When built with conf.enable_debug and conf.defines << %w(MRB_GC_STRESS MRB_HEAP_PAGE_SIZE=169), the test in mruby-enumerator reports “Use-after-free”.
I went back through the commit log and found that the problem started with commit 5bd63d6 . However, I didn't see any problem with the code written.
I don't know where the tail of the cause is, but I will try to find out more.
% cat test_config.rb MRuby::Build.new do toolchain enable_test enable_debug defines << %w(MRB_HEAP_PAGE_SIZE=169) defines << %w(MRB_GC_STRESS) enable_sanitizer "address,undefined" gem core: "mruby-enumerator" # gembox "full-core" end % rake -mv MRUBY_CONFIG=test_config.rb test ...SNIP... Enumerator.class : . Enumerator.superclass : . Enumerator.new : . Enumerator#initialize_copy : . ================================================================= ==72465==ERROR: AddressSanitizer: heap-use-after-free on address 0x525000033ff0 at pc 0x00000042fcc5 bp 0x7ffffffdce90 sp 0x7ffffffdce88 READ of size 4 at 0x525000033ff0 thread T0 #0 0x42fcc4 in obj_free /var/tmp/mruby/src/gc.c:782:23 #1 0x434de2 in incremental_sweep_phase /var/tmp/mruby/src/gc.c:1036:11 #2 0x43174f in incremental_gc /var/tmp/mruby/src/gc.c:1112:20 #3 0x42b41b in incremental_gc_finish /var/tmp/mruby/src/gc.c:1128:5 #4 0x4242ea in mrb_full_gc /var/tmp/mruby/src/gc.c:1224:3 #5 0x42529e in mrb_obj_alloc /var/tmp/mruby/src/gc.c:489:3 #6 0x4f1ce9 in str_new /var/tmp/mruby/src/string.c:147:27 #7 0x4f1bdc in mrb_str_new /var/tmp/mruby/src/string.c:187:24 #8 0x5e07bc in mrb_vm_exec /var/tmp/mruby/src/vm.c:2839:19 #9 0x567655 in mrb_vm_run /var/tmp/mruby/src/vm.c:1365:12 #10 0x55e438 in mrb_top_run /var/tmp/mruby/src/vm.c:3135:10 #11 0x456a7c in load_irep /var/tmp/mruby/src/load.c:682:10 #12 0x4566fd in mrb_load_irep_cxt /var/tmp/mruby/src/load.c:690:10 #13 0x456b18 in mrb_load_irep /var/tmp/mruby/src/load.c:702:10 #14 0x3b23b9 in GENERATED_TMP_mrb_mruby_enumerator_gem_test /var/tmp/mruby/build/host/mrbgems/mruby-enumerator/gem_test.c:1448:3 #15 0x3af9b5 in mrbgemtest_init /var/tmp/mruby/build/host/mrbgems/mruby-test/mrbtest.c:19:5 #16 0x3ab09f in main /var/tmp/mruby/mrbgems/mruby-test/driver.c:299:3 #17 0x8007f3a69 in __libc_start1 (/lib/libc.so.7+0x85a69) #18 0x2faa7f in _start /usr/src/lib/csu/amd64/crt1_s.S:83 0x525000033ff0 is located 7920 bytes inside of 8144-byte region [0x525000032100,0x5250000340d0) freed by thread T0 here: #0 0x374476 in free /usr/src/contrib/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:52:3 previously allocated by thread T0 here: #0 0x374817 in realloc /usr/src/contrib/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:82:3 SUMMARY: AddressSanitizer: heap-use-after-free /var/tmp/mruby/src/gc.c:782:23 in obj_free Shadow bytes around the buggy address: 0x525000033d00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x525000033d80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x525000033e00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x525000033e80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x525000033f00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd =>0x525000033f80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd[fd]fd 0x525000034000: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x525000034080: fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa 0x525000034100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x525000034180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x525000034200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==72465==ABORTING ...SNIP...