[ruby-core:62052] [ruby-trunk - Bug #8543] rb_iseq_load

[billk@cts.com]

Issue #8543 has been updated by B Kelly.

File iseq-load-test3.rb added
File iseq-load-test3-file.rb added

Hello again,

The attached files comprise a small example which appears to consistently
reproduce a segmentation fault with rb_iseq_load.

Interpreter is: ruby 2.2.0dev (2014-04-16 trunk 45597) [i386-mswin32_100]

The crash appears related to the case statement.

~~~
Call stack:

The st_table pointer at st_foreach_check is bad:

  msvcr100-ruby220.dll!st_foreach_check(st_table * table=0x00000008, int (void)* func=0x0f3f3580, unsigned long arg=4512588, unsigned long never=6)  Line 891 + 0x3 bytes C
  msvcr100-ruby220.dll!hash_foreach_call(unsigned long arg=4512588)  Line 258 + 0x17 bytes        C
  msvcr100-ruby220.dll!rb_ensure(unsigned long (void)* b_proc=0x0f3f3530, unsigned long data1=4512588, unsigned long (void)* e_proc=0x0f3f3480, unsigned long data2=10318080)  Line 888 + 0x7 bytes       C
  msvcr100-ruby220.dll!rb_hash_foreach(unsigned long hash=10318080, int (void)* func=0x0f45ac20, unsigned long farg=4512696)  Line 275 + 0x17 bytes       C
> msvcr100-ruby220.dll!iseq_set_sequence(rb_iseq_struct * iseq=0x00d279b0, iseq_link_anchor * anchor=0x0044dd58)  Line 1507 + 0x12 bytes  C
  msvcr100-ruby220.dll!iseq_setup(rb_iseq_struct * iseq=0x00d279b0, iseq_link_anchor * anchor=0x0044dd58)  Line 1026 + 0xd bytes  C
  msvcr100-ruby220.dll!iseq_build_from_ary_body(rb_iseq_struct * iseq=0x00d279b0, iseq_link_anchor * anchor=0x0044dd58, unsigned long body=10318900, st_table * labels_table=0x00d27d10)  Line 5855 + 0xd bytes   C
  msvcr100-ruby220.dll!rb_iseq_build_from_ary(rb_iseq_struct * iseq=0x00d279b0, unsigned long locals=10320520, unsigned long args=5, unsigned long exception=10320460, unsigned long body=10318900)  Line 5932 + 0x15 bytes       C
  msvcr100-ruby220.dll!iseq_load(unsigned long self=10542580, unsigned long data=10320540, unsigned long parent=10318300, unsigned long opt=4)  Line 561 + 0x19 bytes     C
  msvcr100-ruby220.dll!rb_iseq_load(unsigned long data=10320540, unsigned long parent=10318300, unsigned long opt=4)  Line 582 + 0x17 bytes       C
  msvcr100-ruby220.dll!iseq_build_load_iseq(rb_iseq_struct * iseq=0x00d27500, unsigned long op=10320540)  Line 5701 + 0x15 bytes  C
  msvcr100-ruby220.dll!iseq_build_from_ary_body(rb_iseq_struct * iseq=0x00d27500, iseq_link_anchor * anchor=0x0044dfd4, unsigned long body=10318680, st_table * labels_table=0x00d27860)  Line 5816 + 0x13 bytes  C
  msvcr100-ruby220.dll!rb_iseq_build_from_ary(rb_iseq_struct * iseq=0x00d27500, unsigned long locals=10320900, unsigned long args=3, unsigned long exception=10320840, unsigned long body=10318680)  Line 5932 + 0x15 bytes       C
  msvcr100-ruby220.dll!iseq_load(unsigned long self=10542580, unsigned long data=10320920, unsigned long parent=10318380, unsigned long opt=4)  Line 561 + 0x19 bytes     C
  msvcr100-ruby220.dll!rb_iseq_load(unsigned long data=10320920, unsigned long parent=10318380, unsigned long opt=4)  Line 582 + 0x17 bytes       C
  msvcr100-ruby220.dll!iseq_build_load_iseq(rb_iseq_struct * iseq=0x00d27110, unsigned long op=10320920)  Line 5701 + 0x15 bytes  C
  msvcr100-ruby220.dll!iseq_build_from_ary_body(rb_iseq_struct * iseq=0x00d27110, iseq_link_anchor * anchor=0x0044e250, unsigned long body=10318560, st_table * labels_table=0x00d27470)  Line 5783 + 0xd bytes   C
  msvcr100-ruby220.dll!rb_iseq_build_from_ary(rb_iseq_struct * iseq=0x00d27110, unsigned long locals=10321160, unsigned long args=1, unsigned long exception=10321100, unsigned long body=10318560)  Line 5932 + 0x15 bytes       C
  msvcr100-ruby220.dll!iseq_load(unsigned long self=10542580, unsigned long data=10321180, unsigned long parent=10318460, unsigned long opt=4)  Line 561 + 0x19 bytes     C
  msvcr100-ruby220.dll!rb_iseq_load(unsigned long data=10321180, unsigned long parent=10318460, unsigned long opt=4)  Line 582 + 0x17 bytes       C
  msvcr100-ruby220.dll!iseq_build_load_iseq(rb_iseq_struct * iseq=0x00d25c08, unsigned long op=10321180)  Line 5701 + 0x15 bytes  C
  msvcr100-ruby220.dll!iseq_build_from_ary_body(rb_iseq_struct * iseq=0x00d25c08, iseq_link_anchor * anchor=0x0044e4cc, unsigned long body=10318500, st_table * labels_table=0x00d25f68)  Line 5783 + 0xd bytes   C
  msvcr100-ruby220.dll!rb_iseq_build_from_ary(rb_iseq_struct * iseq=0x00d25c08, unsigned long locals=10339520, unsigned long args=1, unsigned long exception=10339460, unsigned long body=10318500)  Line 5932 + 0x15 bytes       C
  msvcr100-ruby220.dll!iseq_load(unsigned long self=10542580, unsigned long data=10339540, unsigned long parent=0, unsigned long opt=4)  Line 561 + 0x19 bytes    C
