Bug #15913: Segmentation fault in using RubyVM::InstructionSequence#to_binary.

• Status: Closed
• Assignee: -
• Target version: -
• ruby -v: ruby 2.5.1p57 (2018-03-29 revision 63029) [x86_64-darwin18]
• Backport: 2.4: UNKNOWN, 2.5: UNKNOWN, 2.6: UNKNOWN

Occur Segmentation fault when the ruby code is class methods with hash argument in if false statement in iteration methods into RubyVM::InstructionSequence.compile.

# good
RubyVM::InstructionSequence.compile('puts "Hello, World"').to_binary
RubyVM::InstructionSequence.compile('{}.each {|this| Hash.new({id: 1})}').to_binary

# bad
RubyVM::InstructionSequence.compile('{}.each   {|this| if false; Hash.new({id: 1}); end }').to_binary
RubyVM::InstructionSequence.compile('{}.map    {|this| if false; Hash.new({id: 1}); end }').to_binary
RubyVM::InstructionSequence.compile('{}.select {|this| if false; Hash.new({id: 1}); end }').to_binary
RubyVM::InstructionSequence.compile('{}.each_with_index {|this, i| if false; Hash.new({id: 1}); end }').to_binary
# ... and more iterator methods

Crash log

 $ ruby -e "RubyVM::InstructionSequence.compile('{}.each   {|this| if false; Hash.try_convert({id: 1}); end }').to_binary"

-e:1: [BUG] Segmentation fault at 0x0000000000000000
ruby 2.5.1p57 (2018-03-29 revision 63029) [x86_64-darwin18]

-- Crash Report log information --------------------------------------------
   See Crash Report log file under the one of following:                    
     * ~/Library/Logs/DiagnosticReports                                     
     * /Library/Logs/DiagnosticReports                                      
   for more details.                                                        
Don't forget to include the above Crash Report log file in bug reports.     

-- Control frame information -----------------------------------------------
c:0003 p:---- s:0010 e:000009 CFUNC  :to_binary
c:0002 p:0017 s:0006 e:000005 EVAL   -e:1 [FINISH]
c:0001 p:0000 s:0003 E:000270 (none) [FINISH]

-- Ruby level backtrace information ----------------------------------------
-e:1:in `<main>'
-e:1:in `to_binary'

-- Machine register context ------------------------------------------------
 rax: 0x00007ffee6e93dd0 rbx: 0x0000000000000000 rcx: 0x0000000000000000
 rdx: 0x00007ffee6e93de0 rdi: 0x00007ffee6e93dd0 rsi: 0x00007fd72bd97270
 rbp: 0x00007ffee6e93e60 rsp: 0x00007ffee6e93dd0  r8: 0x00007fd72bd00000
  r9: 0x00184a4000800000 r10: 0x0000000000000018 r11: 0x00000027bb0fcb60
 r12: 0x0000000000000054 r13: 0x00007fd72bd96d70 r14: 0x0000000000000000
 r15: 0x0000000000000001 rip: 0x0000000108dbce3e rfl: 0x0000000000010246

-- C level backtrace information -------------------------------------------
0   ruby                                0x0000000108f68507 rb_vm_bugreport + 135
1   ruby                                0x0000000108ddfb53 rb_bug_context + 467
2   ruby                                0x0000000108ed5ef1 sigsegv + 81
3   libsystem_platform.dylib            0x00007fff7e1a0b5d _sigtramp + 29
4   ruby                                0x0000000108dbce3e ibf_dump_ci_entries + 270
5   ruby                                0x0000000108da390c ibf_dump_iseq + 876
6   ruby                                0x0000000108dbc692 ibf_dump_code + 402
7   ruby                                0x0000000108da37eb ibf_dump_iseq + 587
8   ruby                                0x0000000108da314d iseq_ibf_dump + 397
9   ruby                                0x0000000108e2d94a iseqw_to_binary + 74
10  ruby                                0x0000000108f5aff7 vm_call_cfunc + 295
11  ruby                                0x0000000108f426de vm_exec_core + 13262
12  ruby                                0x0000000108f55680 vm_exec + 144
13  ruby                                0x0000000108de9b31 ruby_exec_internal + 177
14  ruby                                0x0000000108de9a28 ruby_run_node + 56
15  ruby                                0x0000000108d6a47f main + 79

-- Other runtime information -----------------------------------------------

* Loaded script: -e

* Loaded features:

