tenderlove/nokogiri — Issue #616: Segv on 1.9.3
Author: tenderlove
Created: 2012-02-14 18:50:16+00:00
State: open

This script will eventually segv, but only on 1.9.3. Version of libxml2 doesn't seem to matter:

```ruby
require "nokogiri"
buf = File.read 'test/files/dont_hurt_em_why.xml'

def inspect node
node.children.map { |c| inspect(c) }
end

loop do
inspect Nokogiri::XML(buf)
end
```

The system I'm on:

```
[apatterson@railsci nokogiri]$ uname -orv
2.6.18-194.3.1.el5xen #1 SMP Thu May 13 13:49:53 EDT 2010 GNU/Linux
[apatterson@railsci nokogiri]$ cat /etc/redhat-release
CentOS release 5.5 (Final)
[apatterson@railsci nokogiri]$ ruby -I lib bin/nokogiri -v
# Nokogiri (1.5.0)
---
warnings: []

nokogiri: 1.5.0
ruby:
version: 1.9.3
platform: x86_64-linux
description: ruby 1.9.3p0 (2011-10-30) [x86_64-linux]
engine: ruby
libxml:
binding: extension
compiled: 2.7.8
loaded: 2.7.8
[apatterson@railsci nokogiri]$
```

My gdb stack trace:

```

#0 0x00002aaaae59e884 in mark (node=0x11f6a10) at ../../../../ext/nokogiri/xml_node.c:17
#1 0x000000000041e1ce in gc_mark_children (objspace=0x84e8a0, ptr=8737120, lev=1) at gc.c:1853
#2 0x000000000041dc16 in gc_mark (objspace=0x84e8a0, ptr=8737120, lev=0) at gc.c:1642
#3 0x000000000041d461 in mark_locations_array (objspace=0x84e8a0, x=0x7ffffffefbf0, n=6941) at gc.c:1415
#4 0x000000000041d5e2 in gc_mark_locations (objspace=0x84e8a0, start=0x7ffffffed380, end=0x7fffffffd4e0) at gc.c:1428
#5 0x000000000041fb29 in mark_current_machine_context (objspace=0x84e8a0, th=0x84e520) at gc.c:2414
#6 0x000000000041fcad in gc_marks (objspace=0x84e8a0) at gc.c:2466
#7 0x000000000041f36d in gc_lazy_sweep (objspace=0x84e8a0) at gc.c:2187
#8 0x000000000041cea3 in rb_newobj () at gc.c:1176
#9 0x0000000000540080 in ary_alloc (klass=9086320) at array.c:301
#10 0x00000000005401b8 in ary_new (klass=9086320, capa=3) at array.c:320
#11 0x0000000000540254 in rb_ary_new2 (capa=3) at array.c:334
#12 0x0000000000540264 in rb_ary_new () at array.c:341
#13 0x00000000005690db in enum_collect (obj=19863000) at enum.c:413
#14 0x0000000000523a1f in call_cfunc (func=0x569098 , recv=19863000, len=0, argc=0, argv=0x2aaaae08d468) at vm_insnhelper.c:320
#15 0x00000000005238da in vm_call_cfunc (th=0x84e520, reg_cfp=0x2aaaae18bfe8, num=0, recv=19863000, blockptr=0x2aaaae18c010, me=0x8c91a0)
at vm_insnhelper.c:404
#16 0x0000000000522c91 in vm_call_method (th=0x84e520, cfp=0x2aaaae18bfe8, num=0, blockptr=0x2aaaae18c010, flag=0, id=1568, me=0x8c91a0, recv=19863000)
at vm_insnhelper.c:534
#17 0x000000000051da4c in vm_exec_core (th=0x84e520, initial=0) at insns.def:1015
#18 0x000000000052ccb1 in vm_exec (th=0x84e520) at vm.c:1220
#19 0x000000000052b907 in invoke_block_from_c (th=0x84e520, block=0x134d370, self=9123520, argc=1, argv=0x2aaaae08d400, blockptr=0x0, cref=0x0) at vm.c:624
#20 0x000000000052b98e in vm_yield (th=0x84e520, argc=1, argv=0x2aaaae08d400) at vm.c:654
#21 0x0000000000528235 in rb_yield_0 (argc=1, argv=0x2aaaae08d400) at vm_eval.c:740
#22 0x0000000000528455 in rb_yield_values2 (argc=1, argv=0x2aaaae08d400) at vm_eval.c:779
#23 0x000000000056904a in collect_i (i=19863040, ary=19867160, argc=1, argv=0x2aaaae08d400) at enum.c:375
#24 0x0000000000519c58 in vm_yield_with_cfunc (th=0x84e520, block=0x134d440, self=19867280, argc=1, argv=0x2aaaae08d400, blockargptr=0x0)
at vm_insnhelper.c:738
#25 0x0000000000518d59 in vm_invoke_block (th=0x84e520, reg_cfp=0x2aaaae18c148, num=1, flag=0) at vm_insnhelper.c:957
#26 0x000000000051ddd9 in vm_exec_core (th=0x84e520, initial=0) at insns.def:1066
#27 0x000000000052ccb1 in vm_exec (th=0x84e520) at vm.c:1220
#28 0x000000000052b907 in invoke_block_from_c (th=0x84e520, block=0x2aaaae18c278, self=19867280, argc=1, argv=0x7ffffffef778, blockptr=0x0, cref=0x0)
at vm.c:624
#29 0x000000000052b98e in vm_yield (th=0x84e520, argc=1, argv=0x7ffffffef778) at vm.c:654
#30 0x0000000000528235 in rb_yield_0 (argc=1, argv=0x7ffffffef778) at vm_eval.c:740
#31 0x0000000000528209 in rb_yield (val=7) at vm_eval.c:750
#32 0x0000000000449ffc in int_upto (from=1, to=37) at numeric.c:3204
#33 0x0000000000523a3e in call_cfunc (func=0x449f77 , recv=1, len=1, argc=1, argv=0x2aaaae08d3c0) at vm_insnhelper.c:323
#34 0x00000000005238da in vm_call_cfunc (th=0x84e520, reg_cfp=0x2aaaae18c250, num=1, recv=1, blockptr=0x2aaaae18c278, me=0x8e26e0) at vm_insnhelper.c:404
#35 0x0000000000522c91 in vm_call_method (th=0x84e520, cfp=0x2aaaae18c250, num=1, blockptr=0x2aaaae18c278, flag=0, id=1904, me=0x8e26e0, recv=1)
at vm_insnhelper.c:534
#36 0x000000000051da4c in vm_exec_core (th=0x84e520, initial=0) at insns.def:1015
#37 0x000000000052ccb1 in vm_exec (th=0x84e520) at vm.c:1220
#38 0x0000000000526af0 in vm_call0 (th=0x84e520, recv=19867280, id=424, argc=0, argv=0x0, me=0xb673d0) at vm_eval.c:66
#39 0x0000000000527dc0 in rb_call0 (recv=19867280, mid=424, argc=0, argv=0x0, scope=CALL_FCALL, self=6) at vm_eval.c:235
#40 0x0000000000527d16 in rb_call (recv=19867280, mid=424, argc=0, argv=0x0, scope=CALL_FCALL) at vm_eval.c:438
```