Bug #16196: `RUBY_DEBUG=gc_stress ruby -ropenssl` dumps core

• Status: Closed
• Assignee: tenderlovemaking (Aaron Patterson)
• Target version: -
• ruby -v: ruby 2.7.0dev (2019-10-01 trunk 878a06efec) [x86_64-linux]
• Backport: 2.5: DONE, 2.6: DONE

[shyouhei (Shyouhei Urabe)]

% RUBY_DEBUG=gc_stress gdb --args ruby --disable-gems -ropenssl -ve0
GNU gdb (Ubuntu 8.2-0ubuntu1~18.04) 8.2
Copyright (C) 2018 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
    <http://www.gnu.org/software/gdb/documentation/>.

For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from ruby...done.
(gdb) run
Starting program: ruby --disable-gems -ropenssl -ve0
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
ruby 2.7.0dev (2019-10-01 trunk 878a06efec) [x86_64-linux]
last_commit=add comments [ci skip]

Program received signal SIGSEGV, Segmentation fault.
do_hash (key=93824998647120, tab=0x555555d0ee80) at st.c:326
326         st_hash_t hash = (st_hash_t)(tab->type->hash)(key);
(gdb) p *tab
$1 = {entry_power = 216 '\330', bin_power = 16 '\020', size_ind = 183 '\267', rebuilds_num = 21845, type = 0x1, num_entries = 1, bins = 0x0, entries_start = 0, entries_bound = 1, entries = 0x555555d0eec0}
(gdb) rp tab
unknown: $2 = (struct RBasic *) 0x555555d0ee80
(gdb) fr 5
#5  0x00007ffff2ace30f in Init_ossl_asn1 () at ext/openssl/ossl_asn1.c:1829
1829        rb_hash_aset(class_tag_map, cASN1Boolean, INT2NUM(V_ASN1_BOOLEAN));
(gdb) rp class_tag_map
[PROMOTED] T_HASH: st len=1 $3 = (struct RHash *) 0x555555b70d90
(gdb) rp (R_CAST(RHash)class_tag_map)->as.st
unknown: $4 = (struct RBasic *) 0x555555d0ee80
(gdb) bt
#0  do_hash (key=93824998647120, tab=0x555555d0ee80) at st.c:326
#1  0x00005555556d6fe7 in rb_st_update (tab=0x555555d0ee80, key=93824998647120, func=0x5555555a99b6 <hash_aset_insert>, arg=140737488329232) at st.c:1480
#2  0x00005555555a7efd in rb_hash_stlike_update (hash=93824998641040, key=93824998647120, func=0x5555555a99b6 <hash_aset_insert>, arg=140737488329232) at hash.c:1647
#3  0x00005555555a7f6e in tbl_update (hash=93824998641040, key=93824998647120, func=0x5555555a99b6 <hash_aset_insert>, optional_arg=3) at hash.c:1663
#4  0x00005555555a9b15 in rb_hash_aset (hash=93824998641040, key=93824998647120, val=3) at hash.c:2802
#5  0x00007ffff2ace30f in Init_ossl_asn1 () at ext/openssl/ossl_asn1.c:1829
#6  0x00007ffff2ac9832 in Init_openssl () at ext/openssl/ossl.c:1211
#7  0x000055555577a770 in dln_load (file=0x555555c9e8c0 "lib/ruby/2.7.0/x86_64-linux/openssl.so") at dln.c:1371
#8  0x00005555555db967 in load_ext (path=93824998555680) at load.c:944
#9  0x0000555555767095 in rb_vm_call_cfunc (recv=93824998923520, func=0x5555555db926 <load_ext>, arg=93824998555680, block_handler=0, filename=93824998555680) at vm.c:2199
#10 0x00005555555dbec9 in require_internal (ec=0x555555b58670, fname=93824998556400, safe=0, exception=1) at load.c:1034
#11 0x00005555555dc220 in rb_require_safe (fname=93824998556680, safe=0) at load.c:1100
#12 0x00005555555db2a5 in rb_f_require (obj=93824998923520, fname=93824998556680) at load.c:819
#13 0x00005555557469bd in call_cfunc_1 (recv=93824998923520, argc=1, argv=0x7ffff7ed0060, func=0x5555555db280 <rb_f_require>) at vm_insnhelper.c:2113
#14 0x00005555557475b5 in vm_call_cfunc_with_frame (ec=0x555555b58670, reg_cfp=0x7ffff7fcff68, calling=0x7fffffffa040, ci=0x555555c49150, cc=0x555555c47dd0, empty_kw_splat=0) at vm_insnhelper.c:2276
#15 0x000055555574778e in vm_call_cfunc (ec=0x555555b58670, reg_cfp=0x7ffff7fcff68, calling=0x7fffffffa040, ci=0x555555c49150, cc=0x555555c47dd0) at vm_insnhelper.c:2300
#16 0x0000555555748b16 in vm_call_method_each_type (ec=0x555555b58670, cfp=0x7ffff7fcff68, calling=0x7fffffffa040, ci=0x555555c49150, cc=0x555555c47dd0) at vm_insnhelper.c:2677
#17 0x0000555555749123 in vm_call_method (ec=0x555555b58670, cfp=0x7ffff7fcff68, calling=0x7fffffffa040, ci=0x555555c49150, cc=0x555555c47dd0) at vm_insnhelper.c:2786
#18 0x0000555555749285 in vm_call_general (ec=0x555555b58670, reg_cfp=0x7ffff7fcff68, calling=0x7fffffffa040, ci=0x555555c49150, cc=0x555555c47dd0) at vm_insnhelper.c:2819
#19 0x000055555574b450 in vm_sendish (ec=0x555555b58670, reg_cfp=0x7ffff7fcff68, ci=0x555555c49150, cc=0x555555c47dd0, block_handler=0, method_explorer=0x55555574b2cf <vm_search_method_wrap>) at vm_insnhelper.c:3759
#20 0x00005555557516e4 in vm_exec_core (ec=0x555555b58670, initial=0) at insns.def:810
#21 0x00005555557660f7 in rb_vm_exec (ec=0x555555b58670, mjit_enable_p=1) at vm.c:1894
#22 0x0000555555766eac in rb_iseq_eval (iseq=0x555555b5c048) at vm.c:2142
#23 0x00005555555daa7f in load_iseq_eval (ec=0x555555b58670, fname=93824998556920) at load.c:593
#24 0x00005555555dbe84 in require_internal (ec=0x555555b58670, fname=93824998571080, safe=0, exception=1) at load.c:1030
#25 0x00005555555dc220 in rb_require_safe (fname=93824998571080, safe=0) at load.c:1100
#26 0x00005555555db2a5 in rb_f_require (obj=93824998923520, fname=93824998571080) at load.c:819
#27 0x00005555557469bd in call_cfunc_1 (recv=93824998923520, argc=1, argv=0x7fffffffb510, func=0x5555555db280 <rb_f_require>) at vm_insnhelper.c:2113
#28 0x000055555575bdb5 in vm_call0_cfunc_with_frame (ec=0x555555b58670, calling=0x7fffffffb340, ci=0x7fffffffb330, cc=0x7fffffffb360, argv=0x7fffffffb510) at vm_eval.c:100
#29 0x000055555575bf37 in vm_call0_cfunc (ec=0x555555b58670, calling=0x7fffffffb340, ci=0x7fffffffb330, cc=0x7fffffffb360, argv=0x7fffffffb510) at vm_eval.c:114
#30 0x000055555575c0bb in vm_call0_body (ec=0x555555b58670, calling=0x7fffffffb340, ci=0x7fffffffb330, cc=0x7fffffffb360, argv=0x7fffffffb510) at vm_eval.c:146
#31 0x000055555575ba32 in rb_vm_call0 (ec=0x555555b58670, recv=93824998923520, id=21313, argc=1, argv=0x7fffffffb510, me=0x555555b5f6d0, kw_splat=0) at vm_eval.c:63
#32 0x000055555575c8e2 in rb_vm_call_kw (ec=0x555555b58670, recv=93824998923520, id=21313, argc=1, argv=0x7fffffffb510, me=0x555555b5f6d0, kw_splat=0) at vm_eval.c:277
#33 0x000055555575cc5b in rb_call0 (ec=0x555555b58670, recv=93824998923520, mid=21313, argc=1, argv=0x7fffffffb510, call_scope=CALL_FCALL, self=93824998923520) at vm_eval.c:401
#34 0x000055555575d8bb in rb_call (recv=93824998923520, mid=21313, argc=1, argv=0x7fffffffb510, scope=CALL_FCALL) at vm_eval.c:725
#35 0x000055555575e178 in rb_funcallv (recv=93824998923520, mid=21313, argc=1, argv=0x7fffffffb510) at vm_eval.c:965
#36 0x00005555556c4767 in require_libraries (req_list=0x7fffffffc708) at ruby.c:706
#37 0x00005555556c78c6 in process_options (argc=0, argv=0x7fffffffc948, opt=0x7fffffffc6c0) at ruby.c:1791
#38 0x00005555556c900b in ruby_process_options (argc=4, argv=0x7fffffffc928) at ruby.c:2388
#39 0x000055555557cc59 in ruby_options (argc=4, argv=0x7fffffffc928) at eval.c:123
#40 0x000055555557994d in main (argc=4, argv=0x7fffffffc928) at main.c:50
(gdb)

