Bug #8543

rb_iseq_load

Added by Alexey Voskov 10 months ago. Updated 8 days ago.

[ruby-core:55557]
Status:Open
Priority:Low
Assignee:Koichi Sasada
Category:YARV
Target version:current: 2.2.0
ruby -v:ruby 2.0.0p234 (2013-06-19 revision 41434) [x86_64-darwin11.4.2] Backport:1.9.3: DONTNEED, 2.0.0: REQUIRED

Description

I noticed an unusual behaviour of undocumented rbiseqload function.
Its work differs in different Ruby versions. I'm trying to protect some Ruby
source code by its conversion to YARV p-code and using the next strategy:
1) Convert code to array
data = RubyVM::InstructionSequence.compilefile('hello.rb').toa

2) Pass a compiled source to the rbiseqload function and evaluate it
iseq = iseq_load.(data)
iseq.eval

Sample programs are supplied in the attachments.

"hello.rb"

puts "tralivali"
def funct(a,b)
a**b
end

3.times { |i|
puts "Hello, world#{funct(2,i)}!"

}

The differences
Ruby 1.9.3 (ruby 1.9.3p194 (2012-04-20) [i386-mingw32])

Correct work. Output:

tralivali
Hello, world1!
Hello, world2!
Hello, world4!


Ruby 2.0.0 (ruby 2.0.0p193 (2013-05-14) [x64-mingw32])

Incorrect work (omits the code inside code blocks). Output

tralivali


Attempts of loading bigger programs by means of rbiseqload in Ruby 2.0.0 usually ends with a segmentation fault.

Such behaviour also can be reproduced by means of iseq Ruby extension ("for iseq freaks")
https://github.com/wanabe/iseq

P.S. I understand that it is an undocumented feature.

hello.rb Magnifier - Codes for conversion to YARV PCODE (102 Bytes) Alexey Voskov, 06/19/2013 09:39 PM

rb_pack.rb Magnifier - "Compiler" (931 Bytes) Alexey Voskov, 06/19/2013 09:39 PM

iseq-load-test3.rb Magnifier - Program which calls RubyVM::InstructionSequence.load (210 Bytes) B Kelly, 04/16/2014 10:03 AM

iseq-load-test3-file.rb Magnifier - Program fragment which triggers SEGV when loaded by rb_iseq_load (369 Bytes) B Kelly, 04/16/2014 10:03 AM

History

#1 Updated by Tomoyuki Chikanaga 10 months ago

  • Tracker changed from misc to Bug

#2 Updated by Tomoyuki Chikanaga 10 months ago

  • Priority changed from Normal to Low
  • Backport set to 1.9.3: DONTNEED, 2.0.0: REQUIRED
  • ruby -v set to ruby 2.0.0p234 (2013-06-19 revision 41434) [x86_64-darwin11.4.2]

#3 Updated by Hiroshi SHIBATA 3 months ago

  • Target version changed from 2.1.0 to current: 2.2.0

#4 Updated by B Kelly 8 days ago

Hi,

Just a data point:

With ruby 2.2.0dev (2014-04-16 trunk 45576) [i386-mswin32100],
the rb
iseq_load example in https://bugs.ruby-lang.org/issues/8543
is producing the correct output.

(I will attempt to test with more complicated programs soon.)

Regards,

Bill

#5 Updated by B Kelly 8 days ago

Hello again,

The attached files comprise a small example which appears to consistently
reproduce a segmentation fault with rbiseqload.

Interpreter is: ruby 2.2.0dev (2014-04-16 trunk 45597) [i386-mswin32_100]

The crash appears related to the case statement.

