From dd998dd561c75054679f69b7e9d30af4bae7cfaa Mon Sep 17 00:00:00 2001
From: nobu <nobu@b2dd03c8-39d4-4d8f-98ff-823fe69b080e>
Date: Mon, 17 Feb 2014 08:41:57 +0000
Subject: [PATCH] marshal.c: do not recycle wrapper objects

* marshal.c (marshal_dump, marshal_load): do not recycle wrapper
  objects, to prevent from segfault with continuation.
  [ruby-dev:47970] [Bug #9523]

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@45025 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
---
 ChangeLog                 |  6 ++++++
 marshal.c                 |  8 ++++----
 test/ruby/test_marshal.rb | 19 +++++++++++++++++++
 3 files changed, 29 insertions(+), 4 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index 3c9b89f088..a53c1a67c9 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,9 @@
+Mon Feb 17 17:41:55 2014  Nobuyoshi Nakada  <nobu@ruby-lang.org>
+
+	* marshal.c (marshal_dump, marshal_load): do not recycle wrapper
+	  objects, to prevent from segfault with continuation.
+	  [ruby-dev:47970] [Bug #9523]
+
 Mon Feb 17 15:43:59 2014  Zachary Scott  <e@zzak.io>
 
 	* doc/keywords.rdoc: [DOC] Add keywords doc by documenting-ruby/ruby#29
diff --git a/marshal.c b/marshal.c
index b8106d7e48..7772b4cb2a 100644
--- a/marshal.c
+++ b/marshal.c
@@ -993,8 +993,8 @@ marshal_dump(int argc, VALUE *argv)
 	rb_io_write(arg->dest, arg->str);
 	rb_str_resize(arg->str, 0);
     }
-    free_dump_arg(arg);
-    rb_gc_force_recycle(wrapper); /* also guards from premature GC */
+    clear_dump_arg(arg);
+    RB_GC_GUARD(wrapper);
 
     return port;
 }
@@ -2004,8 +2004,8 @@ marshal_load(int argc, VALUE *argv)
 
     if (!NIL_P(proc)) arg->proc = proc;
     v = r_object(arg);
-    free_load_arg(arg);
-    rb_gc_force_recycle(wrapper); /* also guards from premature GC */
+    clear_load_arg(arg);
+    RB_GC_GUARD(wrapper);
 
     return v;
 }
diff --git a/test/ruby/test_marshal.rb b/test/ruby/test_marshal.rb
index d0ae231d87..1bbc999258 100644
--- a/test/ruby/test_marshal.rb
+++ b/test/ruby/test_marshal.rb
@@ -611,4 +611,23 @@ class TestMarshal < Test::Unit::TestCase
     end
     assert_empty(tainted.map {|x| [x, x.class]}, bug8945)
   end
+
+  class Bug9523
+    attr_reader :cc
+    def marshal_dump
+      callcc {|c| @cc = c }
+      nil
+    end
+    def marshal_load(v)
+    end
+  end
+
+  def test_continuation
+    require "continuation"
+    c = Bug9523.new
+    assert_raise_with_message(RuntimeError, /Marshal\.dump reentered at marshal_dump/) do
+      Marshal.dump(c)
+      c.cc.call
+    end
+  end
 end