From: Tanaka Akira <akr@...>
Date: 2009-10-17T09:01:45+09:00
Subject: [ruby-dev:39501] [bug:trunk] invalid memory access in 100**900

以下のように、100**900 を計算すると変なところをアクセスするようです。

% valgrind ./ruby -ve '100**900'
==30546== Memcheck, a memory error detector.
==30546== Copyright (C) 2002-2007, and GNU GPL'd, by Julian Seward et al.
==30546== Using LibVEX rev 1854, a library for dynamic binary translation.
==30546== Copyright (C) 2004-2007, and GNU GPL'd, by OpenWorks LLP.
==30546== Using valgrind-3.3.1-Debian, a dynamic binary instrumentation framework.
==30546== Copyright (C) 2000-2007, and GNU GPL'd, by Julian Seward et al.
==30546== For more details, rerun with: -v
==30546== 
ruby 1.9.2dev (2009-10-17 trunk 25379) [i686-linux]
==30546== Invalid read of size 1
==30546==    at 0x4024980: memcpy (mc_replace_strmem.c:402)
==30546==    by 0x816D731: big_split (bignum.c:1851)
==30546==    by 0x816D8D4: bigmul1_karatsuba (bignum.c:1874)
==30546==    by 0x816E549: bigmul0 (bignum.c:2055)
==30546==    by 0x816FC3B: bigsqr (bignum.c:2552)
==30546==    by 0x816FF06: rb_big_pow (bignum.c:2604)
==30546==    by 0x80894C5: int_pow (numeric.c:2451)
==30546==    by 0x80896E1: fix_pow (numeric.c:2508)
==30546==    by 0x81464CC: call_cfunc (vm_insnhelper.c:292)
==30546==    by 0x8146346: vm_call_cfunc (vm_insnhelper.c:386)
==30546==    by 0x8145885: vm_call_method (vm_insnhelper.c:511)
==30546==    by 0x8141559: vm_exec_core (insns.def:994)
==30546==  Address 0x442a1e3 is 3 bytes after a block of size 376 alloc'd
==30546==    at 0x4023E8C: realloc (vg_replace_malloc.c:429)
==30546==    by 0x80635EF: vm_xrealloc (gc.c:699)
==30546==    by 0x8063734: ruby_xrealloc (gc.c:761)
==30546==    by 0x8063783: ruby_xrealloc2 (gc.c:771)
==30546==    by 0x8168E7A: rb_big_realloc (bignum.c:120)
==30546==    by 0x8168E9B: rb_big_resize (bignum.c:129)
==30546==    by 0x8169428: bigtrunc (bignum.c:207)
==30546==    by 0x816FC43: bigsqr (bignum.c:2552)
==30546==    by 0x816FF06: rb_big_pow (bignum.c:2604)
==30546==    by 0x80894C5: int_pow (numeric.c:2451)
==30546==    by 0x80896E1: fix_pow (numeric.c:2508)
==30546==    by 0x81464CC: call_cfunc (vm_insnhelper.c:292)
==30546== 
==30546== Invalid read of size 1
==30546==    at 0x4024987: memcpy (mc_replace_strmem.c:402)
==30546==    by 0x816D731: big_split (bignum.c:1851)
==30546==    by 0x816D8D4: bigmul1_karatsuba (bignum.c:1874)
==30546==    by 0x816E549: bigmul0 (bignum.c:2055)
==30546==    by 0x816FC3B: bigsqr (bignum.c:2552)
==30546==    by 0x816FF06: rb_big_pow (bignum.c:2604)
==30546==    by 0x80894C5: int_pow (numeric.c:2451)
==30546==    by 0x80896E1: fix_pow (numeric.c:2508)
==30546==    by 0x81464CC: call_cfunc (vm_insnhelper.c:292)
==30546==    by 0x8146346: vm_call_cfunc (vm_insnhelper.c:386)
==30546==    by 0x8145885: vm_call_method (vm_insnhelper.c:511)
==30546==    by 0x8141559: vm_exec_core (insns.def:994)
==30546==  Address 0x442a1e2 is 2 bytes after a block of size 376 alloc'd
==30546==    at 0x4023E8C: realloc (vg_replace_malloc.c:429)
==30546==    by 0x80635EF: vm_xrealloc (gc.c:699)
==30546==    by 0x8063734: ruby_xrealloc (gc.c:761)
==30546==    by 0x8063783: ruby_xrealloc2 (gc.c:771)
==30546==    by 0x8168E7A: rb_big_realloc (bignum.c:120)
==30546==    by 0x8168E9B: rb_big_resize (bignum.c:129)
==30546==    by 0x8169428: bigtrunc (bignum.c:207)
==30546==    by 0x816FC43: bigsqr (bignum.c:2552)
==30546==    by 0x816FF06: rb_big_pow (bignum.c:2604)
==30546==    by 0x80894C5: int_pow (numeric.c:2451)
==30546==    by 0x80896E1: fix_pow (numeric.c:2508)
==30546==    by 0x81464CC: call_cfunc (vm_insnhelper.c:292)
==30546== 
==30546== Invalid read of size 1
==30546==    at 0x4024990: memcpy (mc_replace_strmem.c:402)
==30546==    by 0x816D731: big_split (bignum.c:1851)
==30546==    by 0x816D8D4: bigmul1_karatsuba (bignum.c:1874)
==30546==    by 0x816E549: bigmul0 (bignum.c:2055)
==30546==    by 0x816FC3B: bigsqr (bignum.c:2552)
==30546==    by 0x816FF06: rb_big_pow (bignum.c:2604)
==30546==    by 0x80894C5: int_pow (numeric.c:2451)
==30546==    by 0x80896E1: fix_pow (numeric.c:2508)
==30546==    by 0x81464CC: call_cfunc (vm_insnhelper.c:292)
==30546==    by 0x8146346: vm_call_cfunc (vm_insnhelper.c:386)
==30546==    by 0x8145885: vm_call_method (vm_insnhelper.c:511)
==30546==    by 0x8141559: vm_exe: int_pow (numeric.c:2451)
==30546==    by 0x80896E1: fix_pow (numeric.c:2508)
==30546==    by 0x81464CC: call_cfunc (vm_insnhelper.c:292)
==30546== 
==30546== ERROR SUMMARY: 4 errors from 4 contexts (suppressed: 29 from 1)
==30546== malloc/free: in use at exit: 607,758 bytes in 14,322 blocks.
==30546== malloc/free: 15,588 allocs, 1,266 frees, 1,628,891 bytes allocated.
==30546== For counts of detected errors, rerun with: -v
==30546== searching for pointers to 14,322 not-freed blocks.
==30546== checked 447,132 bytes.
==30546== 
==30546== LEAK SUMMARY:
==30546==    definitely lost: 464,272 bytes in 9,660 blocks.
==30546==      possibly lost: 0 bytes in 0 blocks.
==30546==    still reachable: 143,486 bytes in 4,662 blocks.
==30546==         suppressed: 0 bytes in 0 blocks.
==30546== Rerun with --leak-check=full to see details of leaked memory.
-- 
[田中 哲][たなか あきら][Tanaka Akira]