Issue #20577 has been reported by mdalessio (Mike Dalessio). ---------------------------------------- Bug #20577: FREE_AT_EXIT segfaulting after 32683aa1 https://bugs.ruby-lang.org/issues/20577 * Author: mdalessio (Mike Dalessio) * Status: Open * ruby -v: ruby 3.4.0dev (2024-06-11T14:33:51Z master 32683aa18d) [x86_64-linux] * Backport: 3.1: UNKNOWN, 3.2: UNKNOWN, 3.3: UNKNOWN ---------------------------------------- After commit 32683aa1 on master, using `RUBY_FREE_AT_EXIT` results in a segfault. When run with valgrind, many invalid reads are reported. Repro with ``` RUBY_FREE_AT_EXIT=1 bundle exec /path/to/ruby -e 'puts RUBY_DESCRIPTION' ``` or for valgrind details ``` RUBY_FREE_AT_EXIT=1 bundle exec valgrind /path/to/ruby -e 'puts RUBY_DESCRIPTION' ``` Typical example valgrind error is: ``` ==441955== Invalid read of size 4 ==441955== at 0x2C6F97: hash_table_index (id_table.c:132) ==441955== by 0x2C6F97: rb_id_table_lookup (id_table.c:230) ==441955== by 0x31AB50: cached_callable_method_entry (vm_method.c:1415) ==441955== by 0x31AB50: callable_method_entry_or_negative (vm_method.c:1485) ==441955== by 0x31C4EE: callable_method_entry (vm_method.c:1522) ==441955== by 0x31C4EE: rb_callable_method_entry (vm_method.c:1529) ==441955== by 0x18F370: obj_any_hash (hash.c:222) ==441955== by 0x19F444: any_hash (hash.c:204) ==441955== by 0x19F444: rb_any_hash (hash.c:260) ==441955== by 0x19F444: ar_do_hash (hash.c:418) ==441955== by 0x19F444: ar_delete (hash.c:1093) ==441955== by 0x19F444: rb_hash_stlike_delete (hash.c:2385) ==441955== by 0x1A0CCB: rb_hash_delete_entry (hash.c:2402) ==441955== by 0x2C59B6: rb_gc_free_dsymbol (symbol.c:851) ==441955== by 0x17AC53: obj_free (gc.c:3460) ==441955== by 0x17D045: rb_objspace_call_finalizer_i (gc.c:4352) ==441955== by 0x17D045: gc_each_object (gc.c:4302) ==441955== by 0x17D045: rb_objspace_call_finalizer (gc.c:4401) ==441955== by 0x162719: rb_ec_finalize (eval.c:164) ==441955== by 0x162719: rb_ec_cleanup (eval.c:255) ==441955== by 0x15CE09: rb_main (main.c:40) ==441955== by 0x15CE09: main (main.c:59) ==441955== Address 0x4ec4610 is 0 bytes inside a block of size 24 free'd ==441955== at 0x484988F: free (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==441955== by 0x175BD1: objspace_xfree (gc.c:12153) ==441955== by 0x175BD1: objspace_xfree (gc.c:12084) ==441955== by 0x175BD1: ruby_sized_xfree.constprop.0 (gc.c:12257) ==441955== by 0x17A9A0: obj_free (gc.c:3293) ==441955== by 0x17D045: rb_objspace_call_finalizer_i (gc.c:4352) ==441955== by 0x17D045: gc_each_object (gc.c:4302) ==441955== by 0x17D045: rb_objspace_call_finalizer (gc.c:4401) ==441955== by 0x162719: rb_ec_finalize (eval.c:164) ==441955== by 0x162719: rb_ec_cleanup (eval.c:255) ==441955== by 0x15CE09: rb_main (main.c:40) ==441955== by 0x15CE09: main (main.c:59) ==441955== Block was alloc'd at ==441955== at 0x4846828: malloc (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==441955== by 0x189B0A: objspace_xmalloc0 (gc.c:11938) ==441955== by 0x2C6EA6: rb_id_table_create (id_table.c:98) ==441955== by 0x31AD99: cache_callable_method_entry (vm_method.c:1444) ==441955== by 0x31AD99: callable_method_entry_or_negative (vm_method.c:1502) ==441955== by 0x32A7DE: callable_method_entry (vm_method.c:1522) ==441955== by 0x32A7DE: vm_respond_to (vm_method.c:2878) ==441955== by 0x3305E3: check_funcall_respond_to (vm_eval.c:602) ==441955== by 0x3305E3: rb_check_funcall_default_kw (vm_eval.c:676) ==441955== by 0x20E896: convert_type_with_id (object.c:3131) ==441955== by 0x20E896: rb_check_convert_type_with_id (object.c:3223) ==441955== by 0x1672A7: rb_stat (file.c:1299) ==441955== by 0x16E15E: rb_file_exist_p (file.c:1805) ==441955== by 0x16E15E: rb_check_realpath_internal (file.c:4567) ==441955== by 0x1D6639: get_loaded_features_index (load.c:415) ==441955== by 0x1D6FB7: rb_provide_feature (load.c:703) ==441955== by 0x1A2629: rb_call_inits (inits.c:64) ==441955== by 0x162B67: ruby_setup (eval.c:86) ==441955== by 0x162C1C: ruby_init (eval.c:98) ==441955== by 0x15CDF7: rb_main (main.c:39) ==441955== by 0x15CDF7: main (main.c:59) ``` I'm attaching a full log from my system. cc @peterzhu2118 ---Files-------------------------------- bug.log (238 KB) -- https://bugs.ruby-lang.org/