Skip to content

Commit

Permalink
YJIT: Fix canary crash with Array#<<
Browse files Browse the repository at this point in the history
Previously, we got "We are killing the stack canary set by opt_ltlt"
from `$./miniruby --yjit-call-threshold=1 -e 'a = [].freeze; a << 1'`

Found by running ruby-spec with yjit-call-threshold=1.
  • Loading branch information
XrXr committed Apr 17, 2024
1 parent 48846d6 commit ada0d9b
Showing 1 changed file with 4 additions and 2 deletions.
6 changes: 4 additions & 2 deletions yjit/src/codegen.rs
Original file line number Diff line number Diff line change
Expand Up @@ -5929,8 +5929,10 @@ fn jit_rb_ary_push(
) -> bool {
asm_comment!(asm, "Array#<<");

// rb_ary_push allocates memory for buffer extension
jit_prepare_call_with_gc(jit, asm);
// rb_ary_push allocates memory for buffer extension and can raise FrozenError
// Not using a lazy frame here since the interpreter also has a truncated
// stack trace from opt_ltlt.
jit_prepare_non_leaf_call(jit, asm);

let item_opnd = asm.stack_opnd(0);
let ary_opnd = asm.stack_opnd(1);
Expand Down

0 comments on commit ada0d9b

Please sign in to comment.