0x26197F: rb_wb_protected_newobj_of (gc.c:917) ==25795== by 0x2DEA88: rb_class_allocate_instance (object.c:131) ==25795== by 0x2E3B18: class_call_alloc_func (object.c:2141) ==25795== by 0x2E3B18: rb_class_alloc (object.c:2113) ==25795== by 0x2E3B18: rb_class_new_instance_pass_kw (object.c:2172) ==25795== by 0x429DDC: vm_call_cfunc_with_frame_ (vm_insnhelper.c:3786) ==25795== by 0x44B08D: vm_sendish (vm_insnhelper.c:5953) ==25795== by 0x44B08D: vm_exec_core (insns.def:898) ==25795== by 0x43A7A4: rb_vm_exec (vm.c:2564) ==25795== by 0x234914: rb_ec_exec_node (eval.c:281) ==25795== Address 0x21603710 is 0 bytes inside a block of size 16 free'd ==25795== at 0x4849B2C: free (vg_replace_malloc.c:989) ==25795== by 0x249651: rb_gc_impl_free (default.c:8527) ==25795== by 0x249651: rb_gc_impl_free (default.c:8508) ==25795== by 0x249651: ruby_sized_xfree.constprop.0 (gc.c:4178) ==25795== by 0x4626EC: ruby_sized_xfree_inlined (gc.h:277) ==25795== by 0x4626EC: wmap_free_entry (weakmap.c:45) ==25795== by 0x4626EC: wmap_mark_weak_table_i (weakmap.c:61) ==25795== by 0x3A5CEF: apply_functor (st.c:1633) ==25795== by 0x3A5CEF: st_general_foreach (st.c:1543) ==25795== by 0x3A5CEF: rb_st_foreach (st.c:1640) ==25795== by 0x25C991: gc_mark_children (default.c:4870) ==25795== by 0x25C991: gc_marks_wb_unprotected_objects_plane (default.c:5565) ==25795== by 0x25C991: rgengc_rememberset_mark_plane (default.c:5557) ==25795== by 0x25C991: rgengc_rememberset_mark (default.c:6233) ==25795== by 0x25C991: gc_marks_start (default.c:6057) ==25795== by 0x25C991: gc_marks (default.c:6077) ==25795== by 0x25C991: gc_start (default.c:6723) ==25795== by 0x260F96: heap_prepare (default.c:2282) ==25795== by 0x260F96: heap_next_free_page (default.c:2489) ==25795== by 0x260F96: newobj_cache_miss (default.c:2598) ==25795== by 0x26197F: newobj_alloc (default.c:2622) ==25795== by 0x26197F: rb_gc_impl_new_obj (default.c:2701) ==25795== by 0x26197F: newobj_of (gc.c:890) ==25795== by 0x26197F: rb_wb_protected_newobj_of (gc.c:917) ==25795== by 0x2DEA88: rb_class_allocate_instance (object.c:131) ==25795== by 0x2E3B18: class_call_alloc_func (object.c:2141) ==25795== by 0x2E3B18: rb_class_alloc (object.c:2113) ==25795== by 0x2E3B18: rb_class_new_instance_pass_kw (object.c:2172) ==25795== by 0x429DDC: vm_call_cfunc_with_frame_ (vm_insnhelper.c:3786) ==25795== by 0x44B08D: vm_sendish (vm_insnhelper.c:5953) ==25795== by 0x44B08D: vm_exec_core (insns.def:898) ==25795== by 0x43A7A4: rb_vm_exec (vm.c:2564) ==25795== Block was alloc'd at ==25795== at 0x484680F: malloc (vg_replace_malloc.c:446) ==25795== by 0x25CE9E: rb_gc_impl_malloc (default.c:8542) ==25795== by 0x462A39: wmap_aset_replace (weakmap.c:423) ==25795== by 0x3A5542: rb_st_update (st.c:1487) ==25795== by 0x462B8E: wmap_aset (weakmap.c:452) ==25795== by 0x429DDC: vm_call_cfunc_with_frame_ (vm_insnhelper.c:3786) ==25795== by 0x44B08D: vm_sendish (vm_insnhelper.c:5953) ==25795== by 0x44B08D: vm_exec_core (insns.def:898) ==25795== by 0x43A7A4: rb_vm_exec (vm.c:2564) ==25795== by 0x234914: rb_ec_exec_node (eval.c:281) ==25795== by 0x2369B8: ruby_run_node (eval.c:319) ==25795== by 0x15D675: rb_main (main.c:43) ==25795== by 0x15D675: main (main.c:62) * Fix use-after-free for WeakKeyMap [Bug #20688] We cannot free the key before the ST_DELETE because it could hash the key which would read the key and would cause a use-after-free. Instead, we store the key and free it on the next iteration.