    0 enumerator.so
    1 thread.rb
    2 rational.so
    3 complex.so
    4 /usr/local/var/rbenv/versions/2.5.1/lib/ruby/2.5.0/x86_64-darwin18/enc/encdb.bundle
    5 /usr/local/var/rbenv/versions/2.5.1/lib/ruby/2.5.0/x86_64-darwin18/enc/trans/transdb.bundle
    6 /usr/local/var/rbenv/versions/2.5.1/lib/ruby/2.5.0/x86_64-darwin18/rbconfig.rb
    7 /usr/local/var/rbenv/versions/2.5.1/lib/ruby/site_ruby/2.5.0/rubygems/compatibility.rb
    8 /usr/local/var/rbenv/versions/2.5.1/lib/ruby/site_ruby/2.5.0/rubygems/defaults.rb
    9 /usr/local/var/rbenv/versions/2.5.1/lib/ruby/site_ruby/2.5.0/rubygems/deprecate.rb
   10 /usr/local/var/rbenv/versions/2.5.1/lib/ruby/site_ruby/2.5.0/rubygems/errors.rb
   11 /usr/local/var/rbenv/versions/2.5.1/lib/ruby/site_ruby/2.5.0/rubygems/version.rb
   12 /usr/local/var/rbenv/versions/2.5.1/lib/ruby/site_ruby/2.5.0/rubygems/requirement.rb
   13 /usr/local/var/rbenv/versions/2.5.1/lib/ruby/site_ruby/2.5.0/rubygems/platform.rb
   14 /usr/local/var/rbenv/versions/2.5.1/lib/ruby/site_ruby/2.5.0/rubygems/basic_specification.rb
   15 /usr/local/var/rbenv/versions/2.5.1/lib/ruby/site_ruby/2.5.0/rubygems/stub_specification.rb
   16 /usr/local/var/rbenv/versions/2.5.1/lib/ruby/2.5.0/delegate.rb
   17 /usr/local/var/rbenv/versions/2.5.1/lib/ruby/2.5.0/uri/rfc2396_parser.rb
   18 /usr/local/var/rbenv/versions/2.5.1/lib/ruby/2.5.0/uri/rfc3986_parser.rb
   19 /usr/local/var/rbenv/versions/2.5.1/lib/ruby/2.5.0/uri/common.rb
   20 /usr/local/var/rbenv/versions/2.5.1/lib/ruby/2.5.0/uri/generic.rb
   21 /usr/local/var/rbenv/versions/2.5.1/lib/ruby/2.5.0/uri/ftp.rb
   22 /usr/local/var/rbenv/versions/2.5.1/lib/ruby/2.5.0/uri/http.rb
   23 /usr/local/var/rbenv/versions/2.5.1/lib/ruby/2.5.0/uri/https.rb
   24 /usr/local/var/rbenv/versions/2.5.1/lib/ruby/2.5.0/uri/ldap.rb
   25 /usr/local/var/rbenv/versions/2.5.1/lib/ruby/2.5.0/uri/ldaps.rb
   26 /usr/local/var/rbenv/versions/2.5.1/lib/ruby/2.5.0/uri/mailto.rb
   27 /usr/local/var/rbenv/versions/2.5.1/lib/ruby/2.5.0/uri.rb
   28 /usr/local/var/rbenv/versions/2.5.1/lib/ruby/site_ruby/2.5.0/rubygems/specification_policy.rb
   29 /usr/local/var/rbenv/versions/2.5.1/lib/ruby/site_ruby/2.5.0/rubygems/util/list.rb
   30 /usr/local/var/rbenv/versions/2.5.1/lib/ruby/2.5.0/x86_64-darwin18/stringio.bundle
   31 /usr/local/var/rbenv/versions/2.5.1/lib/ruby/site_ruby/2.5.0/rubygems/specification.rb
   32 /usr/local/var/rbenv/versions/2.5.1/lib/ruby/site_ruby/2.5.0/rubygems/exceptions.rb
   33 /usr/local/var/rbenv/versions/2.5.1/lib/ruby/site_ruby/2.5.0/rubygems/util.rb
   34 /usr/local/var/rbenv/versions/2.5.1/lib/ruby/site_ruby/2.5.0/rubygems/bundler_version_finder.rb
   35 /usr/local/var/rbenv/versions/2.5.1/lib/ruby/site_ruby/2.5.0/rubygems/dependency.rb
   36 /usr/local/var/rbenv/versions/2.5.1/lib/ruby/site_ruby/2.5.0/rubygems/core_ext/kernel_gem.rb
   37 /usr/local/var/rbenv/versions/2.5.1/lib/ruby/2.5.0/monitor.rb
   38 /usr/local/var/rbenv/versions/2.5.1/lib/ruby/site_ruby/2.5.0/rubygems/core_ext/kernel_require.rb
   39 /usr/local/var/rbenv/versions/2.5.1/lib/ruby/site_ruby/2.5.0/rubygems/core_ext/kernel_warn.rb
   40 /usr/local/var/rbenv/versions/2.5.1/lib/ruby/site_ruby/2.5.0/rubygems.rb
   41 /usr/local/var/rbenv/versions/2.5.1/lib/ruby/site_ruby/2.5.0/rubygems/path_support.rb
   42 /usr/local/var/rbenv/versions/2.5.1/lib/ruby/gems/2.5.0/gems/did_you_mean-1.2.0/lib/did_you_mean/version.rb
   43 /usr/local/var/rbenv/versions/2.5.1/lib/ruby/gems/2.5.0/gems/did_you_mean-1.2.0/lib/did_you_mean/core_ext/name_error.rb
   44 /usr/local/var/rbenv/versions/2.5.1/lib/ruby/gems/2.5.0/gems/did_you_mean-1.2.0/lib/did_you_mean/levenshtein.rb
   45 /usr/local/var/rbenv/versions/2.5.1/lib/ruby/gems/2.5.0/gems/did_you_mean-1.2.0/lib/did_you_mean/jaro_winkler.rb
   46 /usr/local/var/rbenv/versions/2.5.1/lib/ruby/gems/2.5.0/gems/did_you_mean-1.2.0/lib/did_you_mean/spell_checker.rb
   47 /usr/local/var/rbenv/versions/2.5.1/lib/ruby/gems/2.5.0/gems/did_you_mean-1.2.0/lib/did_you_mean/spell_checkers/name_error_checkers/class_name_checker.rb
   48 /usr/local/var/rbenv/versions/2.5.1/lib/ruby/gems/2.5.0/gems/did_you_mean-1.2.0/lib/did_you_mean/spell_checkers/name_error_checkers/variable_name_checker.rb
   49 /usr/local/var/rbenv/versions/2.5.1/lib/ruby/gems/2.5.0/gems/did_you_mean-1.2.0/lib/did_you_mean/spell_checkers/name_error_checkers.rb
   50 /usr/local/var/rbenv/versions/2.5.1/lib/ruby/gems/2.5.0/gems/did_you_mean-1.2.0/lib/did_you_mean/spell_checkers/method_name_checker.rb
   51 /usr/local/var/rbenv/versions/2.5.1/lib/ruby/gems/2.5.0/gems/did_you_mean-1.2.0/lib/did_you_mean/spell_checkers/key_error_checker.rb
   52 /usr/local/var/rbenv/versions/2.5.1/lib/ruby/gems/2.5.0/gems/did_you_mean-1.2.0/lib/did_you_mean/spell_checkers/null_checker.rb
   53 /usr/local/var/rbenv/versions/2.5.1/lib/ruby/gems/2.5.0/gems/did_you_mean-1.2.0/lib/did_you_mean/formatters/plain_formatter.rb
   54 /usr/local/var/rbenv/versions/2.5.1/lib/ruby/gems/2.5.0/gems/did_you_mean-1.2.0/lib/did_you_mean.rb

