[Bug #22240] Protect against rb_jump_tag(TAG_RAISE) after errinfo has been cleared

If native code calls rb_protect, then calls rb_funcall before calling
rb_jump_tag, and that ruby code has a rescue clause, it may set
errinfo to nil.

Previously this would cause a SEGV as we weren't checking the type
and assuming errinfo was an object.

The exception that was being raised is gone at that point,
so there is nothing to recover from:
report the broken state with rb_bug instead of unwinding
with an errinfo that isn't an exception object.

Author: rwstauner

ext/-test-/exception/nil_errinfo.c

@@ -0,0 +1,39 @@
+#include <ruby.h>
+
+static VALUE
+raise_boom(VALUE _arg)
+{
+    rb_raise(rb_eRuntimeError, "boom");
+    UNREACHABLE_RETURN(Qnil);
+}
+
+/*
+ * If a native extension catches an exception with rb_protect()
+ * and then uses rb_funcall to run Ruby code that rescues an exception
+ * the errinfo will be set to Qnil before the extension calls rb_jump_tag.
+ * The exception is lost, so the VM reports it with rb_bug().
+ *
+ * Extensions should save the errinfo before the call and restore it afterward.
+ */
+static VALUE
+raise_after_rescue_cleanup(VALUE self)
+{
+    int state = 0;
+
+    rb_protect(raise_boom, Qnil, &state);
+
+    if (state) {
+        /* Any begin/rescue that catches an exception clears ec->errinfo. */
+        rb_funcall(self, rb_intern("cleanup_with_rescue"), 0);
+        /* ec->errinfo is now Qnil, but state is still TAG_RAISE. */
+        rb_jump_tag(state);
+    }
+    return Qnil;
+}
+
+void
+Init_nil_errinfo(VALUE klass)
+{
+    rb_define_singleton_method(klass, "raise_after_rescue_cleanup",
+                               raise_after_rescue_cleanup, 0);
+}

test/-ext-/exception/test_nil_errinfo.rb

@@ -0,0 +1,49 @@
+# frozen_string_literal: false
+require 'test/unit'
+require 'tmpdir'
+require '-test-/exception'
+
+module Bug
+  class Test_ExceptionNilErrinfo < Test::Unit::TestCase
+    # A native extension that runs Ruby code containing a rescue clause
+    # between rb_protect() and rb_jump_tag() clears ec->errinfo,
+    # losing the exception that was being raised.
+    # There is nothing left to raise, so report it instead of unwinding.
+    def test_rescue_cleanup_is_a_bug
+      no_core = "Process.setrlimit(Process::RLIMIT_CORE, 0); " if defined?(Process.setrlimit) && defined?(Process::RLIMIT_CORE)
+      src = <<~'RUBY'
+        def (Bug::Exception).cleanup_with_rescue
+          begin
+            raise "cleanup error"
+          rescue
+            # entering this rescue sets ec->errinfo to Qnil
+          end
+        end
+
+        Bug::Exception.raise_after_rescue_cleanup
+      RUBY
+      expected_stderr = [
+        :*,
+        /\[BUG\]\sexception object was lost during stack unwinding/,
+        :*,
+      ]
+      Dir.mktmpdir do |tmpdir|
+        args = [{"RUBY_ON_BUG" => nil, "RUBY_CRASH_REPORT" => nil}, "-r-test-/exception", "-C", tmpdir]
+        # Writing the report is slow, see TestRubyOptions#assert_segv.
+        assert_in_out_err(args, "#{no_core}#{src}", [], expected_stderr, encoding: "ASCII-8BIT", timeout: 60)
+      end
+    end
+
+    # Without a rescue clause errinfo is not cleared,
+    # so the exception raised by the cleanup code propagates as usual.
+    def test_rescue_cleanup_raises_latest_error
+      assert_in_out_err(["-r-test-/exception"], <<~'RUBY', [], /cleanup error \(RuntimeError\)/)
+        def (Bug::Exception).cleanup_with_rescue
+          raise "cleanup error"
+        end
+
+        Bug::Exception.raise_after_rescue_cleanup
+      RUBY
+    end
+  end
+end

vm.c

@@ -3025,6 +3025,18 @@ vm_exec_handle_exception(rb_execution_context_t *ec, enum ruby_tag_type state, V
 {
     struct vm_throw_data *err = (struct vm_throw_data *)errinfo;
 
+    /* If a native extension runs Ruby code between rb_protect() and
+     * rb_jump_tag() and that code rescues an exception, ec->errinfo is
+     * cleared while the tag state is still TAG_RAISE.  The exception that
+     * was being raised is lost and unwinding would dereference a non object,
+     * so there is nothing to recover from.  Extensions must save errinfo
+     * before such a call and restore it before rb_jump_tag(). */
+    if (state == TAG_RAISE && RB_SPECIAL_CONST_P(errinfo)) {
+        rb_bug("exception object was lost during stack unwinding; "
+               "a native extension may have run Ruby code containing a rescue clause "
+               "between rb_protect() and rb_jump_tag()");
+    }
+
     for (;;) {
         unsigned int i;
         const struct iseq_catch_table_entry *entry;