2024-08-06parse.y: const_decl_path don't replace destination node by a literal (#11314)Jean byroot Boussier
[Bug #20668] The `dest` node is assumed to be a `CDECL`, so overwriting it with a `LIT` cause a crash on the next iteration. Co-authored-by: Jean Boussier <jean.boussier@gmail.com>
2024-07-30[Bug #20654] Fix floor and ceil when ndigits is large (#11277)Peter Zhu
* Fix floor when ndigits is large [Bug #20654] This commit fixes Integer#floor and Float#floor when the number is negative and ndigits is large such that 10**ndigits is a bignum. Previously, it would return 0 in such cases. However, this would cause unexpected behaviour such as: puts -1.floor(-5) # => -100000 puts -1.floor(-10) # => -10000000000 puts -1.floor(-20) # => 0 This commit changes the last result so that it will return -100000000000000000000. * Fix ceil when ndigits is large [Bug #20654] This commit fixes Integer#ceil and Float#ceil when the number is negative and ndigits is large such that 10**ndigits is a bignum. Previously, it would return 0 in such cases. However, this would cause unexpected behaviour such as: puts 1.ceil(-5) # => 100000 puts 1.ceil(-10) # => 10000000000 puts 1.ceil(-20) # => 0 This commit changes the last result so that it will return 100000000000000000000.
2024-07-29[Bug #20653] Fix memory leak in String#start_with? when regexp times out ↵Peter Zhu
(#11255) Fix memory leak in String#start_with? when regexp times out [Bug #20653] This commit refactors how Onigmo handles timeout. Instead of raising a timeout error, onig_search will return a ONIGERR_TIMEOUT which the caller can free memory, and then raise a timeout error. This fixes a memory leak in String#start_with when the regexp times out. For example: regex = Regexp.new("^#{"(a*)" * 10_000}x$", timeout: 0.000001) str = "a" * 1000000 + "x" 10.times do 100.times do str.start_with?(regex) rescue end puts `ps -o rss= -p #{$$}` end Before: 33216 51936 71152 81728 97152 103248 120384 133392 133520 133616 After: 14912 15376 15824 15824 16128 16128 16144 16144 16160 16160
2024-07-25[Bug #20650] Fix memory leak in Regexp capture group when timeout (#11244)Peter Zhu
Fix memory leak in Regexp capture group when timeout [Bug #20650] The capture group allocates memory that is leaked when it times out. For example: re = Regexp.new("^#{"(a*)" * 10_000}x$", timeout: 0.000001) str = "a" * 1000000 + "x" 10.times do 100.times do re =~ str rescue Regexp::TimeoutError end puts `ps -o rss= -p #{$$}` end Before: 34688 56416 78288 100368 120784 140704 161904 183568 204320 224800 After: 16288 16288 16880 16896 16912 16928 16944 17184 17184 17200
2024-07-08merge revision(s) fc33559c: [Backport #20570]Takashi Kokubun
clear `kw_flag` if given hash is nil https://bugs.ruby-lang.org/issues/20570 is caused I missed to clear the `kw_flag` even if `keyword_hash` is nil.