  msvcr100-ruby220.dll!iseq_s_load(int argc=1, unsigned long * argv=0x0057005c, unsigned long self=10542580)  Line 576 + 0x13 bytes       C
  msvcr100-ruby220.dll!call_cfunc_m1(unsigned long (void)* func=0x0f443b50, unsigned long recv=10542580, int argc=1, const unsigned long * argv=0x0057005c)  Line 1330 + 0xf bytes        C
  msvcr100-ruby220.dll!vm_call_cfunc_with_frame(rb_thread_struct * th=0x00c15588, rb_control_frame_struct * reg_cfp=0x005eff80, rb_call_info_struct * ci=0x00cdcfc0)  Line 1502 + 0x20 bytes      C
  msvcr100-ruby220.dll!vm_call_cfunc(rb_thread_struct * th=0x00c15588, rb_control_frame_struct * reg_cfp=0x005eff80, rb_call_info_struct * ci=0x00cdcfc0)  Line 1592 + 0x11 bytes C
  msvcr100-ruby220.dll!vm_call_method(rb_thread_struct * th=0x00c15588, rb_control_frame_struct * cfp=0x005eff80, rb_call_info_struct * ci=0x00cdcfc0)  Line 1786 + 0x11 bytes    C
  msvcr100-ruby220.dll!vm_call_general(rb_thread_struct * th=0x00c15588, rb_control_frame_struct * reg_cfp=0x005eff80, rb_call_info_struct * ci=0x00cdcfc0)  Line 1941 + 0x11 bytes       C
  msvcr100-ruby220.dll!vm_exec_core(rb_thread_struct * th=0x00c15588, unsigned long initial=0)  Line 1028 + 0x1a bytes    C
  msvcr100-ruby220.dll!vm_exec(rb_thread_struct * th=0x00c15588)  Line 1328 + 0xd bytes   C
  msvcr100-ruby220.dll!invoke_block_from_c(rb_thread_struct * th=0x00c15588, const rb_block_struct * block=0x005effe0, unsigned long self=10187260, int argc=1, const unsigned long * argv=0x0044f0ec, const rb_block_struct * blockptr=0x00000000, const RNode * cref=0x00000000, unsigned long defined_class=4, int splattable=1)  Line 752 + 0x9 bytes	C
  msvcr100-ruby220.dll!vm_yield(rb_thread_struct * th=0x00c15588, int argc=1, const unsigned long * argv=0x0044f0ec)  Line 784 + 0x28 bytes       C
  msvcr100-ruby220.dll!rb_yield_0(int argc=1, const unsigned long * argv=0x0044f0ec)  Line 936 + 0x13 bytes       C
  msvcr100-ruby220.dll!rb_yield(unsigned long val=10340180)  Line 946 + 0xb bytes C
  msvcr100-ruby220.dll!rb_ary_each(unsigned long array=10342440)  Line 1806 + 0x2f bytes  C
  msvcr100-ruby220.dll!call_cfunc_0(unsigned long (void)* func=0x0f3cd6b0, unsigned long recv=10342440, int argc=0, const unsigned long * argv=0x00570040)  Line 1336 + 0x7 bytes C
  msvcr100-ruby220.dll!vm_call_cfunc_with_frame(rb_thread_struct * th=0x00c15588, rb_control_frame_struct * reg_cfp=0x005effd0, rb_call_info_struct * ci=0x00cdc5a8)  Line 1502 + 0x20 bytes      C
  msvcr100-ruby220.dll!vm_call_cfunc(rb_thread_struct * th=0x00c15588, rb_control_frame_struct * reg_cfp=0x005effd0, rb_call_info_struct * ci=0x00cdc5a8)  Line 1592 + 0x11 bytes C
  msvcr100-ruby220.dll!vm_call_method(rb_thread_struct * th=0x00c15588, rb_control_frame_struct * cfp=0x005effd0, rb_call_info_struct * ci=0x00cdc5a8)  Line 1786 + 0x11 bytes    C
  msvcr100-ruby220.dll!vm_call_general(rb_thread_struct * th=0x00c15588, rb_control_frame_struct * reg_cfp=0x005effd0, rb_call_info_struct * ci=0x00cdc5a8)  Line 1941 + 0x11 bytes       C
  msvcr100-ruby220.dll!vm_exec_core(rb_thread_struct * th=0x00c15588, unsigned long initial=0)  Line 999 + 0x1a bytes     C
  msvcr100-ruby220.dll!vm_exec(rb_thread_struct * th=0x00c15588)  Line 1328 + 0xd bytes   C
  msvcr100-ruby220.dll!rb_iseq_eval_main(unsigned long iseqval=10505960)  Line 1586 + 0x9 bytes   C
  msvcr100-ruby220.dll!ruby_exec_internal(void * n=0x00a04ee8)  Line 254 + 0x46 bytes     C
  msvcr100-ruby220.dll!ruby_exec_node(void * n=0x00a04ee8)  Line 316 + 0x9 bytes  C
  msvcr100-ruby220.dll!ruby_run_node(void * n=0x00a04ee8)  Line 308 + 0x9 bytes   C
  ruby_t.exe!main(int argc=3, char * * argv=0x00c115b8)  Line 36 + 0x16 bytes     C
  ruby_t.exe!__tmainCRTStartup()  Line 555 + 0x17 bytes   C


In the iseq_set_sequence above marked by ">", the bad hash value was
fetched from operands[j]:

                case TS_CDHASH:
                  {
                      VALUE map = operands[j];
                      struct cdhash_set_label_struct data;
                      data.hash = map;
                      data.pos = pos;
                      data.len = len;
                      rb_hash_foreach(map, cdhash_set_label_i, (VALUE)&data);

                      hide_obj(map);
                      generated_iseq[pos + 1 + j] = map;
                      break;
                  }

And the iobj->insn_id is consistently YARVINSN_opt_case_dispatch:

    iobj            0x00d27c6c {link={...} insn_id=YARVINSN_opt_case_dispatch line_no=5 ...}        iseq_insn_data *
    link            {type=ISEQ_ELEMENT_INSN next=0x00d27c8c prev=0x00d27ba4 }       iseq_link_element
    insn_id         YARVINSN_opt_case_dispatch      ruby_vminsn_type
    line_no         5       unsigned int
    operand_size    2       int
    sc_state        0       int
~~~

