In `h_check_modified()`, in the case of `MRB_NO_BOXING`, `ht_ea()` or
`ht_ea_capa()` for AR may read uninitialized area. Therefore, do not use
those macros for AR in `MRB_NO_BOXING` (but in the case of `MRB_64BIT`,
`ht_ea_capa()` is the same as `ar_ea_capa()`, so use it).
fix#5332
### Example
##### example.rb
```ruby
h = {}
(1..17).each{h[_1] = _1}
(1..16).each{h.delete(_1)}
h.rehash
```
##### ASAN report
```console
$ bin/mruby example.rb
==52587==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000006998 at pc 0x55a29cddf96b bp 0x7fff7b1b1720 sp 0x7fff7b1b1710
READ of size 4 at 0x602000006998 thread T0
#0 0x55a29cddf96a in ib_it_next /mruby/src/hash.c:639
#1 0x55a29cde2ca2 in ht_rehash /mruby/src/hash.c:900
#2 0x55a29cde379f in h_rehash /mruby/src/hash.c:996
#3 0x55a29cde7f3d in mrb_hash_rehash /mruby/src/hash.c:1735
#4 0x55a29ce77b62 in mrb_vm_exec /mruby/src/vm.c:1451
#5 0x55a29ce5fa88 in mrb_vm_run /mruby/src/vm.c:981
#6 0x55a29ceb87e1 in mrb_top_run /mruby/src/vm.c:2874
#7 0x55a29cf36bdf in mrb_load_exec mrbgems/mruby-compiler/core/parse.y:6805
#8 0x55a29cf36f25 in mrb_load_detect_file_cxt mrbgems/mruby-compiler/core/parse.y:6848
#9 0x55a29cdba0a2 in main /mruby/mrbgems/mruby-bin-mruby/tools/mruby/mruby.c:347
#10 0x7f24ef43b0b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
#11 0x55a29cdb4a6d in _start (/mruby/bin/mruby+0x2a3a6d)
0x602000006998 is located 0 bytes to the right of 8-byte region [0x602000006990,0x602000006998)
allocated by thread T0 here:
#0 0x7f24f01cfffe in __interceptor_realloc (/lib/x86_64-linux-gnu/libasan.so.5+0x10dffe)
#1 0x55a29ceb9440 in mrb_default_allocf /mruby/src/state.c:68
#2 0x55a29cdba747 in mrb_realloc_simple /mruby/src/gc.c:228
#3 0x55a29cdba928 in mrb_realloc /mruby/src/gc.c:242
#4 0x55a29cde12e5 in ht_init /mruby/src/hash.c:749
#5 0x55a29cde2b8e in ht_rehash /mruby/src/hash.c:897
#6 0x55a29cde379f in h_rehash /mruby/src/hash.c:996
#7 0x55a29cde7f3d in mrb_hash_rehash /mruby/src/hash.c:1735
#8 0x55a29ce77b62 in mrb_vm_exec /mruby/src/vm.c:1451
#9 0x55a29ce5fa88 in mrb_vm_run /mruby/src/vm.c:981
#10 0x55a29ceb87e1 in mrb_top_run /mruby/src/vm.c:2874
#11 0x55a29cf36bdf in mrb_load_exec mrbgems/mruby-compiler/core/parse.y:6805
#12 0x55a29cf36f25 in mrb_load_detect_file_cxt mrbgems/mruby-compiler/core/parse.y:6848
#13 0x55a29cdba0a2 in main /mruby/mrbgems/mruby-bin-mruby/tools/mruby/mruby.c:347
#14 0x7f24ef43b0b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
```
We have introduced following new instructions.
* `OP_LAMBDA16`
* `OP_BLOCK16`
* `OP_METHOD16`
* `OP_EXEC16`
Each instruction uses 16 bits operand for `reps` index. Since new
instructions are added, `mruby/c` VM should be updated.
