From: Tanaka Akira <akr@...>
Date: 2007-12-14T00:27:25+09:00
Subject: [ruby-dev:32585] SEGV by IO.pipe

以下のようにすると SEGV します。

% ./ruby -ve '
class IO
  def initialize(*x)
  end
end
IO.pipe
'
ruby 1.9.0 (2007-12-13 patchlevel 0) [i686-linux]
-e:3: warning: method redefined; discarding old initialize
-e:6: -- control frame ----------
c:0004 p:---- s:0008 b:0008 l:000007 d:000007 CFUNC  :pipe
c:0003 p:0020 s:0005 b:0005 l:000004 d:000004 TOP    -e:6
c:0002 p:---- s:0003 b:0003 l:000002 d:000002 FINISH :inherited
c:0001 p:---- s:0001 b:-001 l:000000 d:000000 ------ 
---------------------------
DBG> : "-e:6:in `<main>'"
-- backtrace of native function call (Use addr2line) --
0x80e7e20
0x8104679
0x8104712
0x80b9b90
0xffffe440
0x8070e96
0x80e5b21
0x80e70ac
0x80e6252
0x80e176b
0x80e47f0
0x80e4bba
0x805b1b9
0x805b23a
0x8058379
0xb7db6974
0x8058271
-------------------------------------------------------
[BUG] Segmentation fault
ruby 1.9.0 (2007-12-13) [i686-linux]

zsh: abort (core dumped)  ./ruby -ve ' class IO   def initialize(*x)   end end IO.pipe '
% gdb ruby core.1439
GNU gdb 6.3-debian
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-linux"...Using host libthread_db library "/lib/tls/libthread_db.so.1".

Core was generated by `./ruby -ve 
class IO
  def initialize(*x)
  end
end
IO.pipe
'.
Program terminated with signal 6, Aborted.

warning: current_sos: Can't read pathname for load map: Input/output error

Reading symbols from /lib/tls/libpthread.so.0...Reading symbols from /usr/lib/debug/lib/tls/libpthread-0.60.so...done.
done.
Loaded symbols for /lib/tls/libpthread.so.0
Reading symbols from /lib/tls/librt.so.1...Reading symbols from /usr/lib/debug/lib/tls/librt-2.3.2.so...done.
done.
Loaded symbols for /lib/tls/librt.so.1
Reading symbols from /lib/tls/libdl.so.2...Reading symbols from /usr/lib/debug/lib/tls/libdl-2.3.2.so...done.
done.
Loaded symbols for /lib/tls/libdl.so.2
Reading symbols from /lib/tls/libcrypt.so.1...Reading symbols from /usr/lib/debug/lib/tls/libcrypt-2.3.2.so...done.
done.
Loaded symbols for /lib/tls/libcrypt.so.1
Reading symbols from /lib/tls/libm.so.6...Reading symbols from /usr/lib/debug/lib/tls/libm-2.3.2.so...done.
done.
Loaded symbols for /lib/tls/libm.so.6
Reading symbols from /lib/tls/libc.so.6...Reading symbols from /usr/lib/debug/lib/tls/libc-2.3.2.so...done.
done.
Loaded symbols for /lib/tls/libc.so.6
Reading symbols from /lib/ld-linux.so.2...Reading symbols from /usr/lib/debug/lib/ld-2.3.2.so...done.
done.
Loaded symbols for /lib/ld-linux.so.2
#0  0xb7dc983b in raise () from /lib/tls/libc.so.6
(gdb) bt
#0  0xb7dc983b in raise () from /lib/tls/libc.so.6
#1  0xb7dcafa2 in abort () from /lib/tls/libc.so.6
#2  0x08104717 in rb_bug (fmt=0x6 <Address 0x6 out of bounds>) at error.c:228
#3  0x080b9b90 in sigsegv (sig=11) at signal.c:541
#4  <signal handler called>
#5  rb_io_synchronized (fptr=0x0) at io.c:3304
#6  0x08070e96 in rb_io_s_pipe (klass=0) at io.c:5517
#7  0x080e5b21 in call_cfunc (func=0x8070e00 <rb_io_s_pipe>, recv=3083910060, len=0, argc=-1078132748, argv=0xb7d1f020)
    at insnhelper.ci:286
#8  0x080e70ac in vm_call_cfunc (th=0x8172160, reg_cfp=0xb7d9ef60, num=0, id=5440, recv=3083910060, klass=3083910040, 
    flag=97, mn=0xb7d0b8c8, blockptr=0x0) at insnhelper.ci:373
#9  0x080e6252 in vm_call_method (th=0x8172160, cfp=0xb7d9ef60, num=0, blockptr=0x0, flag=0, id=5440, mn=0x0, 
    recv=3083910060, klass=3083910040) at insnhelper.ci:505
#10 0x080e176b in vm_eval (th=0x8172160, initial=0) at insns.def:1069
#11 0x080e47f0 in vm_eval_body (th=0x8172160) at vm.c:1163
#12 0x080e4bba in rb_iseq_eval (iseqval=3083817080) at vm.c:1372
#13 0x0805b1b9 in ruby_exec_node (n=0xb7cf50f0, file=0x81bb441 "-e") at eval.c:232
#14 0x0805b23a in ruby_run_node (n=0xb7cf50f0) at eval.c:262
#15 0x08058379 in main (argc=3, argv=0xbfbd0614, envp=0xbfbd0624) at main.c:30
(gdb) 
-- 
[田中 哲][たなか あきら][Tanaka Akira]