GitHub: fix#2902, #2917
The current implementation traverses stack to retrieve backtrace. But
stack will be changed when some operations are occurred. It means that
backtrace may be broken after some operations.
This change (1) saves the minimum information to retrieve backtrace when
exception is raised and (2) restores backtrace from the minimum
information when backtrace is needed. It reduces overhead for creating
backtrace Ruby objects.
The space for the minimum information is reused by multiple
exceptions. So memory allocation isn't occurred for each exception.
It isn't needed as it's very similar to mrb_define_method_raw() and also
there's only one place where mrb_proc_ptr() actually has to be called.
Inspired by @furunkel's method cache patch (#2764).
The following program reproduces this problem:
#include <mruby.h>
static mrb_value
recursive(mrb_state *mrb, mrb_value self)
{
mrb_int n;
mrb_get_args(mrb, "i", &n);
if (n == 0) {
mrb_raise(mrb, E_RUNTIME_ERROR, "XXX");
} else {
mrb_funcall(mrb, self, "recursive", 1, mrb_fixnum_value(n - 1));
}
return self;
}
int
main(void)
{
mrb_state *mrb;
mrb = mrb_open();
mrb_define_method(mrb, mrb->kernel_module, "recursive", recursive,
MRB_ARGS_REQ(1));
mrb_funcall(mrb, mrb_top_self(mrb), "recursive", 1, mrb_fixnum_value(30));
mrb_close(mrb);
}
Recursive method call isn't required. It's just for expanding call info
stack.
If mrb_realloc() is called in cipush(), cibase address is changed. So,
we shouldn't compare ci before mrb_realloc() and cibase after
mrb_realloc(). It accesses unknown address and causes crash.
In src/vm.c: mrb_funcall_with_block
stack_extend may realloc mrb->c->stbase, if argv points on mruby's stack,
then it points invalid address after stack_extend.
e.g. src/class.c: mrb_instance_new
This code:
```ruby
class A
def initialize(a0,a1,a2,a3,a4)
a0.is_a? Array
end
end
def f(a0,a1,a2,a3,a4)
A.new(a0,a1,a2,a3,a4)
f(a0,a1,a2,a3,a4)
end
f(0,1,2,3,4)
```
is expected to get exception
```
stack level too deep. (limit=(0x40000 - 128)) (SystemStackError)
```
but get segfault.
Signed-off-by: Go Saito <gos@iij.ad.jp>
How to reproduce:
class A
def x
yield
ensure
y
end
def y
end
end
# Work
A.new.x do
end
# Not work
# trace:
# [2] /tmp/a.rb:5:in A.x
# [0] /tmp/a.rb:15
# /tmp/a.rb:5: undefined method 'y' for main (NoMethodError)
A.new.x do
break
end
# trace:
# [2] /tmp/a.rb:5:in A.call
# [0] /tmp/a.rb:19
# /tmp/a.rb:5: undefined method 'y' for main (NoMethodError)
lambda do
A.new.x do
return
end
end.call
`self` in ensure is broken when yield and break/return are used.
Kouhei Sutou