[ruby-dev:35616] Re: [Bug:1.9] context switch may occur during freeing io

なかだです。

At Sun, 20 Jul 2008 08:27:35 +0900,
Nobuyoshi Nakada wrote in [ruby-dev:35594]:
> > と呼び出しが進んで、GC 中に他のスレッドが動き出してしまうためです。
> 
> T_DATAのdfreeとfptr_finalizeはdeferredに回しましょうか。

ObjectSpaceから見えてしまうとまずいので、訂正です。


Index: gc.c
===================================================================
--- gc.c	(revision 18139)
+++ gc.c	(working copy)
@@ -1317,4 +1317,7 @@ gc_mark_children(rb_objspace_t *objspace
 	break;
 
+      case T_UNDEF:
+	break;
+
       default:
 	rb_bug("rb_gc_mark(): unknown data type 0x%lx(%p) %s",
@@ -1324,5 +1327,5 @@ gc_mark_children(rb_objspace_t *objspace
 }
 
-static void obj_free(rb_objspace_t *, VALUE);
+static int obj_free(rb_objspace_t *, VALUE);
 
 static void
@@ -1402,9 +1405,7 @@ gc_sweep(rb_objspace_t *objspace)
 	while (p < pend) {
 	    if (!(p->as.basic.flags & FL_MARK)) {
-		if (p->as.basic.flags) {
-		    obj_free(objspace, (VALUE)p);
-		}
-		if (need_call_final && FL_TEST(p, FL_FINALIZE)) {
-		    p->as.free.flags = FL_MARK; /* remain marked */
+		if (p->as.basic.flags && obj_free(objspace, (VALUE)p) ||
+		    need_call_final && FL_TEST(p, FL_FINALIZE)) {
+		    p->as.free.flags |= FL_MARK; /* remain marked */
 		    p->as.free.next = final_list;
 		    final_list = p;
@@ -1470,5 +1471,5 @@ rb_gc_force_recycle(VALUE p)
 }
 
-static void
+static int
 obj_free(rb_objspace_t *objspace, VALUE obj)
 {
@@ -1527,5 +1528,7 @@ obj_free(rb_objspace_t *objspace, VALUE 
 	    }
 	    else if (RANY(obj)->as.data.dfree) {
-		(*RANY(obj)->as.data.dfree)(DATA_PTR(obj));
+		RANY(obj)->as.basic.flags &= ~T_MASK;
+		RANY(obj)->as.basic.flags |= T_UNDEF;
+		return 1;
 	    }
 	}
@@ -1542,5 +1545,10 @@ obj_free(rb_objspace_t *objspace, VALUE 
       case T_FILE:
 	if (RANY(obj)->as.file.fptr) {
-	    rb_io_fptr_finalize(RANY(obj)->as.file.fptr);
+	    rb_io_t *fptr = RANY(obj)->as.file.fptr;
+	    RANY(obj)->as.basic.flags &= ~T_MASK;
+	    RANY(obj)->as.basic.flags |= T_UNDEF;
+	    RDATA(obj)->dfree = (void (*)(void*))rb_io_fptr_finalize;
+	    RDATA(obj)->data = fptr;
+	    return 1;
 	}
 	break;
@@ -1571,5 +1579,5 @@ obj_free(rb_objspace_t *objspace, VALUE 
 	    break;
 	}
-	return;			/* no need to free iv_tbl */
+	break;			/* no need to free iv_tbl */
 
       case T_STRUCT:
@@ -1580,8 +1588,13 @@ obj_free(rb_objspace_t *objspace, VALUE 
 	break;
 
+      case T_UNDEF:
+	break;
+
       default:
 	rb_bug("gc_sweep(): unknown data type 0x%lx(%p)",
 	       RANY(obj)->as.basic.flags & T_MASK, (void*)obj);
     }
+    RANY(obj)->as.basic.flags &= ~T_MASK;
+    return 0;
 }
 
@@ -1855,4 +1868,5 @@ os_obj_of(rb_objspace_t *objspace, VALUE
 		  case T_ICLASS:
 		  case T_NODE:
+		  case T_UNDEF:
 		    continue;
 		  case T_CLASS:
@@ -2010,4 +2024,7 @@ run_final(rb_objspace_t *objspace, VALUE
     objid = rb_obj_id(obj);	/* make obj into id */
     rb_thread_critical = Qtrue;
+    if ((RANY(obj)->as.basic.flags & T_MASK) == T_UNDEF) {
+	(*RANY(obj)->as.data.dfree)(DATA_PTR(obj));
+    }
     args[1] = 0;
     args[2] = (VALUE)rb_safe_level();


-- 
--- 僕の前にBugはない。
--- 僕の後ろにBugはできる。
    中田 伸悦