kotovalexarian-likes-github/ruby--ruby
1
0
Fork 0
mirror of https://github.com/ruby/ruby.git synced 2022-11-09 12:17:21 -05:00
Code Releases Activity

[Bug #18501] Fire write barrier after hash has been written

Browse source 
Before this change the write barrier was executed before the key and
value were actually reachable via the Hash.  This could cause
inconsistencies in object coloration which would lead to accidental
collection of dup'd keys.

Example:

1. Object O is grey, Object P is white.
2. Write barrier fires O -> P
3. Write barrier does nothing
4. Malloc happens, which starts GC
5. GC colors O black
6. P is written in to O (now we have O -> P reference)
7. P is now accidentally treated as garbage
This commit is contained in:
Aaron Patterson 2022-01-28 10:06:02 -08:00 • committed by Aaron Patterson
parent 06e96b922f
commit 2a76440fac
Notes: git 2022-02-05 07:36:26 +09:00
1 changed files with 15 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

20
hash.c
View file

@ -1673,6 +1673,8 @@ struct update_arg {
st_data_t arg;
st_update_callback_func *func;
VALUE hash;
VALUE key;
VALUE value;
};
typedef int (*tbl_update_func)(st_data_t *, st_data_t *, st_data_t, int);
@ -1705,11 +1707,11 @@ tbl_update_modify(st_data_t *key, st_data_t *val, st_data_t arg, int existing)
default:
break;
case ST_CONTINUE:
if (!existing || *key != old_key || *val != old_value)
if (!existing || *key != old_key || *val != old_value) {
rb_hash_modify(hash);
/* write barrier */
RB_OBJ_WRITTEN(hash, Qundef, *key);
RB_OBJ_WRITTEN(hash, Qundef, *val);
p->key = *key;
p->value = *val;
}
break;
case ST_DELETE:
if (existing)
@ -1727,9 +1729,17 @@ tbl_update(VALUE hash, VALUE key, tbl_update_func func, st_data_t optional_arg)
.arg = optional_arg,
.func = func,
.hash = hash,
.key = key,
.value = (VALUE)optional_arg,
};
return rb_hash_stlike_update(hash, key, tbl_update_modify, (st_data_t)&arg);
int ret = rb_hash_stlike_update(hash, key, tbl_update_modify, (st_data_t)&arg);
/* write barrier */
RB_OBJ_WRITTEN(hash, Qundef, arg.key);
RB_OBJ_WRITTEN(hash, Qundef, arg.value);
return ret;
}
#define UPDATE_CALLBACK(iter_lev, func) ((iter_lev) > 0 ? func##_noinsert : func##_insert)