[ruby-core:107597] [Ruby master Bug#18586] ObjectSpace::WeakMap#each seems to leak a broken object

Issue #18586 has been reported by mame (Yusuke Endoh).

----------------------------------------
Bug #18586: ObjectSpace::WeakMap#each seems to leak a broken object
https://bugs.ruby-lang.org/issues/18586

* Author: mame (Yusuke Endoh)
* Status: Open
* Priority: Normal
* Backport: 2.6: UNKNOWN, 2.7: UNKNOWN, 3.0: UNKNOWN, 3.1: UNKNOWN
----------------------------------------
```
h = ObjectSpace::WeakMap.new

GC.disable

s = "a"
10000.times do
  h[s] = true
  s = s.succ
end

GC.enable

h.each do |x|
  x + ""
  x + ""
  x + ""
end
```

```
$ ruby t.rb
t.rb:15: [BUG] Segmentation fault at 0x0000000000000028
ruby 3.1.0p0 (2021-12-25 revision fb4df44d16) [x86_64-linux]

-- Control frame information -----------------------------------------------
c:0004 p:0013 s:0018 e:000015 BLOCK  t.rb:15 [FINISH]
c:0003 p:---- s:0012 e:000011 CFUNC  :each
c:0002 p:0056 s:0008 E:0012f0 EVAL   t.rb:13 [FINISH]
c:0001 p:0000 s:0003 E:001060 (none) [FINISH]

-- Ruby level backtrace information ----------------------------------------
t.rb:13:in `<main>'
t.rb:13:in `each'
t.rb:15:in `block in <main>'

-- Machine register context ------------------------------------------------
 RIP: 0x00005638b271ab52 RBP: 0x00007fc17ab30c20 RSP: 0x00007ffc5f4e4b90
 RAX: 0x0000000000000001 RBX: 0x0000000000000000 RCX: 0x00005638b293a840
 RDX: 0x00007fc17ab30c20 RDI: 0x0000002b00100003 RSI: 0x00007fc17ab30c20
  R8: 0x00005638b330bbc0  R9: 0x0000000000000002 R10: 0x00007fc17e06b278
 R11: 0x00007fc17ab462f0 R12: 0x0000002b00100003 R13: 0x00005638b330b9b0
 R14: 0x00005638b34cf6f8 R15: 0x000000000000002b EFL: 0x0000000000010206

-- C level backtrace information -------------------------------------------
/home/mame/local/bin/ruby(rb_vm_bugreport+0x570) [0x5638b2741820]
/home/mame/local/bin/ruby(rb_bug_for_fatal_signal+0xec) [0x5638b280bafc]
/home/mame/local/bin/ruby(sigsegv+0x4d) [0x5638b26930cd]
[0x7fc17e867520]
/home/mame/local/bin/ruby(rb_vm_search_method_slowpath+0x52) [0x5638b271ab52]
/home/mame/local/bin/ruby(vm_search_method_slowpath0+0x17) [0x5638b271af07]
/home/mame/local/bin/ruby(vm_exec_core+0x2731) [0x5638b2735801]
/home/mame/local/bin/ruby(rb_vm_exec+0xef) [0x5638b272447f]
/home/mame/local/bin/ruby(wmap_each_i+0x3d) [0x5638b2549e7d]
/home/mame/local/bin/ruby(rb_st_foreach+0x75) [0x5638b26a0cf5]
/home/mame/local/bin/ruby(wmap_each+0x3c) [0x5638b254408c]
/home/mame/local/bin/ruby(vm_call_cfunc_with_frame+0x137) [0x5638b2721ab7]
/home/mame/local/bin/ruby(vm_sendish.constprop.0+0xf5) [0x5638b271b195]
/home/mame/local/bin/ruby(vm_exec_core+0x182) [0x5638b2733252]
/home/mame/local/bin/ruby(rb_vm_exec+0xef) [0x5638b272447f]
/home/mame/local/bin/ruby(rb_ec_exec_node+0xb1) [0x5638b252fd61]
/home/mame/local/bin/ruby(ruby_run_node+0x4d) [0x5638b2534f1d]
/home/mame/local/bin/ruby(main+0x5f) [0x5638b252faef]
```

On my machine, it reproduces in Ruby 2.7, 3.0, 3.1, and master.

I think `ObjectSpace::WeakMap#each` is inherently very fragile because the elements may be GC'ed during iteration.



-- 
https://bugs.ruby-lang.org/

Unsubscribe: <mailto:[e-mail]?subject=unsubscribe>
<http://lists.ruby-lang.org/cgi-bin/mailman/options/ruby-core>