[ruby-dev:36698] Segmentation fault in eval

西山和広です。

http://d.hatena.ne.jp/mamamoto/20081007/1223349255
のスクリプトを元にいじっていたらs="n=$*"で落ちました。

最小までは絞っていませんが、ある程度絞りこんで
再現スクリプトは以下のようになりました。

% cat b.rb
#/usr/bin/ruby
def f(s)
  n = 0
  eval(s)
rescue Exception
  nil
end

a = %w[= $ *]

9.times{|i|
  a.permutation(i+1){|b|
    c = %w[n]
    d = b + c
    c.size.step(0, -1){|j|
      d.permutation(d.size-j){|e|
        f(e.join)
      }
    }
  }
}
% ruby-trunk b.rb
(eval):1: warning: variable $= is no longer effective
(eval):1: warning: variable $= is no longer effective
(eval):1: warning: variable $= is no longer effective
(eval):1: warning: variable $= is no longer effective
(eval):1: warning: variable $= is no longer effective
(eval):1: warning: variable $= is no longer effective
(eval):1: [BUG] Segmentation fault
ruby 1.9.0 (2008-10-09 revision 19722) [i686-linux]

-- control frame ----------
c:0019 p:0004 s:0050 b:0050 l:000041 d:000049 EVAL   (eval):1
c:0018 p:---- s:0048 b:0048 l:000047 d:000047 FINISH :===
c:0017 p:---- s:0046 b:0046 l:000045 d:000045 CFUNC  :eval
c:0016 p:0019 s:0042 b:0042 l:000041 d:000041 METHOD b.rb:4
c:0015 p:0018 s:0037 b:0037 l:000006 d:000036 BLOCK  b.rb:16
c:0014 p:---- s:0036 b:0036 l:000035 d:000035 FINISH
c:0013 p:---- s:0034 b:0034 l:000033 d:000033 CFUNC  :permutation
c:0012 p:0024 s:0030 b:0030 l:000006 d:000029 BLOCK  b.rb:16
c:0011 p:---- s:0029 b:0029 l:000028 d:000028 FINISH :==
c:0010 p:---- s:0027 b:0027 l:000026 d:000026 CFUNC  :step
c:0009 p:0042 s:0022 b:0022 l:000006 d:000021 BLOCK  b.rb:15
c:0008 p:---- s:0019 b:0019 l:000018 d:000018 FINISH :remove_const
c:0007 p:---- s:0017 b:0017 l:000016 d:000016 CFUNC  :permutation
c:0006 p:0017 s:0013 b:0013 l:000006 d:000012 BLOCK  b.rb:12
c:0005 p:---- s:0012 b:0012 l:000011 d:000011 FINISH :class_eval
c:0004 p:---- s:0010 b:0010 l:000009 d:000009 CFUNC  :times
c:0003 p:0039 s:0007 b:0007 l:000006 d:000006 TOP    b.rb:11
c:0002 p:---- s:0004 b:0004 l:000003 d:000003 FINISH :inherited
c:0001 p:0000 s:0002 b:0002 l:000001 d:000001 TOP    <dummy toplevel>:17
---------------------------
DBG> : "(eval):1:in `f'"
DBG> : "b.rb:4:in `eval'"
DBG> : "b.rb:4:in `f'"
DBG> : "b.rb:16:in `block (4 levels) in <main>'"
DBG> : "b.rb:16:in `permutation'"
DBG> : "b.rb:16:in `block (3 levels) in <main>'"
DBG> : "b.rb:15:in `step'"
DBG> : "b.rb:15:in `block (2 levels) in <main>'"
DBG> : "b.rb:12:in `permutation'"
DBG> : "b.rb:12:in `block in <main>'"
DBG> : "b.rb:11:in `times'"
DBG> : "b.rb:11:in `<main>'"
-- backtrace of native function call (Use addr2line) --
0xb7ed13d7
0xb7df4053
0xb7df40c9
0xb7e7c5d9
0xb7f30440
0xb7ec5312
0xb7ecc1b8
0xb7ecd595
0xb7ecdba1
0xb7ecdcf8
0xb7ec02d3
0xb7ecee98
0xb7ec77bb
0xb7ecc1b8
0xb7ecc818
0xb7eccff5
0xb7dd1bc7
0xb7dd1b49
0xb7dd1b49
0xb7dd1b49
0xb7dd68ea
0xb7ec02d3
0xb7ecee98
0xb7ec77bb
0xb7ecc1b8
0xb7ecc818
0xb7eccff5
0xb7e26fe4
0xb7ec02d3
0xb7ecee98
0xb7ec77bb
0xb7ecc1b8
0xb7ecc818
0xb7eccff5
0xb7dd1bc7
0xb7dd1b49
0xb7dd1b49
0xb7dd68ea
0xb7ec02d3
0xb7ecee98
0xb7ec77bb
0xb7ecc1b8
0xb7ecc818
0xb7eccff5
0xb7e225bf
0xb7ec02be
0xb7ecee98
0xb7ec77bb
0xb7ecc1b8
0xb7ecc3fd
0xb7df62af
0xb7df7d12
0x8048734
0xb7c1eea8
0x8048631
-------------------------------------------------------
[1]    31871 abort      ruby-trunk b.rb
%


-- 
|ZnZ(ゼット エヌ ゼット)
|西山和広(Kazuhiro NISHIYAMA)