KEMBAR78
Fix missing write barrier on Generator State by jhawthorn · Pull Request #826 · ruby/json · GitHub
Skip to content

Conversation

@jhawthorn
Copy link
Member

@jhawthorn jhawthorn commented Jul 23, 2025

Found by wbcheck. This should only be a problem when state is an object rather than stack allocated.

WBCHECK ERROR: Missed write barrier detected!
  Parent object: 0x7b7b8487c450 (wb_protected: true)
       rb_obj_info_dump: 0x00007b7b8487c450 JSON/Generator/State/JSON::Ext::Generator::State JSON/Generator/State
  Reference counts - snapshot: 1, writebarrier: 0, current: 6, missed: 5
  Missing reference to: 0x7b7b82f35a10
    rb_obj_info_dump: 0x00007b7b82f35a10 T_STRING/String  len: 1, capa: 15 "1"
  Missing reference to: 0x7b7b82f35e90
    rb_obj_info_dump: 0x00007b7b82f35e90 T_STRING/String  len: 1, capa: 15 "2"
  Missing reference to: 0x7b7b83629e50
    rb_obj_info_dump: 0x00007b7b83629e50 T_STRING/String  len: 1, capa: 15 "3"
  Missing reference to: 0x7b7b83b62190
    rb_obj_info_dump: 0x00007b7b83b62190 T_STRING/String  len: 1, capa: 15 "4"
  Missing reference to: 0x7b7b83629490
    rb_obj_info_dump: 0x00007b7b83629490 T_STRING/String  len: 1, capa: 15 "5"

Found by wbcheck

   WBCHECK ERROR: Missed write barrier detected!
     Parent object: 0x7b7b8487c450 (wb_protected: true)
       rb_obj_info_dump: 0x00007b7b8487c450 JSON/Generator/State/JSON::Ext::Generator::State JSON/Generator/State
     Reference counts - snapshot: 1, writebarrier: 0, current: 6, missed: 5
     Missing reference to: 0x7b7b82f35a10
       rb_obj_info_dump: 0x00007b7b82f35a10 T_STRING/String  len: 1, capa: 15 "1"
     Missing reference to: 0x7b7b82f35e90
       rb_obj_info_dump: 0x00007b7b82f35e90 T_STRING/String  len: 1, capa: 15 "2"
     Missing reference to: 0x7b7b83629e50
       rb_obj_info_dump: 0x00007b7b83629e50 T_STRING/String  len: 1, capa: 15 "3"
     Missing reference to: 0x7b7b83b62190
       rb_obj_info_dump: 0x00007b7b83b62190 T_STRING/String  len: 1, capa: 15 "4"
     Missing reference to: 0x7b7b83629490
       rb_obj_info_dump: 0x00007b7b83629490 T_STRING/String  len: 1, capa: 15 "5"
@byroot
Copy link
Member

byroot commented Jul 23, 2025

Good catch. I don't think this can realistically cause a bug, but I'm all for silencing what wbcheck finds.

@byroot byroot merged commit babdd2c into ruby:master Jul 23, 2025
35 checks passed
@jhawthorn jhawthorn deleted the wbcheck_configure branch July 23, 2025 19:08
@jhawthorn
Copy link
Member Author

I agree it's unlikely in practice for the bug here to be hit, but I'm trying to convince both myself and others that nearly everything wbcheck finds is a "real" issue:

require "json"

state1 = JSON.state.new
3.times { GC.start }
state1.merge(
  indent: 1.to_s,
  space: 2.to_s,
  space_before: 3.to_s,
  object_nl: 4.to_s,
  array_nl: 5.to_s
)
GC.start(full_mark: false)
state1.generate({foo: 123})
ruby test.rb
test.rb:13: [BUG] Segmentation fault at 0x0000000000000001
ruby 3.4.4 (2025-05-14 revision a38531fd3f) +PRISM [arm64-darwin24]

-- Crash Report log information --------------------------------------------
   See Crash Report log file in one of the following locations:
     * ~/Library/Logs/DiagnosticReports
     * /Library/Logs/DiagnosticReports
   for more details.
Don't forget to include the above Crash Report log file in bug reports.

-- Control frame information -----------------------------------------------
c:0003 p:---- s:0012 e:000011 CFUNC  :generate
c:0002 p:0057 s:0007 E:000c38 EVAL   test.rb:13 [FINISH]
c:0001 p:0000 s:0003 E:0015f0 DUMMY  [FINISH]

@byroot
Copy link
Member

byroot commented Jul 23, 2025

Yeah, when I say unlikely, is that the object wouldn't be old by that point (unless GC.stress etc). So defiitely real, but also definitely almost impossible to happen in real world code, hence likely why it was missed.

This is more me stating that this doesn't warrant a bug fix release on its own.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants