Bug #18142: Segmentation fault with Ruby 3.0.2

• Status: Closed
• Assignee: k0kubun (Takashi Kokubun)
• Target version: -
• Backport: 2.6: UNKNOWN, 2.7: UNKNOWN, 3.0: UNKNOWN

[hsbt (Hiroshi SHIBATA)]

This may be similar with https://bugs.ruby-lang.org/issues/17584

I got the following error with Ruby 3.0.2+jit and fcgid gem, tDiary-5.1.6.

[BUG] Segmentation fault at 0x0000000000000027
ruby 3.0.2p107 (2021-07-07 revision 0db68f0233) [x86_64-linux]

-- Machine register context ------------------------------------------------
 RIP: 0x00007f2f63217468 RBP: 0x0000561b53017178 RSP: 0x00007f2f5f444d40
 RAX: 0x0000000000000027 RBX: 0x0000000000000000 RCX: 0x0000000000000000
 RDX: 0x0000561b53083b20 RDI: 0x0003aaa100140005 RSI: 0x0000561b519c2fa8
  R8: 0x0000000000000001  R9: 0x000000000000007c R10: 0x00007f2f580008d0
 R11: 0x00007f2f58000080 R12: 0x00007f2f63393e00 R13: 0x0000000000000001
 R14: 0x0000000000000028 R15: 0x000000000000009a EFL: 0x0000000000010246

-- C level backtrace information -------------------------------------------
/home/hsbt/.rbenv/versions/3.0.2/lib/libruby.so.3.0(rb_print_backtrace+0x11) [0x7f2f63375d73] vm_dump.c:758
/home/hsbt/.rbenv/versions/3.0.2/lib/libruby.so.3.0(rb_vm_bugreport) vm_dump.c:998
/home/hsbt/.rbenv/versions/3.0.2/lib/libruby.so.3.0(rb_bug_for_fatal_signal+0xf4) [0x7f2f63180e04] error.c:786
/home/hsbt/.rbenv/versions/3.0.2/lib/libruby.so.3.0(sigsegv+0x4d) [0x7f2f632ccc4d] signal.c:960
/lib/x86_64-linux-gnu/libc.so.6(0x7f2f62efe210) [0x7f2f62efe210]
/home/hsbt/.rbenv/versions/3.0.2/lib/libruby.so.3.0(rb_mjit_inlinable_iseq+0x38) [0x7f2f63217468] mjit_compile.c:451
/home/hsbt/.rbenv/versions/3.0.2/lib/libruby.so.3.0(set_compiling_iseqs+0x64) [0x7f2f631effae] mjit_worker.c:758
/home/hsbt/.rbenv/versions/3.0.2/lib/libruby.so.3.0(set_compiling_iseqs) mjit_worker.c:739
/home/hsbt/.rbenv/versions/3.0.2/lib/libruby.so.3.0(convert_unit_to_func+0x6c5) [0x7f2f631f2b35] mjit_worker.c:1199
/home/hsbt/.rbenv/versions/3.0.2/lib/libruby.so.3.0(CRITICAL_SECTION_START+0x0) [0x7f2f631f3469] mjit_worker.c:1488
/home/hsbt/.rbenv/versions/3.0.2/lib/libruby.so.3.0(mjit_worker) mjit_worker.c:1491
/home/hsbt/.rbenv/versions/3.0.2/lib/libruby.so.3.0(mjit_worker+0x1e) [0x7f2f6330d78e] thread_pthread.c:1942
/lib/x86_64-linux-gnu/libpthread.so.0(start_thread+0xd9) [0x7f2f62e82609]
/lib/x86_64-linux-gnu/libc.so.6(clone+0x43) [0x7f2f62fda293]

Full of log is here: https://gist.github.com/hsbt/5a3ce854820f8ab726a7d017dda2e7dd

[mame (Yusuke Endoh)]

• Status changed from Open to Assigned
• Assignee set to k0kubun (Takashi Kokubun)

[k0kubun (Takashi Kokubun)]

/home/hsbt/.rbenv/versions/3.0.2/lib/libruby.so.3.0(rb_mjit_inlinable_iseq+0x38) [0x7f2f63217468] mjit_compile.c:451

The line is https://github.com/ruby/ruby/blob/v3_0_2/mjit_compile.c#L451. It seems like the captured CC was wrongly GC-ed.

[hsbt (Hiroshi SHIBATA)]

I switched Ruby 3.1.0-dev(2021-09-02) from 3.0.2. After that, I have no error while 6 hours.

[k0kubun (Takashi Kokubun)]

• Status changed from Assigned to Closed

We replaced the implementation in [Feature #19420] and we don't use CRITICAL_SECTION_START anymore. Closing.