[ruby-core:121495] [Ruby Bug#21208] `Ractor#send(move: true)` allow moving objects that are on the stack, and used by C code.

Issue #21208 has been updated by byroot (Jean Boussier).


> The following script causes a crash

Actually, that was only because I was on an older branch, it no longer crash on `master`, and even behave somewhat correctly by sheer luck.

The general issue remain, `send(obj, move: true)` essentially zero-out the object slot, and none of the C methods that call `rb_yield` expect that, and I don't think we can realistically handle that everywhere in Ruby itself, and certainly not in C extensions.

----------------------------------------
Bug #21208: `Ractor#send(move: true)` allow moving objects that are on the stack, and used by C code.
https://bugs.ruby-lang.org/issues/21208#change-112516

* Author: byroot (Jean Boussier)
* Status: Open
* Assignee: ractor
* Backport: 3.1: UNKNOWN, 3.2: UNKNOWN, 3.3: UNKNOWN, 3.4: UNKNOWN
----------------------------------------
The following script causes a crash:

```ruby
rac = Ractor.new do
  Ractor.receive
end

hash = Hash[*50.times]

hash.merge!(12 => 0, 14 => 0) do |key, old_val, new_val|
  if key == 12
    rac.send(hash, move: true)
  end
  new_val
end

p rac.take
```

Contrary to previous crashes related to `send(move: true)`, I'm afraid this one is with the design of the feature itself, not just the implementation.

If we allow objects to be moved, any C code that calls `rb_yield()` may cause memory corruption if one of the objects it uses is moved.

I personally can't see any realistic solution to this.



-- 
https://bugs.ruby-lang.org/
 ______________________________________________
 ruby-core mailing list -- [e-mail]
 To unsubscribe send an email to [e-mail]
 ruby-core info -- https://ml.ruby-lang.org/mailman3/lists/ruby-core.ml.ruby-lang.org/