2024-07-08merge revision(s) 2dd46bb82ffc4dff01d7ea70922f0e407acafb4e: [Backport #20468]Takashi Kokubun
[Bug #20468] Fix safe navigation in `for` variable
2024-06-28[Bug #20598] Fix corruption of internal encoding string (#11069)Peter Zhu
Fix corruption of internal encoding string [Bug #20598] Just like [Bug #20595], Encoding#name_list and Encoding#aliases can have their strings corrupted when Encoding.default_internal is set to nil. Co-authored-by: Matthew Valentine-House <matt@eightbitraptor.com>
2024-06-27[Bug #20595] Fix corruption of encoding name string (#11063)Peter Zhu
Fix corruption of encoding name string [Bug #20595] enc_set_default_encoding will free the C string if the encoding is nil, but the C string can be used by the encoding name string. This will cause the encoding name string to be corrupted. Consider the following code: Encoding.default_internal = Encoding::ASCII_8BIT names = Encoding.default_internal.names p names Encoding.default_internal = nil p names It outputs: ["ASCII-8BIT", "BINARY", "internal"] ["ASCII-8BIT", "BINARY", "\x00\x00\x00\x00\x00\x00\x00\x00"] Co-authored-by: Matthew Valentine-House <matt@eightbitraptor.com>
2024-06-11[Bug #20270] Fix --parser=prism (#10970)Peter Zhu
Co-authored-by: Takashi Kokubun <takashikkbn@gmail.com>
2024-06-11[3.3 backport] compile.c: use putspecialobject for RubyVM::FrozenCore (#10962)Jean byroot Boussier
compile.c: use putspecialobject for RubyVM::FrozenCore [Bug #20569] `putobject RubyVM::FrozenCore`, is not serializable, we have to use `putspecialobject VM_SPECIAL_OBJECT_VMCORE`. Co-authored-by: Jean Boussier <jean.boussier@gmail.com>
2024-06-11Raise SyntaxError on invalid encoding symbol (#10967)Peter Zhu
[Bug #20280] Backport of #10014.
2024-06-10Fix inconsistent evaluation of keyword splat (#10959)Peter Zhu
[Bug #20180] Backports #9624.
2024-06-05Don't add `+YJIT` to `RUBY_DESCRIPTION` until it's actually enabled (#10920)Jean byroot Boussier
If you start Ruby with `--yjit-disable`, the `+YJIT` shouldn't be added until `RubyVM::YJIT.enable` is actually called. Otherwise it's confusing in crash reports etc. Co-authored-by: Jean Boussier <jean.boussier@gmail.com>
2024-05-30merge revision(s) fd549b229b0822198ddc847703194263a2186ed1: [Backport #20515]Takashi Kokubun
test_bignum: defined? returns String (#10880) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit didn't verify the test is working properly due to mistaken auto-merge… [Bug #20515] bug: https://bugs.ruby-lang.org/issues/20515 follow-up: 22e4eeda6561693367fc7a00b92b90f46b09cabd follow-up: https://github.com/ruby/ruby/pull/10875
2024-05-30merge revision(s) ↵Takashi Kokubun
22e4eeda6561693367fc7a00b92b90f46b09cabd,1ab7c412d2e3880a7ad233c32e93961888f8145c: [Backport #20515] ci: Test whether GMP is working in compilers.yml (#10875) Avoid reoccurence of [Bug #20515] Requires https://github.com/ruby/ruby/pull/10876 since 18eaf0be905e3e251423b42d6f4e56b7cae1bc3b bug: https://bugs.ruby-lang.org/issues/20515 RUBY_CHECK_HEADER didn't define HAVE_{header-file} (#10876) --with-gmp is not working at all because HAVE_GMP_H was missing since 18eaf0be90. [Bug #20515] bug: https://bugs.ruby-lang.org/issues/20515 follow-up: https://bugs.ruby-lang.org/issues/20494 follow-up: 18eaf0be905e3e251423b42d6f4e56b7cae1bc3b follow-up: https://github.com/ruby/ruby/pull/10805
2024-05-29merge revision(s) bc002971b6ad483dbf69b8a275c44412bb6ab954: [Backport #20094]Takashi Kokubun
[Bug #20094] Distinguish `begin` and parentheses
