Fix interpreter crash caused by RUBY_INTERNAL_EVENT_NEWOBJ + Ractors

KJ Tsanaktsidis · byroot · commit 7bd7aee02e30 · 2023-03-09T09:46:14.000+01:00
When a Ractor is created whilst a tracepoint for
RUBY_INTERNAL_EVENT_NEWOBJ is active, the interpreter crashes. This is
because during the early setup of the Ractor, the stdio objects are
created, which allocates Ruby objects, which fires the tracepoint.
However, the tracepoint machinery tries to dereference the control frame
(ec-&gt;cfp-&gt;pc), which isn't set up yet and so crashes with a null pointer
dereference.

Fix this by not firing GC tracepoints if cfp isn't yet set up.
diff --git a/gc.c b/gc.c
@@ -2484,6 +2484,7 @@ rb_objspace_set_event_hook(const rb_event_flag_t event)
 static void
 gc_event_hook_body(rb_execution_context_t *ec, rb_objspace_t *objspace, const rb_event_flag_t event, VALUE data)
 {
+    if (UNLIKELY(!ec->cfp)) return;
     const VALUE *pc = ec->cfp->pc;
     if (pc && VM_FRAME_RUBYFRAME_P(ec->cfp)) {
         int prev_opcode = rb_vm_insn_addr2opcode((void *)*ec->cfp->iseq->body->iseq_encoded);
diff --git a/test/objspace/test_ractor.rb b/test/objspace/test_ractor.rb
@@ -0,0 +1,17 @@
+require "test/unit"
+
+class TestObjSpaceRactor < Test::Unit::TestCase
+    def test_tracing_does_not_crash
+        assert_ractor(<<~RUBY, require: 'objspace')
+            ObjectSpace.trace_object_allocations do
+                r = Ractor.new do
+                    obj = 'a' * 1024
+                    Ractor.yield obj
+                end
+
+                r.take
+                r.take
+            end
+        RUBY
+    end
+end

Original file line number	Diff line number	Diff line change
`@@ -2484,6 +2484,7 @@ rb_objspace_set_event_hook(const rb_event_flag_t event)`
`2484`	`2484`	`static void`
`2485`	`2485`	`gc_event_hook_body(rb_execution_context_t ec, rb_objspace_t objspace, const rb_event_flag_t event, VALUE data)`
`2486`	`2486`	`{`
	`2487`	`+ if (UNLIKELY(!ec->cfp)) return;`
`2487`	`2488`	`const VALUE *pc = ec->cfp->pc;`
`2488`	`2489`	`if (pc && VM_FRAME_RUBYFRAME_P(ec->cfp)) {`
`2489`	`2490`	`int prev_opcode = rb_vm_insn_addr2opcode((void )ec->cfp->iseq->body->iseq_encoded);`