[NOTE]
You may have encountered a bug in the Ruby interpreter or extension libraries.
Bug reports are welcome.
For details: http://www.ruby-lang.org/bugreport.html

[IMPORTANT]
Don't forget to include the Crash Report log file under
DiagnosticReports directory in bug reports.

• ruby -v changed from 2.6.3 to ruby 2.6.3p62 (2019-04-16 revision 67580) [x86_64-darwin18]

• ruby -v changed from ruby 2.6.3p62 (2019-04-16 revision 67580) [x86_64-darwin18] to ruby 2.5.1p57 (2018-03-29 revision 63029) [x86_64-darwin18]

This problem occured the crash with just using if false statement pattern.

# good
  # do not use `if false` statement
  RubyVM::InstructionSequence.compile('if true; Hash.try_convert({id: 1}); end').to_binary
  RubyVM::InstructionSequence.compile('if true; Hash.new({id: 1}); end').to_binary
  RubyVM::InstructionSequence.compile('class C; def initialize(**h); end; end; if true; C.new({hoge: 1}); end').to_binary

  # do not use hash argument with classmethod
  RubyVM::InstructionSequence.compile('if false; Hash.try_convert(nil); end').to_binary
  RubyVM::InstructionSequence.compile('if false; Hash.new(nil); end').to_binary
  RubyVM::InstructionSequence.compile('class C; def initialize(**h); end; end; if false; C.new(nil); end').to_binary


# bad
  RubyVM::InstructionSequence.compile('if false; Hash.try_convert({id: 1}); end').to_binary
  RubyVM::InstructionSequence.compile('if false; Hash.new({id: 1}); end').to_binary
  RubyVM::InstructionSequence.compile('class C; def initialize(**h); end; end; if false; C.new({hoge: 1}); end').to_binary

[nobu (Nobuyoshi Nakada)]

Maybe [Bug #14553]?

[nobu (Nobuyoshi Nakada)]

• Subject changed from Segumentation fault in using RubyVM::InstructionSequence#to_binary. to Segmentation fault in using RubyVM::InstructionSequence#to_binary.

[jeremyevans0 (Jeremy Evans)]

• Status changed from Open to Closed

I've tested and confirmed this is fixed by 484cc6b3bc828a0bb62aebefd7fdc2c86cab4f57. Please update to ruby 2.5.5.

I didn't know this problem already fixed. Thanks.