It used to be return the default value if available, but it should
ignore the default value for behavior consistency. CRuby will adopt
this behavior too in the future. [ruby-bugs:16908]
In `h_check_modified()`, in the case of `MRB_NO_BOXING`, `ht_ea()` or
`ht_ea_capa()` for AR may read uninitialized area. Therefore, do not use
those macros for AR in `MRB_NO_BOXING` (but in the case of `MRB_64BIT`,
`ht_ea_capa()` is the same as `ar_ea_capa()`, so use it).
fix#5332
### Example
##### example.rb
```ruby
h = {}
(1..17).each{h[_1] = _1}
(1..16).each{h.delete(_1)}
h.rehash
```
##### ASAN report
```console
$ bin/mruby example.rb
==52587==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000006998 at pc 0x55a29cddf96b bp 0x7fff7b1b1720 sp 0x7fff7b1b1710
READ of size 4 at 0x602000006998 thread T0
#0 0x55a29cddf96a in ib_it_next /mruby/src/hash.c:639
#1 0x55a29cde2ca2 in ht_rehash /mruby/src/hash.c:900
#2 0x55a29cde379f in h_rehash /mruby/src/hash.c:996
#3 0x55a29cde7f3d in mrb_hash_rehash /mruby/src/hash.c:1735
#4 0x55a29ce77b62 in mrb_vm_exec /mruby/src/vm.c:1451
#5 0x55a29ce5fa88 in mrb_vm_run /mruby/src/vm.c:981
#6 0x55a29ceb87e1 in mrb_top_run /mruby/src/vm.c:2874
#7 0x55a29cf36bdf in mrb_load_exec mrbgems/mruby-compiler/core/parse.y:6805
#8 0x55a29cf36f25 in mrb_load_detect_file_cxt mrbgems/mruby-compiler/core/parse.y:6848
#9 0x55a29cdba0a2 in main /mruby/mrbgems/mruby-bin-mruby/tools/mruby/mruby.c:347
#10 0x7f24ef43b0b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
#11 0x55a29cdb4a6d in _start (/mruby/bin/mruby+0x2a3a6d)
0x602000006998 is located 0 bytes to the right of 8-byte region [0x602000006990,0x602000006998)
allocated by thread T0 here:
#0 0x7f24f01cfffe in __interceptor_realloc (/lib/x86_64-linux-gnu/libasan.so.5+0x10dffe)
#1 0x55a29ceb9440 in mrb_default_allocf /mruby/src/state.c:68
#2 0x55a29cdba747 in mrb_realloc_simple /mruby/src/gc.c:228
#3 0x55a29cdba928 in mrb_realloc /mruby/src/gc.c:242
#4 0x55a29cde12e5 in ht_init /mruby/src/hash.c:749
#5 0x55a29cde2b8e in ht_rehash /mruby/src/hash.c:897
#6 0x55a29cde379f in h_rehash /mruby/src/hash.c:996
#7 0x55a29cde7f3d in mrb_hash_rehash /mruby/src/hash.c:1735
#8 0x55a29ce77b62 in mrb_vm_exec /mruby/src/vm.c:1451
#9 0x55a29ce5fa88 in mrb_vm_run /mruby/src/vm.c:981
#10 0x55a29ceb87e1 in mrb_top_run /mruby/src/vm.c:2874
#11 0x55a29cf36bdf in mrb_load_exec mrbgems/mruby-compiler/core/parse.y:6805
#12 0x55a29cf36f25 in mrb_load_detect_file_cxt mrbgems/mruby-compiler/core/parse.y:6848
#13 0x55a29cdba0a2 in main /mruby/mrbgems/mruby-bin-mruby/tools/mruby/mruby.c:347
#14 0x7f24ef43b0b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
```
Instead of including `mruby/presym.h` everywhere, we provided the
fallback `mruby/presym.inc` under `include/mruby` directory, and specify
`-I<build-dir>/include` before `-I<top-dir>/include` in `presym.rake`.
So even when someone drops `-I<build-dir>/include` in compiler options,
it just compiles without failure.
The Hash implementation assumed that there were always empty buckets, but
sometimes there were only active or deleted buckets (no empty buckets).
Therefore, fix it so that this situation does not occur.
### Example
```ruby
# example.rb
class A
attr_reader :v
def initialize(v) @v = v end
def ==(o) @v == o.v end
def hash; @v end
def to_s; "#{self.class}[#{@v}]" end
alias eql? ==
alias inspect to_s
end
keys = (0..31).map{A.new(_1)}
h = {}
(0..16).each{h[keys[_1]] = _1}
(17..31).each do
k = keys[_1]
h[k] = _1
h.delete(k)
end
p h.keys
```
#### Before this patch:
```console
$ bin/mruby example.rb
[A[0], A[1], A[2], A[3], A[4], A[5], A[6], A[7], A[8], A[9], A[10], A[11], A[12], A[13], A[14], A[15], A[16], A[30], A[31]]
```
#### After this patch:
```console
$ bin/mruby example.rb
[A[0], A[1], A[2], A[3], A[4], A[5], A[6], A[7], A[8], A[9], A[10], A[11], A[12], A[13], A[14], A[15], A[16]]
```
* The term `hash_table` can be misleading because the return value of this
function includes memory usage of entire `Hash` object, including not only
hash table part but also entry list part, etc.
* This function takes a `Hash` object as a receiver and is defined in
`src/hash.c`, so it is natural to have a `mrb_hash_` prefix.
- Integrate `Fixnum` and `Integer`
- Remove `Integral`
- `int / int -> int`
- Replace `mrb_fixnum()` to `mrb_int()`
- Replace `mrb_fixnum_value()` to `mrb_int_value()`.
- Use `mrb_integer_p()` instead of `mrb_fixnum_p()`
- `MRB_WITHOUT_FLOAT` => `MRB_NO_FLOAT`
- `MRB_USE_FLOAT` => `MRB_USE_FLOAT32`
The former is to use `USE_XXX` naming convention. The latter is to make
sure `float` is 32bit float and not floating point number in general.
The function corresponding to `ht_hash_func()` was as follows in the days of
khash implementation (before d78acc7a).
```c
mrb_hash_ht_hash_func(mrb_state *mrb, mrb_value key)
{
enum mrb_vtype t = mrb_type(key);
...
switch (t) {
...
default:
hv = mrb_funcall(mrb, key, "hash", 0);
h = (khint_t)t ^ (khint_t)mrb_fixnum(hv);
break;
}
...
}
```
When switched to the segmented list implementation (d78acc7a), this function
was changed as follows.
```c
sg_hash_func(mrb_state *mrb, seglist *t, mrb_value key)
{
enum mrb_vtype tt = mrb_type(key);
...
switch (tt) {
...
default:
hv = mrb_funcall(mrb, key, "hash", 0);
h = (size_t)t ^ (size_t)mrb_fixnum(hv);
break;
}
...
}
```
Since the argument `t` was added, the variable for type tag was changed from
`t` to `tt`, but the variable used in the expression of `h` remained `t`.
Probably this is an omission of change, so fixed it.
`mrb_get_arg1()` raises `ArgumentError` if the method does not receive one
argument.
And replaces all `mrb_get_args(mrb, "o", &arg)` by the new function.
### Example
```ruby
# example.rb
class A
def eql?(o)
p self.class
super
end
def hash
1
end
end
class B < A; end
h = {A.new => 1}
h[B.new]
```
#### Before this patch:
```console
$ bin/mruby example.rb
A
```
#### After this patch (same as Ruby)
```console
$ bin/mruby example.rb
B
```
Yukihiro "Matz" Matsumoto