I had invoked the program with --disable-gems for simplicity, however
the crash occurs either way.

If there's any further information I could provide please let me know.

Thanks for your help!

Regards,

Bill


----------------------------------------
Bug #8543: rb_iseq_load
https://bugs.ruby-lang.org/issues/8543#change-46227

* Author: Alexey Voskov
* Status: Open
* Priority: Low
* Assignee: Koichi Sasada
* Category: YARV
* Target version: current: 2.2.0
* ruby -v: ruby 2.0.0p234 (2013-06-19 revision 41434) [x86_64-darwin11.4.2]
* Backport: 1.9.3: DONTNEED, 2.0.0: REQUIRED
----------------------------------------
I noticed an unusual behaviour of undocumented rb_iseq_load function. 
Its work differs in different Ruby versions. I'm trying to protect some Ruby
source code by its conversion to YARV p-code and using the next strategy:
1) Convert code to array
data = RubyVM::InstructionSequence.compile_file('hello.rb').to_a

2) Pass a compiled source to the rb_iseq_load function and evaluate it
iseq = iseq_load.(data)
iseq.eval

Sample programs are supplied in the attachments.
"hello.rb"
---------------------------
puts "tralivali"
def funct(a,b)
	a**b
end

3.times { |i|
	puts "Hello, world#{funct(2,i)}!"
}
------------------------


The differences
Ruby 1.9.3 (ruby 1.9.3p194 (2012-04-20) [i386-mingw32])
Correct work. Output:
-------------------------
tralivali
Hello, world1!
Hello, world2!
Hello, world4!

--------------------

Ruby 2.0.0 (ruby 2.0.0p193 (2013-05-14) [x64-mingw32])
Incorrect work (omits the code inside code blocks). Output
-------------------------
tralivali

-------------------------

Attempts of loading bigger programs by means of rb_iseq_load in Ruby 2.0.0 usually ends with a segmentation fault.

Such behaviour also can be reproduced by means of iseq Ruby extension ("for iseq freaks")
https://github.com/wanabe/iseq

P.S. I understand that it is an undocumented feature.

---Files--------------------------------
hello.rb (102 Bytes)
rb_pack.rb (931 Bytes)
iseq-load-test3.rb (210 Bytes)
iseq-load-test3-file.rb (369 Bytes)


-- 
https://bugs.ruby-lang.org/