[ruby-dev:25366] bmcall() causes core dump

酒井です。

bmcall()はsvalue_to_avalue()の結果のデータタイプがT_ARRAYかどうかをチェッ
クしていないので、次のようにすると core を吐きます。

% ruby -e '
class Foo
  def initialize
    @a = 0
  end
  def to_ary
    [[0,1]]
  end
end

def f
  yield Foo.new
end

f(&method(:p))'
[BUG] Segmentation fault
ruby 1.9.0 (2004-12-28) [i686-linux]

zsh: 22015 abort      ruby -e 
% gdb ruby core
GNU gdb 6.1-debian
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-linux"...Using host libthread_db library "/lib/libthread_db.so.1".

Core was generated by `/home/sakai/local/bin/ruby -e 
class Foo
  def initialize
    @a = 0
  end
  de'.
Program terminated with signal 6, Aborted.
Reading symbols from /home/sakai/local/lib/libruby.so.1.9...done.
Loaded symbols for /home/sakai/local/lib/libruby.so.1.9
Reading symbols from /lib/libdl.so.2...done.
Loaded symbols for /lib/libdl.so.2
Reading symbols from /lib/libcrypt.so.1...done.
Loaded symbols for /lib/libcrypt.so.1
Reading symbols from /lib/libm.so.6...done.
Loaded symbols for /lib/libm.so.6
Reading symbols from /lib/libc.so.6...done.
Loaded symbols for /lib/libc.so.6
Reading symbols from /lib/ld-linux.so.2...done.
Loaded symbols for /lib/ld-linux.so.2
#0  0x401936b1 in kill () from /lib/libc.so.6
(gdb) bt
#0  0x401936b1 in kill () from /lib/libc.so.6
#1  0x40193435 in raise () from /lib/libc.so.6
#2  0x40194978 in abort () from /lib/libc.so.6
#3  0x4003b009 in rb_bug (fmt=0x400ef8ce "Segmentation fault") at error.c:214
#4  0x400bc007 in sigsegv (sig=11) at signal.c:446
#5  <signal handler called>
#6  0x4006cc3c in rb_f_p (argc=134714912, argv=0x0) at io.c:3780
#7  0x40058fb1 in call_cfunc (func=0x4006cc0c <rb_f_p>, recv=1076677056, len=-1, 
    argc=134714912, argv=0x0) at eval.c:5418
#8  0x4004a663 in rb_call0 (klass=1076681896, recv=1076677056, id=7425, oid=7425, 
    argc=134714912, argv=0x0, body=0x402c3a3c, nosuper=0) at eval.c:5559
#9  0x40051b30 in method_call (argc=134714912, argv=0x0, method=1076610856)
    at eval.c:8872
#10 0x4005228d in bmcall (args=1076610776, method=1076610856) at eval.c:9178
#11 0x40048871 in rb_yield_0 (val=1076610776, self=1076677056, klass=0, flags=0, 
    avalue=0) at eval.c:4747
#12 0x40043c6e in rb_eval (self=1076677056, n=0x402bc8e0) at eval.c:2995
#13 0x4004accd in rb_call0 (klass=1076682016, recv=1076677056, id=10449, oid=10449, 
    argc=0, argv=0x0, body=0x402bc8e0, nosuper=0) at eval.c:5688
#14 0x4004b245 in rb_call (klass=1076682016, recv=1076677056, mid=10449, argc=0, 
    argv=0x0, scope=1) at eval.c:5781
#15 0x40044b7a in rb_eval (self=1076677056, n=0x402bc818) at eval.c:3214
#16 0x400511db in block_pass (self=1076677056, node=0x402bc82c) at eval.c:8550
#17 0x40043635 in rb_eval (self=1076677056, n=0x402bc8a4) at eval.c:2905
#18 0x4003fed3 in eval_node (self=1076677056, node=0x402bc8a4) at eval.c:1290
#19 0x40040520 in ruby_exec_internal () at eval.c:1470
#20 0x40040565 in ruby_exec () at eval.c:1488
#21 0x400405be in ruby_run () at eval.c:1505
#22 0x080486ec in main (argc=3, argv=0xbffffb44, envp=0xbffffb54) at main.c:38
(gdb) 

--
酒井 政裕 / Masahiro Sakai