From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on starla X-Spam-Level: X-Spam-Status: No, score=-1.1 required=3.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,MAILING_LIST_MULTI,SPF_HELO_PASS,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 Received: from nue.mailmanlists.eu (nue.mailmanlists.eu [94.130.110.93]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by dcvr.yhbt.net (Postfix) with ESMTPS id B180B1F4CC for ; Sun, 8 Dec 2024 04:38:32 +0000 (UTC) Authentication-Results: dcvr.yhbt.net; dkim=pass (1024-bit key; unprotected) header.d=ml.ruby-lang.org header.i=@ml.ruby-lang.org header.a=rsa-sha256 header.s=mail header.b=dbrSoE+6; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=ruby-lang.org header.i=@ruby-lang.org header.a=rsa-sha256 header.s=s1 header.b=r9UF3NVX; dkim-atps=neutral DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ml.ruby-lang.org; s=mail; t=1733632680; bh=hb6aeSH6v0UOLcweeNCm3waleru5glVhZSBlFQi6XQo=; h=Date:References:To:Reply-To:Subject:List-Id:List-Archive: List-Help:List-Owner:List-Post:List-Subscribe:List-Unsubscribe: From:Cc:From; b=dbrSoE+6vOR87wTAMl+T7/qL8ZFAYrbUhCNQSBfQkhnkIe+4yG2ANmYFgE8dT6/xz Me7i/qqFI9VcGo9hYb+ols3jRQ3AlCluqt77gVEimzSdkL3zg4APeb7NnqodKoc1NZ lA/wBfw2sXmGZHbrJQT5Ooi1uLVqLmXUyI4Zaxac= Received: from nue.mailmanlists.eu (localhost [IPv6:::1]) by nue.mailmanlists.eu (Postfix) with ESMTP id 3BD8344D01 for ; Sun, 8 Dec 2024 04:38:00 +0000 (UTC) Authentication-Results: nue.mailmanlists.eu; dkim=pass (2048-bit key; unprotected) header.d=ruby-lang.org header.i=@ruby-lang.org header.a=rsa-sha256 header.s=s1 header.b=r9UF3NVX; dkim-atps=neutral Received: from s.wrqvtzvf.outbound-mail.sendgrid.net (s.wrqvtzvf.outbound-mail.sendgrid.net [149.72.126.143]) by nue.mailmanlists.eu (Postfix) with ESMTPS id 6633144C57 for ; Sun, 8 Dec 2024 04:37:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ruby-lang.org; h=from:references:subject:mime-version:content-type: content-transfer-encoding:list-id:to:cc:content-type:from:subject:to; s=s1; bh=9FmnAkQhHFQQ5WNDeVtExfNFMWD9Le7WPY8JcBM7X0M=; b=r9UF3NVXAr67nYkFWh/kKTWvlI/3ej5X9bADqGlwO/xNHleA/BJt33STCCkZdSMs7ceb vKZRVqRaZhv3v/Ktc3poiowoXWwULI291rnd/3xdFJx5sts5Bk5wS8lSWGjgnv/htsrwEx TTkpwX2uDi4DG9sBF2hGhifbj4f3IV/OJ9UqV2PyGSfrUbGsgcPy/IS+n7oqf0+2xBiKb3 KbJqqpwZkm7nHwYwBwKAgK2NvtYSvU5JhEe5/Q+2hafwg4iMt2nSQk/aHc5ycVrKRsAEzp +Mfh30x2oYVLgNcg1FnvHupwjxWEt7a7np05d4OUhxB+e5lnuGtfSuN3xZdWYqSw== Received: by recvd-84b546689d-zrqq5 with SMTP id recvd-84b546689d-zrqq5-1-67552298-1 2024-12-08 04:37:44.027788317 +0000 UTC m=+2013275.774662664 Received: from herokuapp.com (unknown) by geopod-ismtpd-2 (SG) with ESMTP id 6M-4uIskT06I5WEi67QEYA for ; Sun, 08 Dec 2024 04:37:43.969 +0000 (UTC) Date: Sun, 08 Dec 2024 04:37:45 +0000 (UTC) Message-ID: References: Mime-Version: 1.0 X-Redmine-Project: ruby-master X-Redmine-Issue-Tracker: Bug X-Redmine-Issue-Id: 20934 X-Redmine-Issue-Author: wanabe X-Redmine-Issue-Priority: Normal X-Redmine-Sender: wanabe X-Mailer: Redmine X-Redmine-Host: bugs.ruby-lang.org X-Redmine-Site: Ruby Issue Tracking System X-Auto-Response-Suppress: All Auto-Submitted: auto-generated X-Redmine-MailingListIntegration-Message-Ids: 96807 X-SG-EID: =?us-ascii?Q?u001=2E9Qxdz4h1P1vCEXKqAHzcTzXXk4TC5lKmvoCuUr5AQGi=2Fm21wFVOcdxeUy?= =?us-ascii?Q?E5vWsWZJcXotHlkHbXqgsfUE5Y7Mvy2NR8vGtPz?= =?us-ascii?Q?HEVAoanjoTFsVKJ4JK3DjnABMdPU8dgr25sojm1?= =?us-ascii?Q?nBou9zf6mFgy+vDE4RFqf4luEiaKDlo=2FE8TqT9n?= =?us-ascii?Q?jq9wqdeikudJ066ckzlZR=2FpA0gduGEJytL575uA?= =?us-ascii?Q?GuLBPUAGgieJTPV2Wmx26tuvlkS70=2FjaMw6K2=2Fy?= =?us-ascii?Q?JvE5?