Thanks to visit codestin.com
Credit goes to github.com

Skip to content

gc.c: Fix a race condition in object_id #13305

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

casperisfine
Copy link
Contributor

The shape was mistakenly accessed outside the lock.

cc @jhawthorn

This comment has been minimized.

@casperisfine
Copy link
Contributor Author

So this fixes the obvious race, but there is a more fundamental issue that isn't and maybe can't be fixed.

Prior to moving the object_id inside the object itself, frozen (hence shareable) objects would never be mutated, so reading their instance variables was always safe.

Now that object_id may need to resize a frozen object, ivar_get would need to synchronize when called on a potentially shared object, and that's really not what we want.

It's not great, but I'm afraid we may need to go back to a synchronized table to store object ids, at least in the case where the object is frozen and would need to be enlarged.

@casperisfine casperisfine force-pushed the objid-fix-race branch 6 times, most recently from 474602d to 8055a1b Compare May 14, 2025 13:06
obj_to_id_value = TypedData_Wrap_Struct(0, &obj_to_id_tbl_type, obj_to_id_tbl);
}
st_insert(obj_to_id_tbl, obj, id);
rb_shape_set_shape_id(obj, object_id_shape_id);
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We're running into the same issue than #13289. If we on 32bits the shape_id is in the generic_ivar table...

{
if (!tbl || tbl->num_entries == 0) return;

// FIXME: this certainly isn't correct. If a key moved, we need to re-hash.
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Note: don't merge without addressing that.

gc.c Outdated
@@ -1940,12 +2018,12 @@ object_id(VALUE obj)

if (UNLIKELY(rb_gc_multi_ractor_p() && rb_ractor_shareable_p(obj))) {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
if (UNLIKELY(rb_gc_multi_ractor_p() && rb_ractor_shareable_p(obj))) {
if (UNLIKELY(rb_gc_multi_ractor_p() && RB_OBJ_SHAREABLE_P(obj))) {

Faster and more restrictive check.

If an object is shareable and has no capacity left, it isn't
safe to store the object ID in fields as it requires an object
resize which can't be done unless all field reads are synchronized.

So in this case we have to store the ID externally like we used to.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants