diff options
| author | Aaron Patterson <[email protected]> | 2023-09-11 14:11:46 -0700 |
|---|---|---|
| committer | Aaron Patterson <[email protected]> | 2023-09-15 09:01:02 -0700 |
| commit | a1dc1a3de9683daf5a543d6f618e17aabfcb8708 () | |
| tree | 4929f01ae37c5d1fd81ae11d5ddcde8a9300bcbc /vm_backtrace.c | |
| parent | efe2822708d62bfe3ba858da526e6ef7d4724959 (diff) | |
Return line 0 for JIT frames
Frames pushed by YJIT have an unreliable PC. The PC could be garbage, and if we try to read the line number with a garbage PC, then the program can crash. This commit returns line 0 for programs where there is a `jit_return` function. If `jit_return` has been set then this frame was pushed by the JIT, and we cannot trust the PC. Here is a debugger session for a program that crashed due to a broken PC: ``` (lldb) p ruby_current_vm_ptr->ractor.main_thread->ec->cfp->iseq->body->iseq_encoded (VALUE *) $0 = 0x0000000118a30e00 (lldb) p/x ruby_current_vm_ptr->ractor.main_thread->ec->cfp->pc (const VALUE *) $1 = 0x0000600000b02d00 (lldb) p/x ruby_current_vm_ptr->ractor.main_thread->ec->cfp->jit_return (void *) $2 = 0x000000010622942c ``` You can see the PC is completely out of range, but there is a `jit_return` pointer so we can avoid this crash.
| -rw-r--r-- | vm_backtrace.c | 14 |
1 files changed, 13 insertions, 1 deletions
@@ -1583,6 +1583,7 @@ rb_profile_frames(int start, int limit, VALUE *buff, int *lines) int i; const rb_execution_context_t *ec = GET_EC(); const rb_control_frame_t *cfp = ec->cfp, *end_cfp = RUBY_VM_END_CONTROL_FRAME(ec); const rb_callable_method_entry_t *cme; // If this function is called inside a thread after thread creation, but @@ -1613,7 +1614,18 @@ rb_profile_frames(int start, int limit, VALUE *buff, int *lines) buff[i] = (VALUE)cfp->iseq; } - if (lines) lines[i] = calc_lineno(cfp->iseq, cfp->pc); i++; } |