node.c (rb_ast_new): imemo_ast is WB-unprotected

mame · mame · commit 86b5e801fcc9 · 2021-04-26T18:11:46.000+09:00
Previously imemo_ast was handled as WB-protected which caused a segfault
of the following code:

```
M0 = {}
M1 = {}
...
M100000 = {}
```

My analysis is here: `shareable_constant_value: literal` creates many
Hash instances during parsing, and add them to node_buffer of imemo_ast.
However, the contents are missed because imemo_ast is incorrectly
WB-protected.

This changeset makes imemo_ast as WB-unprotected.
diff --git a/gc.c b/gc.c
@@ -2435,6 +2435,13 @@ rb_imemo_new(enum imemo_type type, VALUE v1, VALUE v2, VALUE v3, VALUE v0)
     return newobj_of(v0, flags, v1, v2, v3, TRUE);
 }
 
+VALUE
+rb_wb_unprotected_imemo_new(enum imemo_type type, VALUE v1, VALUE v2, VALUE v3, VALUE v0)
+{
+    VALUE flags = T_IMEMO | (type << FL_USHIFT);
+    return newobj_of(v0, flags, v1, v2, v3, FALSE);
+}
+
 static VALUE
 rb_imemo_tmpbuf_new(VALUE v1, VALUE v2, VALUE v3, VALUE v0)
 {
diff --git a/internal/imemo.h b/internal/imemo.h
@@ -130,6 +130,7 @@ struct MEMO {
 
 typedef struct rb_imemo_tmpbuf_struct rb_imemo_tmpbuf_t;
 VALUE rb_imemo_new(enum imemo_type type, VALUE v1, VALUE v2, VALUE v3, VALUE v0);
+VALUE rb_wb_unprotected_imemo_new(enum imemo_type type, VALUE v1, VALUE v2, VALUE v3, VALUE v0);
 rb_imemo_tmpbuf_t *rb_imemo_tmpbuf_parser_heap(void *buf, rb_imemo_tmpbuf_t *old_heap, size_t cnt);
 struct vm_ifunc *rb_vm_ifunc_new(rb_block_call_func_t func, const void *data, int min_argc, int max_argc);
 void rb_strterm_mark(VALUE obj);
diff --git a/node.c b/node.c
@@ -1299,7 +1299,7 @@ rb_ast_t *
 rb_ast_new(void)
 {
     node_buffer_t *nb = rb_node_buffer_new();
-    rb_ast_t *ast = (rb_ast_t *)rb_imemo_new(imemo_ast, 0, 0, 0, (VALUE)nb);
+    rb_ast_t *ast = (rb_ast_t *)rb_wb_unprotected_imemo_new(imemo_ast, 0, 0, 0, (VALUE)nb);
     return ast;
 }
 

Original file line number	Diff line number	Diff line change
`@@ -2435,6 +2435,13 @@ rb_imemo_new(enum imemo_type type, VALUE v1, VALUE v2, VALUE v3, VALUE v0)`
`2435`	`2435`	`return newobj_of(v0, flags, v1, v2, v3, TRUE);`
`2436`	`2436`	`}`
`2437`	`2437`
	`2438`	`+VALUE`
	`2439`	`+rb_wb_unprotected_imemo_new(enum imemo_type type, VALUE v1, VALUE v2, VALUE v3, VALUE v0)`
	`2440`	`+{`
	`2441`	`+ VALUE flags = T_IMEMO \| (type << FL_USHIFT);`
	`2442`	`+ return newobj_of(v0, flags, v1, v2, v3, FALSE);`
	`2443`	`+}`
	`2444`	`+`
`2438`	`2445`	`static VALUE`
`2439`	`2446`	`rb_imemo_tmpbuf_new(VALUE v1, VALUE v2, VALUE v3, VALUE v0)`
`2440`	`2447`	`{`
Original file line number	Diff line number	Diff line change
`@@ -1299,7 +1299,7 @@ rb_ast_t *`
`1299`	`1299`	`rb_ast_new(void)`
`1300`	`1300`	`{`
`1301`	`1301`	`node_buffer_t *nb = rb_node_buffer_new();`
`1302`		`- rb_ast_t ast = (rb_ast_t )rb_imemo_new(imemo_ast, 0, 0, 0, (VALUE)nb);`
	`1302`	`+ rb_ast_t ast = (rb_ast_t )rb_wb_unprotected_imemo_new(imemo_ast, 0, 0, 0, (VALUE)nb);`
`1303`	`1303`	`return ast;`
`1304`	`1304`	`}`
`1305`	`1305`