SIGSEGV in mrb_vm_exec

How it was found

PoC:

The following code triggers the bug (attached as test_mrb_vm_exec_1296.rb):

0.instance_eval{super()}

Sandbox:

x@x:~/Desktop/research/mruby-engine/bin$ ./sandbox test_mrb_vm_exec_1296.rb 
./sandbox:20: [BUG] Segmentation fault at 0x00000000000028
ruby 2.2.6p396 (2016-11-15 revision 56800) [x86_64-linux-gnu]

-- Control frame information -----------------------------------------------
c:0003 p:---- s:0010 e:000009 CFUNC  :sandbox_eval
c:0002 p:0186 s:0005 E:001a28 EVAL   ./sandbox:20 [FINISH]
c:0001 p:0000 s:0002 E:000ff0 TOP    [FINISH]

-- Ruby level backtrace information ----------------------------------------
./sandbox:20:in `<main>'
./sandbox:20:in `sandbox_eval'

-- Machine register context ------------------------------------------------
 RIP: 0x00007f6775adcd27 RBP: 0x00007f67746c9a74 RSP: 0x00007f67746629e0
 RAX: 0x0000000000000000 RBX: 0x0000000000000000 RCX: 0x0000000000000001
 RDX: 0x000000000000004f RDI: 0x00007f67746644e0 RSI: 0x00007f6774662cb0
  R8: 0x00007f67746643e0  R9: 0x0000000000000000 R10: 0x00007f67746644e0
 R11: 0x0000000000000000 R12: 0x000000000000004f R13: 0x0000000000000000
 R14: 0x00007f6774676f80 R15: 0x00007f67746644e0 EFL: 0x0000000000010202

-- C level backtrace information -------------------------------------------
/usr/lib/x86_64-linux-gnu/libruby-2.2.so.2.2 [0x7f677a1dfd55]
/usr/lib/x86_64-linux-gnu/libruby-2.2.so.2.2 [0x7f677a1dff8c]
/usr/lib/x86_64-linux-gnu/libruby-2.2.so.2.2 [0x7f677a0bc06b]
/usr/lib/x86_64-linux-gnu/libruby-2.2.so.2.2 [0x7f677a17214e]
/lib/x86_64-linux-gnu/libc.so.6 [0x7f6779cbcff0]
/home/x/Desktop/research/mruby-engine/lib/mruby_engine/mruby_engine.so(mrb_vm_exec+0x1f37) [0x7f6775adcd27] /home/x/Desktop/research/mruby-engine/ext/mruby_engine/mruby/src/vm.c:1296
/home/x/Desktop/research/mruby-engine/lib/mruby_engine/mruby_engine.so(mrb_vm_run+0x5c) [0x7f6775ae184c] /home/x/Desktop/research/mruby-engine/ext/mruby_engine/mruby/src/vm.c:772
/home/x/Desktop/research/mruby-engine/lib/mruby_engine/mruby_engine.so(mruby_engine_monitored_eval+0xbe) [0x7f6775acf41e] ../../../../ext/mruby_engine/eval_monitored.c:68
/lib/x86_64-linux-gnu/libpthread.so.0(start_thread+0xc2) [0x7f6779a70182] pthread_create.c:312
/lib/x86_64-linux-gnu/libc.so.6(clone+0x6d) [0x7f6779d8130d] ../sysdeps/unix/sysv/linux/x86_64/clone.S:111
...
...
...
7f677a6ee000-7f677a6ef000 rw-p 00000000 00:00 0 
7fff151a6000-7fff159a5000 rw-p 00000000 00:00 0                          [stack]
7fff159fe000-7fff15a00000 r-xp 00000000 00:00 0                          [vdso]
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0                  [vsyscall]


[NOTE]
You may have encountered a bug in the Ruby interpreter or extension libraries.
Bug reports are welcome.
For details: http://www.ruby-lang.org/bugreport.html

Aborted (core dumped)

Debug:

(gdb) r sandbox test_mrb_vm_exec_1296.rb 
Starting program: /usr/bin/ruby sandbox test_mrb_vm_exec_1296.rb
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
[New Thread 0x7ffff7ff7700 (LWP 2975)]
[New Thread 0x7ffff1f73700 (LWP 3022)]

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7ffff1f73700 (LWP 3022)]
0x00007ffff33ecd27 in mrb_vm_exec (mrb=mrb@entry=0x7ffff1f744e0, proc=<optimized out>, proc@entry=0x7ffff1f7c130, pc=0x7ffff1fd9a74) at /home/x/Desktop/research/mruby-engine/ext/mruby_engine/mruby/src/vm.c:1296
1296	      c = mrb->c->ci->target_class->super;
(gdb) l
1291	        exc = mrb_exc_new_str_lit(mrb, E_NOMETHOD_ERROR, "super called outside of method");
1292	        mrb_exc_set(mrb, exc);
1293	        goto L_RAISE;
1294	      }
1295	      recv = regs[0];
1296	      c = mrb->c->ci->target_class->super;
1297	      m = mrb_method_search_vm(mrb, &c, mid);
1298	      if (!m) {
1299	        mrb_sym missing = mrb_intern_lit(mrb, "method_missing");
1300	        m = mrb_method_search_vm(mrb, &c, missing);

Backtrace:

(gdb) bt
#0  0x00007ffff33ecd27 in mrb_vm_exec (mrb=mrb@entry=0x7ffff1f744e0, proc=<optimized out>, proc@entry=0x7ffff1f7c130, pc=0x7ffff1fd9a74) at /home/x/Desktop/research/mruby-engine/ext/mruby_engine/mruby/src/vm.c:1296
#1  0x00007ffff33f184c in mrb_vm_run (mrb=0x7ffff1f744e0, proc=0x7ffff1f7c130, self=..., stack_keep=stack_keep@entry=0) at /home/x/Desktop/research/mruby-engine/ext/mruby_engine/mruby/src/vm.c:772
#2  0x00007ffff33df41e in mruby_engine_monitored_eval (data=0x7ffff1f743e0) at ../../../../ext/mruby_engine/eval_monitored.c:68
#3  0x00007ffff7380182 in start_thread (arg=0x7ffff1f73700) at pthread_create.c:312
#4  0x00007ffff769130d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:111

Clang - ASAN - Log:

x@x:~/Desktop/research/clang/mruby/bin$ ASAN_SYMBOLIZER_PATH=/usr/lib/llvm-3.8/bin/llvm-symbolizer ./mirb test_mrb_vm_exec_1299.rb 
mirb - Embeddable Interactive Ruby Shell

ASAN:DEADLYSIGNAL
=================================================================
==2791==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000028 (pc 0x00000050dc52 bp 0x7fff39f50030 sp 0x7fff39f48b00 T0)
    #0 0x50dc51 in mrb_vm_exec /home/x/Desktop/research/clang/mruby/src/vm.c:1296:37
    #1 0x501d5b in mrb_vm_run /home/x/Desktop/research/clang/mruby/src/vm.c:772:10
    #2 0x4f3ef8 in main /home/x/Desktop/research/clang/mruby/mrbgems/mruby-bin-mirb/tools/mirb/mirb.c:549:18
    #3 0x7fd62e3a4ec4 in __libc_start_main /build/buildd/eglibc-2.19/csu/libc-start.c:287
    #4 0x41a595 in _start (/home/x/Desktop/research/clang/mruby/bin/mirb+0x41a595)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /home/x/Desktop/research/clang/mruby/src/vm.c:1296:37 in mrb_vm_exec
==2791==ABORTING