HexBrain

shopify-scripts · Report #215854

Garbage collector crash

Validstatus
lowseverity
$300bounty
2upvotes
15 Apr 2017disclosed

How it was found

This github [issue](https://github.com/mruby/mruby/issues/3063] seems to have been reintroduced.

f = Fiber.new do
    m = Fiber.current
    Fiber.yield Proc.new {}
end

f = f.resume
GC.start

It causes mruby to abort due to a failed assertion.

$ mruby poc
mruby: /home/user/repos/mruby/src/gc.c:698: mrb_gc_mark: Assertion `(obj)->tt != MRB_TT_FREE' failed.
Aborted

The issue was reintroduced in ecee8c51b0ad8cddd9e422a3e5105f902d7e2781 and is still present in 051e40c0493f2de332f5439e3230c9fe6958bf1a.

The issue is fixed by reverting ecee8c51b0ad8cddd9e422a3e5105f902d7e2781.

Thank you, Dinko Galetic Denis Kasak

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original