Call stack:

The st_table pointer at st_foreach_check is bad:

  msvcr100-ruby220.dll!st_foreach_check(st_table * table=0x00000008, int (void)* func=0x0f3f3580, unsigned long arg=4512588, unsigned long never=6)  Line 891 + 0x3 bytes C
  msvcr100-ruby220.dll!hash_foreach_call(unsigned long arg=4512588)  Line 258 + 0x17 bytes        C
  msvcr100-ruby220.dll!rb_ensure(unsigned long (void)* b_proc=0x0f3f3530, unsigned long data1=4512588, unsigned long (void)* e_proc=0x0f3f3480, unsigned long data2=10318080)  Line 888 + 0x7 bytes       C
  msvcr100-ruby220.dll!rb_hash_foreach(unsigned long hash=10318080, int (void)* func=0x0f45ac20, unsigned long farg=4512696)  Line 275 + 0x17 bytes       C
> msvcr100-ruby220.dll!iseq_set_sequence(rb_iseq_struct * iseq=0x00d279b0, iseq_link_anchor * anchor=0x0044dd58)  Line 1507 + 0x12 bytes  C
  msvcr100-ruby220.dll!iseq_setup(rb_iseq_struct * iseq=0x00d279b0, iseq_link_anchor * anchor=0x0044dd58)  Line 1026 + 0xd bytes  C
  msvcr100-ruby220.dll!iseq_build_from_ary_body(rb_iseq_struct * iseq=0x00d279b0, iseq_link_anchor * anchor=0x0044dd58, unsigned long body=10318900, st_table * labels_table=0x00d27d10)  Line 5855 + 0xd bytes   C
  msvcr100-ruby220.dll!rb_iseq_build_from_ary(rb_iseq_struct * iseq=0x00d279b0, unsigned long locals=10320520, unsigned long args=5, unsigned long exception=10320460, unsigned long body=10318900)  Line 5932 + 0x15 bytes       C
  msvcr100-ruby220.dll!iseq_load(unsigned long self=10542580, unsigned long data=10320540, unsigned long parent=10318300, unsigned long opt=4)  Line 561 + 0x19 bytes     C
  msvcr100-ruby220.dll!rb_iseq_load(unsigned long data=10320540, unsigned long parent=10318300, unsigned long opt=4)  Line 582 + 0x17 bytes       C
  msvcr100-ruby220.dll!iseq_build_load_iseq(rb_iseq_struct * iseq=0x00d27500, unsigned long op=10320540)  Line 5701 + 0x15 bytes  C
  msvcr100-ruby220.dll!iseq_build_from_ary_body(rb_iseq_struct * iseq=0x00d27500, iseq_link_anchor * anchor=0x0044dfd4, unsigned long body=10318680, st_table * labels_table=0x00d27860)  Line 5816 + 0x13 bytes  C
  msvcr100-ruby220.dll!rb_iseq_build_from_ary(rb_iseq_struct * iseq=0x00d27500, unsigned long locals=10320900, unsigned long args=3, unsigned long exception=10320840, unsigned long body=10318680)  Line 5932 + 0x15 bytes       C
  msvcr100-ruby220.dll!iseq_load(unsigned long self=10542580, unsigned long data=10320920, unsigned long parent=10318380, unsigned long opt=4)  Line 561 + 0x19 bytes     C
  msvcr100-ruby220.dll!rb_iseq_load(unsigned long data=10320920, unsigned long parent=10318380, unsigned long opt=4)  Line 582 + 0x17 bytes       C
  msvcr100-ruby220.dll!iseq_build_load_iseq(rb_iseq_struct * iseq=0x00d27110, unsigned long op=10320920)  Line 5701 + 0x15 bytes  C
  msvcr100-ruby220.dll!iseq_build_from_ary_body(rb_iseq_struct * iseq=0x00d27110, iseq_link_anchor * anchor=0x0044e250, unsigned long body=10318560, st_table * labels_table=0x00d27470)  Line 5783 + 0xd bytes   C
  msvcr100-ruby220.dll!rb_iseq_build_from_ary(rb_iseq_struct * iseq=0x00d27110, unsigned long locals=10321160, unsigned long args=1, unsigned long exception=10321100, unsigned long body=10318560)  Line 5932 + 0x15 bytes       C
  msvcr100-ruby220.dll!iseq_load(unsigned long self=10542580, unsigned long data=10321180, unsigned long parent=10318460, unsigned long opt=4)  Line 561 + 0x19 bytes     C
  msvcr100-ruby220.dll!rb_iseq_load(unsigned long data=10321180, unsigned long parent=10318460, unsigned long opt=4)  Line 582 + 0x17 bytes       C
  msvcr100-ruby220.dll!iseq_build_load_iseq(rb_iseq_struct * iseq=0x00d25c08, unsigned long op=10321180)  Line 5701 + 0x15 bytes  C
  msvcr100-ruby220.dll!iseq_build_from_ary_body(rb_iseq_struct * iseq=0x00d25c08, iseq_link_anchor * anchor=0x0044e4cc, unsigned long body=10318500, st_table * labels_table=0x00d25f68)  Line 5783 + 0xd bytes   C
  msvcr100-ruby220.dll!rb_iseq_build_from_ary(rb_iseq_struct * iseq=0x00d25c08, unsigned long locals=10339520, unsigned long args=1, unsigned long exception=10339460, unsigned long body=10318500)  Line 5932 + 0x15 bytes       C
  msvcr100-ruby220.dll!iseq_load(unsigned long self=10542580, unsigned long data=10339540, unsigned long parent=0, unsigned long opt=4)  Line 561 + 0x19 bytes    C
  msvcr100-ruby220.dll!iseq_s_load(int argc=1, unsigned long * argv=0x0057005c, unsigned long self=10542580)  Line 576 + 0x13 bytes       C
  msvcr100-ruby220.dll!call_cfunc_m1(unsigned long (void)* func=0x0f443b50, unsigned long recv=10542580, int argc=1, const unsigned long * argv=0x0057005c)  Line 1330 + 0xf bytes        C
  msvcr100-ruby220.dll!vm_call_cfunc_with_frame(rb_thread_struct * th=0x00c15588, rb_control_frame_struct * reg_cfp=0x005eff80, rb_call_info_struct * ci=0x00cdcfc0)  Line 1502 + 0x20 bytes      C
  msvcr100-ruby220.dll!vm_call_cfunc(rb_thread_struct * th=0x00c15588, rb_control_frame_struct * reg_cfp=0x005eff80, rb_call_info_struct * ci=0x00cdcfc0)  Line 1592 + 0x11 bytes C
  msvcr100-ruby220.dll!vm_call_method(rb_thread_struct * th=0x00c15588, rb_control_frame_struct * cfp=0x005eff80, rb_call_info_struct * ci=0x00cdcfc0)  Line 1786 + 0x11 bytes    C
  msvcr100-ruby220.dll!vm_call_general(rb_thread_struct * th=0x00c15588, rb_control_frame_struct * reg_cfp=0x005eff80, rb_call_info_struct * ci=0x00cdcfc0)  Line 1941 + 0x11 bytes       C
  msvcr100-ruby220.dll!vm_exec_core(rb_thread_struct * th=0x00c15588, unsigned long initial=0)  Line 1028 + 0x1a bytes    C
  msvcr100-ruby220.dll!vm_exec(rb_thread_struct * th=0x00c15588)  Line 1328 + 0xd bytes   C
  msvcr100-ruby220.dll!invoke_block_from_c(rb_thread_struct * th=0x00c15588, const rb_block_struct * block=0x005effe0, unsigned long self=10187260, int argc=1, const unsigned long * argv=0x0044f0ec, const rb_block_struct * blockptr=0x00000000, const RNode * cref=0x00000000, unsigned long defined_class=4, int splattable=1)  Line 752 + 0x9 bytes   C
  msvcr100-ruby220.dll!vm_yield(rb_thread_struct * th=0x00c15588, int argc=1, const unsigned long * argv=0x0044f0ec)  Line 784 + 0x28 bytes       C
  msvcr100-ruby220.dll!rb_yield_0(int argc=1, const unsigned long * argv=0x0044f0ec)  Line 936 + 0x13 bytes       C
