ZJIT: Move of ISEQ doesn't hook rb_zjit_iseq_update_references

[k0kubun]

This is an issue to keep track of the random failure discovered in ruby#14102 (comment).

[shopify-github-archiver]

Summary

• Alan identified a misunderstanding in the behavior of rb_zjit_iseq_update_references(), clarifying that it's for updating an iseq's outgoing edges, not for handling when the iseq itself is moved by the garbage collector.
• Takashi confirmed this understanding, realizing that an iseq and its contents can move independently.
• Alan suggested that a new function, invariants_update_references(), is needed to handle this case.
• This new function should use rb_gc_location() to check if each iseq has been moved and needs its references updated.

Links

No extractable links or request IDs were found in the provided content.

This summary was generated using OpenAI's google:gemini-2.5-pro with a temperature of 0.5.

🧵 Slack Thread

User		Message
👤	<@> 2025‑08‑07 00:57	*Takashi Kokubun* posted an update for *MRI standup*
	Alan Wu 2025‑08‑07 02:46	Ahh we got tricked by what rb_zjit_iseq_update_references() does. You get the call back to update outgoing edges of the iseq, not when the iseq itself moves. No wonder it's not called. So what you're missing is actually an invariants_update_references() that queries whether each iseq in the table moved with rb_gc_location()
	Takashi Kokubun 2025‑08‑07 16:36	yeah, I was worried about it too. I assumed the move of ISEQ always issues the move of its contents, but I guess it doesn't hold since they are stored separately and don't need to move at the same time.
	Takashi Kokubun 2025‑08‑07 16:38	ok

---

Takashi Kokubun archived this conversation from ruby-and-rails-infra-standups at 2025‑08‑07 16:39.
All times are in UTC.

[k0kubun]

memo: example backtrace when it moves:

