From: "nagachika (Tomoyuki Chikanaga) via ruby-core" <ruby-core@...>
Date: 2023-07-16T03:52:07+00:00
Subject: [ruby-core:114197] [Ruby master Bug#19463] YJIT `[BUG] Stack consistency error` under certain invalidation scenarios

Issue #19463 has been updated by nagachika (Tomoyuki Chikanaga).

Backport changed from 2.7: DONTNEED, 3.0: DONTNEED, 3.1: DONTNEED, 3.2: REQUIRED to 2.7: DONTNEED, 3.0: DONTNEED, 3.1: DONTNEED, 3.2: DONE

ruby_3_2 0ba10fd8508b1a2bf7488649ee90622de9bef04a merged revision(s) 132934b82baad97107fe754d60f9a68a1db7ecda.

----------------------------------------
Bug #19463: YJIT `[BUG] Stack consistency error` under certain invalidation scenarios
https://bugs.ruby-lang.org/issues/19463#change-103884

* Author: alanwu (Alan Wu)
* Status: Closed
* Priority: Normal
* ruby -v: ruby 3.2.1 (2023-02-08 revision 31819e82c8) +YJIT [arm64-darwin22]
* Backport: 2.7: DONTNEED, 3.0: DONTNEED, 3.1: DONTNEED, 3.2: DONE
----------------------------------------
> test.rb:19: [BUG] Stack consistency error (sp: 15, bp: 16)

With the following:

```ruby
klass = Class.new do
  def self.lookup(hash, key) = hash[key]

  def self.foo(a, b) = []
  
  def self.test(hash, key)
    [lookup(hash, key), key, "".freeze]
    # 05 opt_send_without_block :lookup
    # 07 getlocal_WC_0          :hash
    # 09 opt_str_freeze         ""
    # 12 newarray               3
    # 14 leave
    #
    # YJIT will put instructions (07..14) into a block.
    # When String#freeze is redefined from within lookup(),
    # the return address to the block is still on-stack. We rely
    # on invalidation patching the code at the return address
    # to service this situation correctly.
  end
end

# get YJIT to compile test()
hash = { 1 => [] }
31.times { klass.test(hash, 1) }

# inject invalidation into lookup()
evil_hash = Hash.new do |_, key|
  class String
    undef :freeze
    def freeze = :ugokanai
  end

  key
end
p klass.test(evil_hash, 1)
```

The fix is fairly simple and I'll apply it shortly.



-- 
https://bugs.ruby-lang.org/
 ______________________________________________
 ruby-core mailing list -- ruby-core@ml.ruby-lang.org
 To unsubscribe send an email to ruby-core-leave@ml.ruby-lang.org
 ruby-core info -- https://ml.ruby-lang.org/mailman3/postorius/lists/ruby-core.ml.ruby-lang.org/