From: nobu.nokada@...
Date: 2003-08-16T20:02:15+09:00
Subject: Re: _id2ref bug? (another break)

Hi,

At Sat, 16 Aug 2003 18:35:30 +0900,
ts wrote:
> R> This isn't so strange.  If T_NODE are kept in the same pool as
> R> everything else, then it's entirely possible to get one by accident,
> 
>  and this means that you have a bug in your source. You can retrieve a
>  valid object, which was not the original object : difficult to trust your
>  code in this case.

Ryan is correct.

  $ ruby -e 'x = ""; eval("x"); y = ""; x = [x.id, y.id]; x.min.step(x.max, 10){|i| p ObjectSpace._id2ref(i)}'
  ""
  -e:1: [BUG] Segmentation fault
  ruby 1.8.0 (2003-08-15) [i686-linux]

  Aborted (core dumped)

And I guess this would make better message than
[ruby-core:01417].


Index: gc.c
===================================================================
RCS file: /cvs/ruby/src/ruby/gc.c,v
retrieving revision 1.155
diff -u -2 -p -r1.155 gc.c
--- gc.c	14 Aug 2003 17:19:23 -0000	1.155
+++ gc.c	16 Aug 2003 10:58:42 -0000
@@ -1637,8 +1637,8 @@ id2ref(obj, id)
 
     ptr = id ^ FIXNUM_FLAG;	/* unset FIXNUM_FLAG */
-    if (!is_pointer_to_heap((void *)ptr)) {
+    if (!is_pointer_to_heap((void *)ptr) || BUILTIN_TYPE(ptr) >= T_BLKTAG) {
 	rb_raise(rb_eRangeError, "0x%lx is not id value", p0);
     }
-    if (RBASIC(ptr)->klass == 0) {
+    if (BUILTIN_TYPE(ptr) == 0 || RBASIC(ptr)->klass == 0) {
 	rb_raise(rb_eRangeError, "0x%lx is recycled object", p0);
     }


-- 
Nobu Nakada