Thread 1 hit Hardware watchpoint 3: ((*((VALUE *)0x7ac5a40d3bc0) >> 12) & 15)==7

Old value = 1
New value = 0
__memset_avx2_unaligned_erms () at ../sysdeps/x86_64/multiarch/memset-vec-unaligned-erms.S:171
warning: 171    ../sysdeps/x86_64/multiarch/memset-vec-unaligned-erms.S: No such file or directory
(rr) bt
#0  __memset_avx2_unaligned_erms () at ../sysdeps/x86_64/multiarch/memset-vec-unaligned-erms.S:171
#1  0x000058ddb6d817db in gc_move (objspace=0x58ddca692ca0, src=134989279476672, dest=134989282586400, src_slot_size=48, slot_size=48) at ../gc/default/default.c:6899
#2  0x000058ddb6d787d9 in try_move (objspace=0x58ddca692ca0, heap=0x58ddca692cc0, free_page=0x58ddcc8da640, src=134989279476672) at ../gc/default/default.c:3205
#3  0x000058ddb6d7da06 in gc_compact_move (objspace=0x58ddca692ca0, heap=0x58ddca692cc0, src=134989279476672) at ../gc/default/default.c:5478
#4  0x000058ddb6d7dbc1 in gc_compact_plane (objspace=0x58ddca692ca0, heap=0x58ddca692cc0, p=134989279476672, bitset=3, page=0x58ddccd0ed80) at ../gc/default/default.c:5529
#5  0x000058ddb6d7dd84 in gc_compact_page (objspace=0x58ddca692ca0, heap=0x58ddca692cc0, page=0x58ddccd0ed80) at ../gc/default/default.c:5567
#6  0x000058ddb6d7dea9 in gc_sweep_compact (objspace=0x58ddca692ca0) at ../gc/default/default.c:5609
#7  0x000058ddb6d7a6f1 in gc_sweep (objspace=0x58ddca692ca0) at ../gc/default/default.c:4073
#8  0x000058ddb6d80472 in gc_start (objspace=0x58ddca692ca0, reason=8456) at ../gc/default/default.c:6429
#9  0x000058ddb6d7ffd7 in garbage_collect (objspace=0x58ddca692ca0, reason=256) at ../gc/default/default.c:6310
#10 0x000058ddb6d766f0 in newobj_slowpath (heap_idx=1, wb_protected=1, cache=0x58ddca697aa0, objspace=0x58ddca692ca0, flags=53274, klass=134989308634896) at ../gc/default/default.c:2432
#11 newobj_slowpath_wb_protected (klass=134989308634896, flags=53274, objspace=0x58ddca692ca0, cache=0x58ddca697aa0, heap_idx=1) at ../gc/default/default.c:2454
#12 0x000058ddb6d769e3 in rb_gc_impl_new_obj (objspace_ptr=0x58ddca692ca0, cache_ptr=0x58ddca697aa0, klass=134989308634896, flags=53274, v1=0, v2=0, v3=0, wb_protected=true, alloc_size=88) at ../gc/default/default.c:2491
#13 0x000058ddb6d87c88 in newobj_of (cr=0x58ddca6978d0, klass=134989308634896, flags=53274, v1=0, v2=0, v3=0, wb_protected=true, size=88) at ../gc.c:991
#14 0x000058ddb6d87e77 in rb_wb_protected_newobj_of (ec=0x58ddca697b80, klass=134989308634896, flags=53274, size=88) at ../gc.c:1029
#15 0x000058ddb6da03d6 in rb_imemo_new (type=imemo_fields, v0=134989308634896, size=88) at ../imemo.c:45
#16 0x000058ddb6da062f in imemo_fields_new (klass=134989308634896, capa=9) at ../imemo.c:116
#17 0x000058ddb6da06f4 in rb_imemo_fields_new (klass=134989308634896, capa=9) at ../imemo.c:131
#18 0x000058ddb6f3be89 in imemo_fields_copy_capa (klass=134989308634896, source_fields_obj=134989307051952, new_size=9) at ../variable.c:1691
#19 0x000058ddb6f3c881 in imemo_fields_set (klass=134989308634896, fields_obj=134989307051952, target_shape_id=1146, field_name=260403, val=3, concurrent=false) at ../variable.c:1885
#20 0x000058ddb6f3c9b0 in generic_field_set (obj=134989305638688, target_shape_id=1146, field_name=260403, val=3) at ../variable.c:1908
#21 0x000058ddb6f3cb73 in generic_ivar_set (obj=134989305638688, id=260403, val=3) at ../variable.c:1946
#22 0x000058ddb6f3d172 in ivar_set (obj=134989305638688, id=260403, val=3) at ../variable.c:2101
#23 0x000058ddb6f3d1b1 in rb_ivar_set (obj=134989305638688, id=260403, val=3) at ../variable.c:2110
#24 0x000058ddb6e16ee0 in rb_obj_ivar_set_m (obj=134989305638688, iv=66663180, val=3) at ../object.c:2986
#25 0x000058ddb6f5e882 in ractor_safe_call_cfunc_2 (recv=134989305638688, argc=2, argv=0x7ac5c12f53d8, func=0x58ddb6e16e68 <rb_obj_ivar_set_m>) at ../vm_insnhelper.c:3681
#26 0x000058ddb6f5f44c in vm_call_cfunc_with_frame_ (ec=0x58ddca697b80, reg_cfp=0x7ac5c13f4be8, calling=0x7ffe8c7f37c0, argc=2, argv=0x7ac5c12f53d8, stack_bottom=0x7ac5c12f53d0) at ../vm_insnhelper.c:3851
#27 0x000058ddb6f5f766 in vm_call_cfunc_with_frame (ec=0x58ddca697b80, reg_cfp=0x7ac5c13f4be8, calling=0x7ffe8c7f37c0) at ../vm_insnhelper.c:3897
#28 0x000058ddb6f66923 in vm_sendish (ec=0x58ddca697b80, reg_cfp=0x7ac5c13f4be8, cd=0x58ddcc2f7460, block_handler=0, method_explorer=mexp_search_method) at ../vm_insnhelper.c:6058
#29 0x000058ddb6f66bbb in rb_vm_opt_send_without_block (ec=0x58ddca697b80, reg_cfp=0x7ac5c13f4be8, cd=0x58ddcc2f7460) at ../vm_insnhelper.c:6105
#30 0x000058ddb299a5b5 in ?? ()
#31 0x00007ac5a59c6f20 in ?? ()
#32 0x00007ac5a59c6f20 in ?? ()
#33 0x00007ffe8c7f38a0 in ?? ()
#34 0x000058ddb299a5e8 in ?? ()
#35 0x0000000000000000 in ?? ()

[k0kubun]

We'd need to maintain Invariants::ep_escape_iseqs, so we definitely need to figure out a way to detect ISEQ moves, even while ruby#14102 decided to use IseqPayload.

[XrXr]

We can use the same strategy as YJIT of updating the whole table during reference update:

ruby/yjit/src/invariants.rs

Lines 378 to 392 in fccd96c

	pub extern "C" fn rb_yjit_root_update_references() {
	if unsafe { INVARIANTS.is_none() } {
	return;
	}
	let no_ep_escape_iseqs = &mut Invariants::get_instance().no_ep_escape_iseqs;
	// Make a copy of the table with updated ISEQ keys
	let mut updated_copy = HashMap::with_capacity(no_ep_escape_iseqs.len());
	for (iseq, blocks) in mem::take(no_ep_escape_iseqs) {
	let new_iseq = unsafe { rb_gc_location(iseq.into()) }.as_iseq();
	updated_copy.insert(new_iseq, blocks);
	}
	*no_ep_escape_iseqs = updated_copy;
	}

I think what iseq_update_references() actually gets called after the iseq is already moved, and so rb_gc_location() on it returns the same address. The invarants table will have the old address though.

Funny reading message from past self 😅 73eeb86

[k0kubun]

It feels so sad that I did the same mistake last year and already forgot it one year later 🥲 Thanks for linking to the YJIT fix.