[ruby-core:91150] [Ruby trunk Bug#15536] Crash on merging specific hashes using keyword splat

[naruse@airemix.jp]

Issue #15536 has been updated by naruse (Yui NARUSE).

Backport changed from 2.4: UNKNOWN, 2.5: REQUIRED, 2.6: REQUIRED to 2.4: UNKNOWN, 2.5: REQUIRED, 2.6: DONE

ruby_2_6 r66853 merged revision(s) 66832.

----------------------------------------
Bug #15536: Crash on merging specific hashes using keyword splat
https://bugs.ruby-lang.org/issues/15536#change-76381

* Author: decuplet (Nikita Shilnikov)
* Status: Closed
* Priority: Normal
* Assignee: 
* Target version: 
* ruby -v: ruby 2.5.3p105 (2018-10-18 revision 65156) [x86_64-linux]
* Backport: 2.4: UNKNOWN, 2.5: REQUIRED, 2.6: DONE
----------------------------------------
Here's a snippet that leads to a crash on ruby 2.5.3. I tried to make it as small as possible.
```ruby
1000.times do
  {
    **{
      a1: nil,
      a2: nil,
      a3: nil,
      a4: nil,
      a5: nil,
      a6: nil,
      a7: nil,
      a8: nil,
      a9: nil
    },
    b1: nil,
    b2: nil,
    a4: nil,
    **{ c1: nil, c2: nil },
    a7: nil,
    a8: nil,
    a9: nil,
  }
end
```

Results in `*** Error in irb': malloc(): memory corruption: 0x000055ca6c832bd0 ***` (more detail in the attached file).

We came across this on ruby 2.5.3 and as far as I can tell it's no longer a problem on 2.6 but we yet to upgrade.

---Files--------------------------------
segfault.txt (30.8 KB)


-- 
https://bugs.ruby-lang.org/