= To: ruby-core@ml.ruby-lang.org X-Entity-ID: u001.I8uzylDtAfgbeCOeLBYDww== Message-ID-Hash: KNUQB745XCNPWCSQXSITCENVS3DBVBCX X-Message-ID-Hash: KNUQB745XCNPWCSQXSITCENVS3DBVBCX X-MailFrom: bounces+313651-b711-ruby-core=ml.ruby-lang.org@em5188.ruby-lang.org X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.9 Precedence: list Reply-To: Ruby developers Subject: [ruby-core:120130] [Ruby master Bug#20934] `UnboundMethod#bind_call` may cause "double free or corruption" with Ractor List-Id: Ruby developers Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: From: "wanabe (_ wanabe) via ruby-core" Cc: "wanabe (_ wanabe)" Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Issue #20934 has been updated by wanabe (_ wanabe). Thanks for your comment. It looks like a race condition between `rb_method_definition_release()` and `method_definition_addref()`. Applying the following patch suppressed the problem. ```patch diff --git a/vm_method.c b/vm_method.c index 69a533b182..725b2a99ac 100644 --- a/vm_method.c +++ b/vm_method.c @@ -518,6 +518,7 @@ static void rb_method_definition_release(rb_method_definition_t *def) { if (def != NULL) { + RB_VM_LOCK_ENTER(); const int reference_count = def->reference_count; def->reference_count--; @@ -535,6 +536,7 @@ rb_method_definition_release(rb_method_definition_t *def) if (METHOD_DEBUG) fprintf(stderr, "-%p-%s:%d->%d (dec)\n", (void *)def, rb_id2name(def->original_id), reference_count, def->reference_count); } + RB_VM_LOCK_LEAVE(); } } @@ -621,9 +623,11 @@ setup_method_cfunc_struct(rb_method_cfunc_t *cfunc, VALUE (*func)(ANYARGS), int static rb_method_definition_t * method_definition_addref(rb_method_definition_t *def, bool complemented) { + RB_VM_LOCK_ENTER(); if (!complemented && def->reference_count > 0) def->aliased = true; def->reference_count++; if (METHOD_DEBUG) fprintf(stderr, "+%p-%s:%d\n", (void *)def, rb_id2name(def->original_id), def->reference_count); + RB_VM_LOCK_LEAVE(); return def; } ``` But I don't think it is a good idea because the cost would be high. Hopefully there is a better solution. ---------------------------------------- Bug #20934: `UnboundMethod#bind_call` may cause "double free or corruption" with Ractor https://bugs.ruby-lang.org/issues/20934#change-110880 * Author: wanabe (_ wanabe) * Status: Open * ruby -v: ruby 3.4.0dev (2024-12-06T18:51:08Z :detached: 8ad6860ff7) +PRISM [x86_64-linux] * Backport: 3.1: UNKNOWN, 3.2: UNKNOWN, 3.3: UNKNOWN ---------------------------------------- When I call `UnboundMethod#bind_call` on both main Ractor and child Ractor, probable errors can be encountered. Here is an issue reproduce script `ractor_issue.rb`. ``` def foo 10000.times do Object.instance_method(:object_id).bind_call(self) end end Ractor.new { foo } foo ``` And there are some examples of execution results. ``` $ ./miniruby -v ractor_issue.rb ruby 3.4.0dev (2024-12-06T18:51:08Z :detached: 8ad6860ff7) +PRISM [x86_64-linux] ractor_issue.rb:7: warning: Ractor is experimental, and the behavior may change in future versions of Ruby! Also there are many implementation issues. double free or corruption (fasttop) Aborted (core dumped) ``` ``` $ ./miniruby -v ractor_issue.rb ruby 3.4.0dev (2024-12-06T18:51:08Z :detached: 8ad6860ff7) +PRISM [x86_64-linux] ractor_issue.rb:7: warning: Ractor is experimental, and the behavior may change in future versions of Ruby! Also there are many implementation issues. # terminated with exception (report_on_exception is true): ractor_issue.rb:3:in 'UnboundMethod#bind_call': undefined method 'object_id' for main (NoMethodError) from ractor_issue.rb:3:in 'block in Object#foo' from :257:in 'Integer#times' from ractor_issue.rb:2:in 'Object#foo' from ractor_issue.rb:8:in '
' ``` Please try running it several times, as there is a probability of successful completion. -- https://bugs.ruby-lang.org/ ______________________________________________ ruby-core mailing list -- ruby-core@ml.ruby-lang.org To unsubscribe send an email to ruby-core-leave@ml.ruby-lang.org ruby-core info -- https://ml.ruby-lang.org/mailman3/lists/ruby-core.ml.ruby-lang.org/