From: "byroot (Jean Boussier)" <noreply@...>
Date: 2022-12-02T11:13:32+00:00
Subject: [ruby-core:111149] [Ruby master Bug#19156] ObjectSpace.dump_all segfault during string inspection

Issue #19156 has been updated by byroot (Jean Boussier).





> calls into new_str0, which when the string is large enough, will be malloc'ed by MRI, correct? 



No. It calls `rb_str_new("", 0)` which means it's always an empty String, so it only allocates an Object slot.



It then never increase that string, but make it point to the underlying mmaped region. 



> From MRIs perspective, why does it matter where the actual string data resides?



It doesn't. That is why it works generally, until the mmaped region is freed.



> I also don't think it's because of the MmapValue object being GC'ed;



That was a guess, it might just free that region without being GCed, not sure.



What is certain though is that at some point it frees that region while the String objects it created still points to it, and it does nothing about it.







----------------------------------------

Bug #19156: ObjectSpace.dump_all segfault during string inspection

https://bugs.ruby-lang.org/issues/19156#change-100433



* Author: mk (Matthias K�ppler)

* Status: Third Party's Issue

* Priority: Normal

* ruby -v: ruby 3.0.4p208 (2022-04-12 revision 3fa771dded) [x86_64-linux]

* Backport: 2.7: UNKNOWN, 3.0: UNKNOWN, 3.1: UNKNOWN

----------------------------------------

I am working on a feature that would allow our application to capture heap dumps during shutdown for later inspection.



These heap dumps are captured via `ObjectSpace.dump_all(output: io)`. While walking the object space, MRI occasionally segfaults while inspecting string objects in `search_nonascii` of `string.c`:



```

/usr/local/lib/ruby/3.0.0/objspace.rb:87: [BUG] Segmentation fault at 0x00007efee4201000

ruby 3.0.4p208 (2022-04-12 revision 3fa771dded) [x86_64-linux]

...



-- Control frame information -----------------------------------------------

c:0053 p:---- s:0312 e:000311 CFUNC  :_dump_all

c:0052 p:0130 s:0305 e:000304 METHOD /usr/local/lib/ruby/3.0.0/objspace.rb:87

c:0051 p:0023 s:0295 e:000294 METHOD /home/git/gitlab/lib/gitlab/memory/reports/heap_dump.rb:26

...



-- C level backtrace information -------------------------------------------

/usr/local/lib/libruby.so.3.0(rb_print_backtrace+0x11) [0x7efee4ad0c5e] vm_dump.c:758

/usr/local/lib/libruby.so.3.0(rb_vm_bugreport) vm_dump.c:998

/usr/local/lib/libruby.so.3.0(rb_bug_for_fatal_signal+0xf8) [0x7efee48d0b08] error.c:787

/usr/local/lib/libruby.so.3.0(sigsegv+0x55) [0x7efee4a23db5] signal.c:963

/lib/x86_64-linux-gnu/libpthread.so.0(__restore_rt+0x0) [0x7efee4f12140] ../sysdeps/pthread/funlockfile.c:28

/usr/local/lib/libruby.so.3.0(search_nonascii+0x30) [0x7efee4a3ca60] string.c:552

/usr/local/lib/libruby.so.3.0(coderange_scan) string.c:585

/usr/local/lib/libruby.so.3.0(enc_coderange_scan+0x1b) [0x7efee4a3e28a] string.c:709

/usr/local/lib/libruby.so.3.0(rb_enc_str_coderange) string.c:727

/usr/local/lib/ruby/3.0.0/x86_64-linux/objspace.so(is_broken_string+0x8) [0x7efeced9c304] ../../internal/string.h:116

/usr/local/lib/ruby/3.0.0/x86_64-linux/objspace.so(dump_object) objspace_dump.c:388

/usr/local/lib/ruby/3.0.0/x86_64-linux/objspace.so(heap_i+0x39) [0x7efeced9caa9] objspace_dump.c:521

/usr/local/lib/libruby.so.3.0(objspace_each_objects_without_setup+0xaf) [0x7efee48e878f] gc.c:3232

/usr/local/lib/libruby.so.3.0(objspace_each_objects_protected+0x14) [0x7efee48e87c4] gc.c:3242

/usr/local/lib/libruby.so.3.0(rb_ensure+0x12a) [0x7efee48d96aa] eval.c:1162

/usr/local/lib/libruby.so.3.0(objspace_each_objects+0x28) [0x7efee48fb458] gc.c:3310

/usr/local/lib/libruby.so.3.0(rb_objspace_each_objects) gc.c:3298

/usr/local/lib/ruby/3.0.0/x86_64-linux/objspace.so(objspace_dump_all+0x88) [0x7efeced9b068] objspace_dump.c:616

...

```



Unfortunately I couldn't get my hands on that memory region to see which strings are causing this since this doesn't always happen.



I suspect this is also a problem with MRI master since the code looks unchanged from 3.0.4.







-- 

https://bugs.ruby-lang.org/

 ______________________________________________
 ruby-core mailing list -- ruby-core@ml.ruby-lang.org
 To unsubscribe send an email to ruby-core-leave@ml.ruby-lang.org
 ruby-core info -- https://ml.ruby-lang.org/mailman3/postorius/lists/ruby-core.ml.ruby-lang.org/