[ruby-core:115055] [Ruby master Bug#19917] Segmentation fault or lost objects when using Ractor.select with moved exceptions

15 Oct 2023

      Issue #19917 has been updated by luke-gru (Luke Gruber).

I'm not in front of a machine that runs ruby right now, but I don't think this has to do with ractors. I was trying things out in the ruby playground and managed to crash ruby with this as well:

```ruby
100.times do |j|
  ractor_count = 10

  ractors = Array.new(ractor_count) do |i|
    Proc.new do
      begin
        raise 'foo'
      rescue => e
        err = Marshal.load(Marshal.dump(e))
      end
      #e
    end
  end

  ractors.each(&:call)
end
```

It looks like it's something related to Marshal.

----------------------------------------
Bug #19917: Segmentation fault or lost objects when using Ractor.select with moved exceptions
https://bugs.ruby-lang.org/issues/19917#change-104930

* Author: toy (Ivan Kuchin)
* Status: Open
* Priority: Normal
* ruby -v: ruby 3.2.2 (2023-03-30 revision e51014f9c0) [x86_64-linux]
* Backport: 3.0: UNKNOWN, 3.1: UNKNOWN, 3.2: UNKNOWN
----------------------------------------
I stumbled upon loss of messages with exceptions or even Segmentation fault during transfer of exception from Ractor when moving the exception. In versions 3.0 and 3.1 I saw only loss of messages, in 3.2 also Segmentation fault. Loss of messages happens only when using `Ractor.select` (not `Ractor#take`), but segmentation fault happens also using `Ractor#take`.

```ruby
100.times do
  ractor_count = 10

  ractors = Array.new(ractor_count) do |i|
    Ractor.new do
      begin
        raise 'foo'
      rescue => e
        # It is not possible to move exception without duplicating, but also
        # without it showing bactrace errors in 3.0 and is empty in 3.1+
        e = Marshal.load(Marshal.dump(e))
        Ractor.yield e, move: true
      end
      'message got lost'
    end
  end

  ractor_count.times do
    ractor, result = Ractor.select(*ractors)
    p result
    ractors.delete(ractor)
  end
end
```

In 3.0 and 3.1 will contain mix of `#<RuntimeError: foo>` and `"message got lost"`, in 3.2 may contain both and cause Segmentation fault. Excerpt of output (full output attached) from container running ruby:3.2 (`ruby 3.2.2 (2023-03-30 revision e51014f9c0) [x86_64-linux]`):
```
…
#<RuntimeError: RuntimeError>
"message got lost"
#<RuntimeError: RuntimeError>
#<RuntimeError: RuntimeError>
#<RuntimeError: RuntimeError>
#<RuntimeError: RuntimeError>
#<RuntimeError: RuntimeError>
#<RuntimeError: RuntimeError>
#<RuntimeError: RuntimeError>
#<RuntimeError: RuntimeError>
#<RuntimeError: RuntimeError>
#<RuntimeError: RuntimeError>
#<RuntimeError: RuntimeError>
#<RuntimeError: RuntimeError>
#<RuntimeError: RuntimeError>
#<RuntimeError: RuntimeError>
#<RuntimeError: RuntimeError>
#<RuntimeError: RuntimeError>
#<RuntimeError: RuntimeError>
#<RuntimeError: RuntimeError>
<internal:marshal>:34: [BUG] Segmentation fault at 0x0000000000000000
ruby 3.2.2 (2023-03-30 revision e51014f9c0) [x86_64-linux]

-- Control frame information -----------------------------------------------
c:0004 p:0006 s:0019 e:000018 METHOD <internal:marshal>:34
c:0003 p:0022 s:0011 e:000010 RESCUE (irb):11
c:0002 p:0007 s:0007 e:000006 BLOCK  (irb):6 [FINISH]
c:0001 p:---- s:0003 e:000002 DUMMY  [FINISH]

-- Ruby level backtrace information ----------------------------------------
(irb):6:in `block (3 levels) in <top (required)>'
(irb):11:in `rescue in block (3 levels) in <top (required)>'
<internal:marshal>:34:in `load'

-- Machine register context ------------------------------------------------
 RIP: 0x00007fabc1d64490 RBP: 0x0000000000000000 RSP: 0x00007fabbc71b0c0
 RAX: 0x0000000000000003 RBX: 0x00007fabbcebee88 RCX: 0x000000000000015f
 RDX: 0x0000556127db90f0 RDI: 0x000000000000015f RSI: 0x00007fabc2068628
  R8: 0x0000000000000001  R9: 0x0000000000000020 R10: 0x00005561285633d0
 R11: 0x0000000000000001 R12: 0x0000556127dbb710 R13: 0x00007fabc0601be0
 R14: 0x0000000000000018 R15: 0x0000000000000000 EFL: 0x0000000000010206
…
```

---Files--------------------------------
segmentation-fault.txt (27.8 KB)

-- 
https://bugs.ruby-lang.org/