From b8461c86817fd2f766746e61e9f93362955a3474 Mon Sep 17 00:00:00 2001
From: "Yukihiro \"Matz\" Matsumoto" <matz@ruby-lang.org>
Date: Mon, 3 Apr 2017 18:38:49 +0900
Subject: Protect ensure clause lambdas from GC; fix #3491

---
 src/gc.c | 8 +++-----
 src/vm.c | 3 ++-
 2 files changed, 5 insertions(+), 6 deletions(-)

(limited to 'src')

diff --git a/src/gc.c b/src/gc.c
index ecf25d637..391da84cb 100644
--- a/src/gc.c
+++ b/src/gc.c
@@ -565,7 +565,7 @@ mark_context_stack(mrb_state *mrb, struct mrb_context *c)
 static void
 mark_context(mrb_state *mrb, struct mrb_context *c)
 {
-  int i, e = 0;
+  int i;
   mrb_callinfo *ci;
 
   /* mark stack */
@@ -574,16 +574,14 @@ mark_context(mrb_state *mrb, struct mrb_context *c)
   /* mark VM stack */
   if (c->cibase) {
     for (ci = c->cibase; ci <= c->ci; ci++) {
-      if (ci->eidx > e) {
-        e = ci->eidx;
-      }
       mrb_gc_mark(mrb, (struct RBasic*)ci->env);
       mrb_gc_mark(mrb, (struct RBasic*)ci->proc);
       mrb_gc_mark(mrb, (struct RBasic*)ci->target_class);
     }
   }
   /* mark ensure stack */
-  for (i=0; i<e; i++) {
+  for (i=0; i<c->esize; i++) {
+    if (c->ensure[i] == NULL) break;
     mrb_gc_mark(mrb, (struct RBasic*)c->ensure[i]);
   }
   /* mark fibers */
diff --git a/src/vm.c b/src/vm.c
index 31093ade9..87262f1be 100644
--- a/src/vm.c
+++ b/src/vm.c
@@ -296,6 +296,7 @@ ecall(mrb_state *mrb, int i)
   }
   p = mrb->c->ensure[i];
   if (!p) return;
+  mrb->c->ensure[i] = NULL;
   if (mrb->c->ci->eidx > i)
     mrb->c->ci->eidx = i;
   cioff = mrb->c->ci - mrb->c->cibase;
@@ -310,7 +311,6 @@ ecall(mrb_state *mrb, int i)
   mrb->c->stack = mrb->c->stack + ci[-1].nregs;
   exc = mrb->exc; mrb->exc = 0;
   mrb_run(mrb, p, *self);
-  mrb->c->ensure[i] = NULL;
   mrb->c->ci = mrb->c->cibase + cioff;
   if (!mrb->exc) mrb->exc = exc;
 }
@@ -1148,6 +1148,7 @@ RETRY_TRY_BLOCK:
         mrb->c->ensure = (struct RProc **)mrb_realloc(mrb, mrb->c->ensure, sizeof(struct RProc*) * mrb->c->esize);
       }
       mrb->c->ensure[mrb->c->ci->eidx++] = p;
+      mrb->c->ensure[mrb->c->ci->eidx] = NULL;
       ARENA_RESTORE(mrb, ai);
       NEXT;
     }
-- 
cgit v1.2.3