It seems to me that rb_global_variable is not working.

[shyouhei (Shyouhei Urabe)]

I still observe this behaviour. Can someone confirm?

[nobu (Nobuyoshi Nakada)]

• Status changed from Open to Closed

Applied in changeset git|203b7fa1ae8cc40d41c38d684f70b3fea7fae813.

---

Guard static variable first

• ext/openssl/ossl_asn1.c (Init_ossl_asn1): register the static
  variable to grab an internal object, before creating the object.
  otherwise the just-created object could get collected during the
  global variable list allocation. [Bug #16196]

[nobu (Nobuyoshi Nakada)]

• Backport changed from 2.5: UNKNOWN, 2.6: UNKNOWN to 2.5: REQUIRED, 2.6: REQUIRED

[nagachika (Tomoyuki Chikanaga)]

• Backport changed from 2.5: REQUIRED, 2.6: REQUIRED to 2.5: REQUIRED, 2.6: DONE

ruby_2_6 r67834 merged revision(s) 203b7fa1ae8cc40d41c38d684f70b3fea7fae813,0131fab749fb76800de09e49a6abf910201c5b58,9c0cd5c569ba22bc68d1a77ad6580a275cd99639,c144d7215b3444fa36d28d540b60170a5b30743d.

[usa (Usaku NAKAMURA)]

• Backport changed from 2.5: REQUIRED, 2.6: DONE to 2.5: DONE, 2.6: DONE