  msvcr100-ruby220.dll!rb_yield(unsigned long val=10340180)  Line 946 + 0xb bytes C
  msvcr100-ruby220.dll!rb_ary_each(unsigned long array=10342440)  Line 1806 + 0x2f bytes  C
  msvcr100-ruby220.dll!call_cfunc_0(unsigned long (void)* func=0x0f3cd6b0, unsigned long recv=10342440, int argc=0, const unsigned long * argv=0x00570040)  Line 1336 + 0x7 bytes C
  msvcr100-ruby220.dll!vm_call_cfunc_with_frame(rb_thread_struct * th=0x00c15588, rb_control_frame_struct * reg_cfp=0x005effd0, rb_call_info_struct * ci=0x00cdc5a8)  Line 1502 + 0x20 bytes      C
  msvcr100-ruby220.dll!vm_call_cfunc(rb_thread_struct * th=0x00c15588, rb_control_frame_struct * reg_cfp=0x005effd0, rb_call_info_struct * ci=0x00cdc5a8)  Line 1592 + 0x11 bytes C
  msvcr100-ruby220.dll!vm_call_method(rb_thread_struct * th=0x00c15588, rb_control_frame_struct * cfp=0x005effd0, rb_call_info_struct * ci=0x00cdc5a8)  Line 1786 + 0x11 bytes    C
  msvcr100-ruby220.dll!vm_call_general(rb_thread_struct * th=0x00c15588, rb_control_frame_struct * reg_cfp=0x005effd0, rb_call_info_struct * ci=0x00cdc5a8)  Line 1941 + 0x11 bytes       C
  msvcr100-ruby220.dll!vm_exec_core(rb_thread_struct * th=0x00c15588, unsigned long initial=0)  Line 999 + 0x1a bytes     C
  msvcr100-ruby220.dll!vm_exec(rb_thread_struct * th=0x00c15588)  Line 1328 + 0xd bytes   C
  msvcr100-ruby220.dll!rb_iseq_eval_main(unsigned long iseqval=10505960)  Line 1586 + 0x9 bytes   C
  msvcr100-ruby220.dll!ruby_exec_internal(void * n=0x00a04ee8)  Line 254 + 0x46 bytes     C
  msvcr100-ruby220.dll!ruby_exec_node(void * n=0x00a04ee8)  Line 316 + 0x9 bytes  C
  msvcr100-ruby220.dll!ruby_run_node(void * n=0x00a04ee8)  Line 308 + 0x9 bytes   C
  ruby_t.exe!main(int argc=3, char * * argv=0x00c115b8)  Line 36 + 0x16 bytes     C
  ruby_t.exe!__tmainCRTStartup()  Line 555 + 0x17 bytes   C


In the iseq_set_sequence above marked by ">", the bad hash value was
fetched from operands[j]:

                case TS_CDHASH:
                  {
                      VALUE map = operands[j];
                      struct cdhash_set_label_struct data;
                      data.hash = map;
                      data.pos = pos;
                      data.len = len;
                      rb_hash_foreach(map, cdhash_set_label_i, (VALUE)&data);

                      hide_obj(map);
                      generated_iseq[pos + 1 + j] = map;
                      break;
                  }

And the iobj->insn_id is consistently YARVINSN_opt_case_dispatch:

    iobj            0x00d27c6c {link={...} insn_id=YARVINSN_opt_case_dispatch line_no=5 ...}        iseq_insn_data *
    link            {type=ISEQ_ELEMENT_INSN next=0x00d27c8c prev=0x00d27ba4 }       iseq_link_element
    insn_id         YARVINSN_opt_case_dispatch      ruby_vminsn_type
    line_no         5       unsigned int
    operand_size    2       int
    sc_state        0       int

I had invoked the program with --disable-gems for simplicity, however
the crash occurs either way.

If there's any further information I could provide please let me know.

Thanks for your help!

Regards,

Bill

Also available in: Atom PDF