From eb92159d72fc711387f7e17ffbaca1678f23fd47 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E5=8D=9C=E9=83=A8=E6=98=8C=E5=B9=B3?=
 <shyouhei@ruby-lang.org>
Date: Thu, 3 Oct 2019 12:26:41 +0900
Subject: Revert https://github.com/ruby/ruby/pull/2486

This reverts commits: 10d6a3aca7 8ba48c1b85 fba8627dc1 dd883de5ba
6c6a25feca 167e6b48f1 7cb96d41a5 3207979278 595b3c4fdd 1521f7cf89
c11c5e69ac cf33608203 3632a812c0 f56506be0d 86427a3219 .

The reason for the revert is that we observe ABA problem around
inline method cache.  When a cache misshits, we search for a
method entry.  And if the entry is identical to what was cached
before, we reuse the cache.  But the commits we are reverting here
introduced situations where a method entry is freed, then the
identical memory region is used for another method entry.  An
inline method cache cannot detect that ABA.

Here is a code that reproduce such situation:

```ruby
require 'prime'

class << Integer
  alias org_sqrt sqrt
  def sqrt(n)
    raise
  end

  GC.stress = true
  Prime.each(7*37){} rescue nil # <- Here we populate CC
  class << Object.new; end

  # These adjacent remove-then-alias maneuver
  # frees a method entry, then immediately
  # reuses it for another.
  remove_method :sqrt
  alias sqrt org_sqrt
end

Prime.each(7*37).to_a # <- SEGV
```
---
 vm_core.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'vm_core.h')

diff --git a/vm_core.h b/vm_core.h
index 192165b497..8eb155585e 100644
--- a/vm_core.h
+++ b/vm_core.h
@@ -491,7 +491,7 @@ rb_iseq_check(const rb_iseq_t *iseq)
 }
 
 static inline const rb_iseq_t *
-def_iseq_ptr(const rb_method_definition_t *def)
+def_iseq_ptr(rb_method_definition_t *def)
 {
 #if VM_CHECK_MODE > 0
     if (def->type != VM_METHOD_TYPE_ISEQ) rb_bug("def_iseq_ptr: not iseq (%d)", def->type);
-- 
cgit v1.2.3