Due to new instructions, dump format compatibility is lost, we have
increased `RITE_BINARY_MAJOR_VER`.
In addition, we have decreased the size of `refcnt` in `mrb_irep` from
`uint32_t` to `uint16_t`, which is reasonably big enough.
The `init_SYMBOLS()` function implicitly defined in `MRB_PRESYM_DEFINE_VAR_AND_INITER()` requires some familiarity when trying to find it from the caller.
By introducing `MRB_PRESYM_INIT_SYMBOLS()`, it is possible to find directly from the identifier.
Because a structure that is an element of `presym_table` has padding, split
it into individual arrays for name and length.
#### Result (64-bit CPU with full-core gembox)
| | mruby | libmruby.a |
|--------|------------|------------|
| Before | 1,087,444B | 1,476,872B |
| After | 1,079,340B | 1,469,784B |
Instead of including `mruby/presym.h` everywhere, we provided the
fallback `mruby/presym.inc` under `include/mruby` directory, and specify
`-I<build-dir>/include` before `-I<top-dir>/include` in `presym.rake`.
So even when someone drops `-I<build-dir>/include` in compiler options,
it just compiles without failure.
`calc_crc_16_ccitt()` consumes a lot of clock cycles in programs like
`mrbtest` which loads a lot of dumped binary. Error detection for flaky
channels should be done in the higher level.
Note: `mruby/c` should be updated to support this change.
The Hash implementation assumed that there were always empty buckets, but
sometimes there were only active or deleted buckets (no empty buckets).
Therefore, fix it so that this situation does not occur.
### Example
```ruby
# example.rb
class A
attr_reader :v
def initialize(v) @v = v end
def ==(o) @v == o.v end
def hash; @v end
def to_s; "#{self.class}[#{@v}]" end
alias eql? ==
alias inspect to_s
end
keys = (0..31).map{A.new(_1)}
h = {}
(0..16).each{h[keys[_1]] = _1}
(17..31).each do
k = keys[_1]
h[k] = _1
h.delete(k)
end
p h.keys
```
#### Before this patch:
```console
$ bin/mruby example.rb
[A[0], A[1], A[2], A[3], A[4], A[5], A[6], A[7], A[8], A[9], A[10], A[11], A[12], A[13], A[14], A[15], A[16], A[30], A[31]]
```
#### After this patch:
```console
$ bin/mruby example.rb
[A[0], A[1], A[2], A[3], A[4], A[5], A[6], A[7], A[8], A[9], A[10], A[11], A[12], A[13], A[14], A[15], A[16]]
```
When I `#call` the "proc" object created by the `mrb_proc_new_cfunc()` function from Ruby space, the return value did not go into the correct stack position.
This can destroy the calling variable.
This issue is now caused by #5272. sorry.
Previously I used the `RData` object to avoid a memory leak in `mrb_irep` if `src/load.c` failed.
ref: https://github.com/mruby/mruby/pull/4250
commit: f1523d2404
Considering that the `RProc` object will be created in the subsequent process, it is preferable to create the `RProc` object from the beginning.
Along with this, the inside of `read_irep()` is replaced with the processing centered on the `RProc` object.
The global function that returns the `mrb_irep` pointer is still provided for compatibility.
This enhances self-containment.
- Changed the `mrb_callinfo::pc` field to point to itself.
Previously it indicated the return destination of the previous call level.
`mrb_callinfo::pc` will now hold the address to its own `proc->body.irep->iseq`.
- Removed `mrb_callinfo::err` field.
This is because `mrb_callinfo::pc - 1` is semantically the same as the previous `err`.
- The `pc0` and `pc_save` variables in `mrb_vm_exec()` are no longer needed and have been deleted.
- It removes the argument because `cipush()` doesn't need to save the previous `pc`.
This enhances self-containment.
Previously `mrb_context::stack` had the current call level stack, but now it owns it.
The `mrb_context::stack` field, which is no longer needed, will be removed.
KOBAYASHI Shuji