[ruby-core:64880] [ruby-trunk - Bug #10206] garbage symbols crash symbol GC

Issue #10206 has been updated by Eric Wong.


 I'm looking into uses of intern_cstr_without_pindown in parse.y causing
 garbage syms.
 
 Unfortunately, I do not yet understand why we avoid pindown in parse.y
 (or much of parse.y).  I thought symbol GC was only to help users who
 use String#to_sym too aggressively.
 
 > 	http://80x24.org/r35240/gdb-bt.txt
 
 compile.c:
 		      case TS_ID: /* ID */
 			generated_iseq[pos + 1 + j] = SYM2ID(operands[j]);

----------------------------------------
Bug #10206: garbage symbols crash symbol GC
https://bugs.ruby-lang.org/issues/10206#change-48741

* Author: Eric Wong
* Status: Open
* Priority: Normal
* Assignee: Koichi Sasada
* Category: core
* Target version: current: 2.2.0
* ruby -v: trunk
* Backport: 2.0.0: UNKNOWN, 2.1: UNKNOWN
----------------------------------------
This is reproducible with just a test loop running for serveral minutes/hours:

	while make test-all TESTS=-j8; do :; done

It looks like SYM2ID/rb_sym2id interacts badly with dsymbol_check
when it encounters garbage objects.

dsymbol_check replaces an invalid object and returns a new object
for the caller, but the original arg for SYM2ID remains usable
to the caller:

        id = SYM2ID(garbage_sym);
        do_something(garbage_sym); /* bad invalid object used */

Changing: rb_sym2id(VALUE) to rb_sym2id(VALUE *)
might solve the issue, but introduces many incompatibilities in existing
code:

        id = rb_sym2id(&garbage_sym);
        do_something(garbage_sym); /* id == garbage_sym, safe to use */

ref: ruby-core thread starting at [ruby-core:64671]
backtraces:
	http://80x24.org/r35240/rb-dump.txt
	http://80x24.org/r35240/gdb-bt.txt





-- 
https://bugs.ruby-lang.org/