From: "ko1 (Koichi Sasada)" <redmine@...>
Date: 2013-10-10T10:01:29+09:00
Subject: [ruby-core:57795] [ruby-trunk - Bug #9011] rb_fstring unsafe to use	in general case


Issue #9011 has been updated by ko1 (Koichi Sasada).


Nobu's patch r43210 may solve this problem. Could you verify it?

BTW, I don't like this fix. I'll try fix by another way.

----------------------------------------
Bug #9011: rb_fstring unsafe to use in general case
https://bugs.ruby-lang.org/issues/9011#change-42399

Author: normalperson (Eric Wong)
Status: Open
Priority: Normal
Assignee: 
Category: 
Target version: 
ruby -v: trunk
Backport: 1.9.3: UNKNOWN, 2.0.0: UNKNOWN


I don't think the current "frozen"f in pure Ruby code is unsafe
(I haven't reproduced a crash)

But I do not think rb_fstring is generally safe for other C code, including extension authors

Consider the following case:

        fstr1 = rb_fstring(str)
        fstr1 goes out of scope
        GC mark runs ...
        fstr1 is eligible for lazy sweep
        fstr2 = rb_fstring(str)
        fstr2 is identical to fstr1
        fstr1 is swept (rb_str_free)
        fstr2 use attempted -> crash

I extracted this bug report from Feature #8998, where I showed a patch
which exposes this bug during "make check"



-- 
http://bugs.ruby-lang.org/