Commit d8c059e
authored
Add a spec for the GC window inside the first #field_types call (#1456)
The existing spec calls #field_types to completion before collecting, so it
covers a stale read on a later call. The window that actually goes wrong is
inside the first call: the array is stored on the wrapper before the fill loop
runs, and that loop allocates a String per column, so a GC there can collect
the still-unmarked array between the store and the rb_ary_store that follows.
Three fresh results give three independent first-call windows, since whether
the dying array temporary is conservatively pinned on the C stack is
compiler/layout luck; the contents assertion catches a corrupted-but-alive
array as well as a crash.
Unpatched, this aborts with "[BUG] try to mark T_NONE object" 3/3 under
GC.stress; patched it is clean 3/3.
Reproduction from @jeremy, who found the same bug independently in #1454.1 parent 401b999 commit d8c059e
1 file changed
Lines changed: 25 additions & 0 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
95 | 95 | | |
96 | 96 | | |
97 | 97 | | |
| 98 | + | |
| 99 | + | |
| 100 | + | |
| 101 | + | |
| 102 | + | |
| 103 | + | |
| 104 | + | |
| 105 | + | |
| 106 | + | |
| 107 | + | |
| 108 | + | |
| 109 | + | |
| 110 | + | |
| 111 | + | |
| 112 | + | |
| 113 | + | |
| 114 | + | |
| 115 | + | |
| 116 | + | |
| 117 | + | |
| 118 | + | |
| 119 | + | |
| 120 | + | |
| 121 | + | |
| 122 | + | |
98 | 123 | | |
99 | 124 | | |
100 | 125 | | |
| |||
0 commit comments