2024-05-29merge revision(s) d292a9b98ce03c76dbe13138d20b9fbf613cc02d: [Backport #20453]Takashi Kokubun
[Bug #20453] segfault in Regexp timeout https://bugs.ruby-lang.org/issues/20228 started freeing `stk_base` to avoid a memory leak. But `stk_base` is sometimes stack allocated (using `xalloca`), so the free only works if the regex stack has grown enough to hit `stack_double` (which uses `xmalloc` and `xrealloc`). To reproduce the problem on master and 3.3.1: ```ruby Regexp.timeout = 0.001 /^(a*)x$/ =~ "a" * 1000000 + "x"' ``` Some details about this potential fix: `stk_base == stk_alloc` on [init](https://github.com/ruby/ruby/blob/dde99215f2bc60c22a00fc941ff7f714f011e920/regexec.c#L1153), so if `stk_base != stk_alloc` we can be sure we called [`stack_double`](https://github.com/ruby/ruby/blob/dde99215f2bc60c22a00fc941ff7f714f011e920/regexec.c#L1210) and it's safe to free. It's also safe to free if we've [saved](https://github.com/ruby/ruby/blob/dde99215f2bc60c22a00fc941ff7f714f011e920/regexec.c#L1187-L1189) the stack to `msa->stack_p`, since we do the `stk_base != stk_alloc` check before saving. This matches the check we do inside [`stack_double`](https://github.com/ruby/ruby/blob/dde99215f2bc60c22a00fc941ff7f714f011e920/regexec.c#L1221)
2024-05-29merge revision(s) c479492a6701dcef3d3a96de8946ecf7beb079d4: [Backport #20427]Takashi Kokubun
Resize ary when `Array#sort!` block modifies embedded ary In cases where `rb_ary_sort_bang` is called with a block and tmp is an embedded array, we need to account for the block potentially impacting the capacity of ary. ex: ``` var_0 = (1..70).to_a var_0.sort! do |var_0_block_129, var_1_block_129| var_0.pop var_1_block_129 <=> var_0_block_129 end.shift(3) ``` The above example can put the array into a corrupted state resulting in a heap buffer overflow and possible segfault: ``` ERROR: AddressSanitizer: heap-buffer-overflow on address [...] WRITE of size 560 at 0x60b0000034f0 thread T0 [...] ``` This commit adds a conditional to determine when the capacity of ary has been modified by the provided block. If this is the case, ensure that the capacity of ary is adjusted to handle at minimum the len of tmp.
2024-05-29merge revision(s) 58918788abd63901588e4aa1e39b5c057321c10a: [Backport #20342]Takashi Kokubun
[Bug #20342] Consider wrapped load in `main` methods
2024-05-29merge revision(s) a7ff264477105b5dc0ade6facad4176a1b73df0b: [Backport #20393]Takashi Kokubun
Don't clear pending interrupts in the parent process. (#10365)
2024-05-29Skip under_gc_compact_stress on s390x (#10073)Takashi Kokubun
2024-05-29merge revision(s) ↵Takashi Kokubun
dc146babf47a84bbd1f176d766637d4a40327019,f23d5028059078a346efc977287b669d494a5a3f,a0f7de814ae5c299d6ce99bed5fb308a05d50ba0: [Backport #20296] [Bug #20296] Clear errinfo when `exception: false` [Bug #20296] Refine the test [Bug #20296] Fix the default assertion message
2024-05-29merge revision(s) e04146129ec6898dd6a9739dad2983c6e9b68056: [Backport #20292]Takashi Kokubun
[Bug #20292] Truncate embedded string to new capacity
2024-05-29merge revision(s) 78d9fe69479d32214a52ad7291c3973f1b6b7f6f: [Backport #20286]Takashi Kokubun
Ensure that exiting thread invokes end-of-life behaviour. (#10039)
2024-05-29Change test_warmup_frees_pages to check each size poolPeter Zhu
This should help in debugging the intermittent test failures on CI: TestProcess#test_warmup_frees_pages [test/ruby/test_process.rb:2779]: <201> expected but was <202>.
