-
Alan Wu authored
We observed crashes from rb_io_bufwrite() thread switching (through rb_thread_check_ints()) in the middle of rb_execution_context_mark(). By the time rb_execution_context_mark() gets a timeslice again, it read garbage from a frame that was already popped in another thread, crashing the process in SEGV. Other mark functions probably have their own ways of breaking, but clearly, the usual IO code do too much for this perilous pseudo GC context. Use `FILE*` like before 5001cc47 ("Optimize ObjectSpace.dump_all"). Also, add type checking for the private _dump methods. Co-authored-by:
Peter Zhu <peter@peterzhu.ca>
Alan Wu authoredWe observed crashes from rb_io_bufwrite() thread switching (through rb_thread_check_ints()) in the middle of rb_execution_context_mark(). By the time rb_execution_context_mark() gets a timeslice again, it read garbage from a frame that was already popped in another thread, crashing the process in SEGV. Other mark functions probably have their own ways of breaking, but clearly, the usual IO code do too much for this perilous pseudo GC context. Use `FILE*` like before 5001cc47 ("Optimize ObjectSpace.dump_all"). Also, add type checking for the private _dump methods. Co-authored-by:
Peter Zhu <peter@peterzhu.ca>
Loading