[ruby-core:121248] [Ruby master Bug#21170] Corrupted Hash (bad VALUE and missing entry) when -1 returned from .hash

Issue #21170 has been updated by jhawthorn (John Hawthorn).


Fixed in bf10e99bf9d9676b12ab470b8970e4f12c9b4392

Backports:
3.2: https://github.com/ruby/ruby/pull/12860
3.3: https://github.com/ruby/ruby/pull/12861
3.4: https://github.com/ruby/ruby/pull/12862

----------------------------------------
Bug #21170: Corrupted Hash (bad VALUE and missing entry) when -1 returned from .hash
https://bugs.ruby-lang.org/issues/21170#change-112194

* Author: jhawthorn (John Hawthorn)
* Status: Open
* Backport: 3.1: DONTNEED, 3.2: REQUIRED, 3.3: REQUIRED, 3.4: REQUIRED
----------------------------------------
``` ruby
class MyObj
  attr_reader :hash
  def initialize(val) = @hash = val
end

values = 0.downto(-16).to_a
hash = {}
values.each do |val|
  hash[MyObj.new(val)] = val
end
p hash.values
# => [0, -2, -3, -4, -5, -6, -7, -8, -9, -10, -11, -12, -13, -14, -15, false, -16]
```

---

st_table reserves -1 as a special hash value to indicate that an entry has been deleted. So that that's a valid value to be returned from the hash function, do_hash replaces -1 with 0 so that it is not mistaken for the sentinel.

Previously, when upgrading an AR table to an ST table, rb_st_add_direct_with_hash was used which did not perform the same conversion, this could lead to a hash in a broken state where one if its entries which was supposed to exist being marked as a tombstone.

The hash could then become further corrupted when the ST table required resizing as the falsely tombstoned entry would be skipped but it would be counted in num entries, leading to an uninitialized entry at index 15.

https://github.com/ruby/ruby/pull/12852



-- 
https://bugs.ruby-lang.org/
 ______________________________________________
 ruby-core mailing list -- [e-mail]
 To unsubscribe send an email to [e-mail]
 ruby-core info -- https://ml.ruby-lang.org/mailman3/lists/ruby-core.ml.ruby-lang.org/