2024-05-28merge revision(s) f36a71e26995b69ff72bc132bbcf40ad89571414: [Backport #20307]Takashi Kokubun
[Bug #20307] Fix `Hash#update` to make frozen copy of string keys
2024-05-28Fix RegExp warning causing flaky Ripper failureAlan Wu
Sometimes this file get picked up and break Ripper tests: TestRipper::Generic#test_parse_files:test/ruby assert_separately failed with error message pid 63392 exit 0 | test_regexp.rb:2025: warning: character class has duplicated range https://github.com/ruby/ruby/actions/runs/7699956651/job/20982702553#step:12:103
2024-03-22merge revision(s) b176315827d1082f43628013a7d89fda02724d33: [Backport ↵NARUSE, Yui
#20324] (#10329) [Bug #20324] Uncomparable ranges are not overlapping
2024-03-21merge revision(s) ↵NARUSE, Yui
e626da82eae3d437b84d4f9ead0164d436b08e1a,f3af5ae7e6c1c096bbfe46d69de825a02b1696cf: [Backport #20311] (#10312) Don't pin named structs defined in Ruby [Bug #20311] `rb_define_class_under` assumes it's called from C and that the reference might be held in a C global variable, so it adds the class to the VM root. In the case of `Struct.new('Name')` it's wasteful and make the struct immortal. Make Struct memory leak test faster [Bug #20311] It times out on some platform, so we can reduce iterations. On my machine it completes in 250ms and RSS grows 8X.
2024-03-21merge revision(s) ↵NARUSE, Yui
081ee3d35509110f383cb7dd8d1205def0cdd1e8,1c97abaabae6844c861705fd07f532292dcffa74: [Backport #19907] (#10315) Add memory leak test for eval kwargs De-dup identical callinfo objects Previously every call to vm_ci_new (when the CI was not packable) would result in a different callinfo being returned this meant that every kwarg callsite had its own CI. When calling, different CIs result in different CCs. These CIs and CCs both end up persisted on the T_CLASS inside cc_tbl. So in an eval loop this resulted in a memory leak of both types of object. This also likely resulted in extra memory used, and extra time searching, in non-eval cases. For simplicity in this commit I always allocate a CI object inside rb_vm_ci_lookup, but ideally we would lazily allocate it only when needed. I hope to do that as a follow up in the future.
2024-03-21merge revision(s) d3279a0c11ca45ca85027e7eb74dc4aac52c478b: [Backport ↵NARUSE, Yui
#20327] (#10313) [Bug #20327] Do not count subsecond to calculate UTC offset Assume that there will never be any time zones with UTC offsets that are subseconds. Historically, UTC offset has only been used down to the second.
