Fix use-after-poison

ChrisBr · ChrisBr · commit 5fdb124941f7 · 2026-02-09T11:58:23.000Z
==50214==ERROR: AddressSanitizer: use-after-poison on address 0x7bc7b6c3fc80 at pc 0x7bc7c6ab22ac bp 0x7bc74801cc90 sp 0x7bc74801cc88 READ of size 8 at 0x7bc7b6c3fc80 thread T0 #0 0x7bc7c6ab22ab in dump_object /tmp/ruby-build/ruby-3.4.8-pshopify2/ext/objspace/objspace_dump.c:453:64 #1 0x7bc7c6ab9a69 in heap_i /tmp/ruby-build/ruby-3.4.8-pshopify2/ext/objspace/objspace_dump.c:666:13 #2 0x56c8be2533df in objspace_each_objects_try /tmp/ruby-build/ruby-3.4.8-pshopify2/./gc/default/default.c:2743:17 #3 0x56c8be1f822d in rb_ensure /tmp/ruby-build/ruby-3.4.8-pshopify2/eval.c:1074:18 #4 0x56c8be227adb in objspace_each_exec /tmp/ruby-build/ruby-3.4.8-pshopify2/./gc/default/default.c:2774:5 #5 0x56c8be227adb in objspace_each_objects /tmp/ruby-build/ruby-3.4.8-pshopify2/./gc/default/default.c:2787:5 #6 0x56c8be227adb in rb_gc_impl_each_objects /tmp/ruby-build/ruby-3.4.8-pshopify2/./gc/default/default.c:2793:5 #7 0x56c8be227adb in rb_objspace_each_objects /tmp/ruby-build/ruby-3.4.8-pshopify2/gc.c:3089:5 #8 0x7bc7c6aaf970 in objspace_dump_all /tmp/ruby-build/ruby-3.4.8-pshopify2/ext/objspace/objspace_dump.c:852:5 #9 0x56c8be5b18a9 in vm_call_cfunc_with_frame_ /tmp/ruby-build/ruby-3.4.8-pshopify2/./vm_insnhelper.c:3794:11 #10 0x56c8be59910f in vm_call_method_each_type /tmp/ruby-build/ruby-3.4.8-pshopify2/./vm_insnhelper.c:4772:16 #11 0x56c8be598bfa in vm_call_method /tmp/ruby-build/ruby-3.4.8-pshopify2/./vm_insnhelper.c #12 0x56c8be55d033 in vm_sendish /tmp/ruby-build/ruby-3.4.8-pshopify2/./vm_insnhelper.c:5961:15 #13 0x56c8be55d033 in vm_exec_core /tmp/ruby-build/ruby-3.4.8-pshopify2/insns.def:898:11 #14 0x56c8be553fd0 in rb_vm_exec /tmp/ruby-build/ruby-3.4.8-pshopify2/vm.c:2595:22 #15 0x56c8be5cba1c in invoke_iseq_block_from_c /tmp/ruby-build/ruby-3.4.8-pshopify2/vm.c:1625:12 #16 0x56c8be5cba1c in invoke_block_from_c_bh /tmp/ruby-build/ruby-3.4.8-pshopify2/vm.c:1639:20 #17 0x56c8be57e5d6 in vm_yield_with_cref /tmp/ruby-build/ruby-3.4.8-pshopify2/vm.c:1676:12 #18 0x56c8be57e5d6 in vm_yield /tmp/ruby-build/ruby-3.4.8-pshopify2/vm.c:1684:12 #19 0x56c8be57e5d6 in rb_yield_0 /tmp/ruby-build/ruby-3.4.8-pshopify2/./vm_eval.c:1344:12 #20 0x56c8be57e5d6 in rb_yield /tmp/ruby-build/ruby-3.4.8-pshopify2/./vm_eval.c #21 0x56c8be1f822d in rb_ensure /tmp/ruby-build/ruby-3.4.8-pshopify2/eval.c:1074:18 #22 0x56c8be5b18a9 in vm_call_cfunc_with_frame_ /tmp/ruby-build/ruby-3.4.8-pshopify2/./vm_insnhelper.c:3794:11 #23 0x56c8be55f22e in vm_sendish /tmp/ruby-build/ruby-3.4.8-pshopify2/./vm_insnhelper.c:5961:15 #24 0x56c8be55f22e in vm_exec_core /tmp/ruby-build/ruby-3.4.8-pshopify2/insns.def:851:11 #25 0x56c8be553fd0 in rb_vm_exec /tmp/ruby-build/ruby-3.4.8-pshopify2/vm.c:2595:22 #26 0x56c8be5c36f6 in vm_call0_body /tmp/ruby-build/ruby-3.4.8-pshopify2/./vm_eval.c:225:20 #27 0x56c8be5c75ab in vm_call0_cc /tmp/ruby-build/ruby-3.4.8-pshopify2/./vm_eval.c:101:12 #28 0x56c8be5c75ab in rb_call0 /tmp/ruby-build/ruby-3.4.8-pshopify2/./vm_eval.c:554:12 #29 0x56c8be5c6bd9 in send_internal /tmp/ruby-build/ruby-3.4.8-pshopify2/./vm_eval.c:1258:11 #30 0x56c8be5b18a9 in vm_call_cfunc_with_frame_ /tmp/ruby-build/ruby-3.4.8-pshopify2/./vm_insnhelper.c:3794:11 #31 0x56c8be55d033 in vm_sendish /tmp/ruby-build/ruby-3.4.8-pshopify2/./vm_insnhelper.c:5961:15 #32 0x56c8be55d033 in vm_exec_core /tmp/ruby-build/ruby-3.4.8-pshopify2/insns.def:898:11 #33 0x56c8be553fd0 in rb_vm_exec /tmp/ruby-build/ruby-3.4.8-pshopify2/vm.c:2595:22 #34 0x56c8be58caaf in invoke_iseq_block_from_c /tmp/ruby-build/ruby-3.4.8-pshopify2/vm.c:1625:12 #35 0x56c8be58caaf in invoke_block_from_c_proc /tmp/ruby-build/ruby-3.4.8-pshopify2/vm.c:1719:16 #36 0x56c8be58caaf in vm_invoke_proc /tmp/ruby-build/ruby-3.4.8-pshopify2/vm.c:1749:12 #37 0x56c8be58b042 in rb_vm_invoke_proc /tmp/ruby-build/ruby-3.4.8-pshopify2/vm.c:1770:16 #38 0x56c8be9207c3 in rb_fiber_start /tmp/ruby-build/ruby-3.4.8-pshopify2/cont.c:2502:23 #39 0x56c8be928253 in fiber_entry /tmp/ruby-build/ruby-3.4.8-pshopify2/cont.c:860:5 SUMMARY: AddressSanitizer: use-after-poison /tmp/ruby-build/ruby-3.4.8-pshopify2/ext/objspace/objspace_dump.c:453:64 in dump_object
diff --git a/ext/objspace/objspace_dump.c b/ext/objspace/objspace_dump.c
@@ -454,11 +454,14 @@ dump_object(VALUE obj, struct dump_config *dc)
             {
                 VALUE klass = ((const struct rb_callcache *)obj)->klass;
                 if (klass != Qundef) {
-                    mid = vm_cc_cme((const struct rb_callcache *)obj)->called_id;
-                    if (mid != 0) {
-                        dump_append(dc, ", \"called_id\":");
-                        dump_append_id(dc, mid);
-
+                    const rb_callable_method_entry_t *cme = vm_cc_cme((const struct rb_callcache *)obj);
+                    if (cme) {
+                        mid = cme->called_id;
+                        if (mid != 0) {
+                            dump_append(dc, ", \"called_id\":");
+                            dump_append_id(dc, mid);
+
+                        }
                     }
 
                     dump_append(dc, ", \"receiver_class\":");