2024-03-21merge revision(s) ↵NARUSE, Yui
d19d683a354530a27b4cbb049223f8dc70c75849,de1a586ecc2ee7f465f0c0a69291054136a3a819: [Backport #20250] (#10308) rb_obj_setup: do not copy RUBY_FL_SEEN_OBJ_ID [Bug #20250] We're seting up a new instance, so it never had an associated object_id. proc.c: get rid of `CLONESETUP` MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit [Bug #20253] All the way down to Ruby 1.9, `Proc`, `Method`, `UnboundMethod` and `Binding` always had their own specific clone and dup routine. This caused various discrepancies with how other objects behave on `dup` and `clone. [Bug #20250], [Bug #20253]. This commit get rid of `CLONESETUP` and use the the same codepath as all other types, so ensure consistency. NB: It's still not accepting the `freeze` keyword argument on `clone`. Co-Authored-By: Étienne Barrié <etienne.barrie@gmail.com>
2024-03-21merge revision(s) ↵NARUSE, Yui
18ee7c9a108bf3424814565377c8796e5e455cf7,4a6384ed9358e8fb8464f6e37efb5477182f01db: [Backport #20246] (#10309) Clear all refined CCs on reopening refinement mod In cfd7729ce7a31c8b6ec5dd0e99c67b2932de4732 we started using inline caches for refinements. However, we weren't clearing inline caches when defined on a reopened refinement module. Fixes [Bug #20246] Fix [Bug #20246]: Don't set next_head_exact if a capture is called (#9897)
2024-03-21merge revision(s) 01fd262e62076277a41af72ea13f20deb1b462a2: [Backport ↵NARUSE, Yui
#20245] (#10307) Fix crash when checking symbol encoding [Bug #20245] We sometimes pass in a fake string to sym_check_asciionly. This can crash if sym_check_asciionly raises because it creates a CFP with the fake string as the receiver which will crash if GC tries to mark the CFP. For example, the following script crashes: GC.stress = true Object.const_defined?("\xC3")
2024-03-20merge revision(s) 3e6e3ca2627b1aa71b17de902cc1b8188246a828: [Backport ↵NARUSE, Yui
#20207] (#10299) Correctly handle consecutive lookarounds (#9738) Fix [Bug #20207] Fix [Bug #20212] Handling consecutive lookarounds in init_cache_opcodes is buggy, so it causes invalid memory access reported in [Bug #20207] and [Bug #20212]. This fixes it by using recursive functions to detected lookarounds nesting correctly.
2024-03-20merge revision(s) ↵NARUSE, Yui
01bfd1a2bf013a9ed92a9722ac5228187e05e6a8,1c120efe02d079b0a1dea573cf0fd7978d9cc857,31378dc0969f4466b2122d730b7298dd7004acdf: [Backport #20228] (#10301) Fix memory leak in OnigRegion when match raises [Bug #20228] rb_reg_onig_match can raise a Regexp::TimeoutError, which would cause the OnigRegion to leak. Fix memory leak in stk_base when Regexp timeout [Bug #20228] If rb_reg_check_timeout raises a Regexp::TimeoutError, then the stk_base will leak. Add memory leak test for Regexp timeout [Bug #20228]
2024-03-20merge revision(s) ade56737e2273847426214035c0ff2340b43799a: [Backport ↵NARUSE, Yui
#20190] (#10300) Fix coderange of invalid_encoding_string.<<(ord) Appending valid encoding character can change coderange from invalid to valid. Example: "\x95".force_encoding('sjis')<<0x5C will be a valid string "\x{955C}"
2024-03-20merge revision(s) 771a2f039b9a059a73e8f111d1d46590fa697f63: [Backport ↵NARUSE, Yui
#20213] (#10297) Fix incorrect use of VM_CALL_KW_SPLAT_MUT in zsuper with keyword splat For zsuper calls with a keyword splat but no actual keywords, the keyword splat is passed directly, so it cannot be mutable, because if the callee accepts a keyword splat, changes to the keyword splat by the callee would be reflected in the caller. While here, simplify the logic when the method supports literal keywords. I don't think it is possible for a method with has_kw param flags to not have keywords, so add an assertion for that, and set VM_CALL_KW_SPLAT_MUT in a single place.
2024-03-20merge revision(s) b14674b236445fb70f484603e678722760f678f4: [Backport ↵NARUSE, Yui
#20194] (#10295) Memory leak with TracePoint on bmethod [Bug #20194] When disabling the TracePoint on bmethod, the hooks list is not freed. For example: obj = Object.new obj.define_singleton_method(:foo) {} bmethod = obj.method(:foo) tp = TracePoint.new(:return) {} 10.times do 100_000.times do tp.enable(target: bmethod) {} end puts `ps -o rss= -p #{$$}` end Before: 18208 22832 26528 29728 34000 37776 40864 44400 47680 51504 After: 16688 17168 17168 17248 17696 17760 17824 17824 17856 17920 --- test/ruby/test_settracefunc.rb | 13 +++++++++++++ vm_trace.c | 1 + 2 files changed, 14 insertions(+)
generated by cgit v1.2.3 (git 2.25.1) at 2026-01-16 17:44:35 +0000