fix use-after-free in obj_free.

* gc.c (obj_free): a table can be accessed for debug counters.
  [Bug #15165] [Fix GH-1964]

  A patch from Joe Truba <jtruba@meraki.com>

  Also check USE_DEBUG_COUNTER macro.


git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@64857 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

1 files changed, 3 insertions, 2 deletions

diff --git a/gc.c b/gc.c
index 9a849dc9e8..4080c22b6c 100644
--- a/gc.c
+++ b/gc.c
@@ -2261,8 +2261,7 @@ obj_free(rb_objspace_t *objspace, VALUE obj)
 	break;
       case T_HASH:
 	if (RANY(obj)->as.hash.ntbl) {
-	    st_free_table(RANY(obj)->as.hash.ntbl);
-
+#if USE_DEBUG_COUNTER
             if (RHASH_SIZE(obj) >= 8) {
                 RB_DEBUG_COUNTER_INC(obj_hash_ge8);
             }
@@ -2272,6 +2271,8 @@ obj_free(rb_objspace_t *objspace, VALUE obj)
             else {
                 RB_DEBUG_COUNTER_INC(obj_hash_under4);
             }
+#endif
+	    st_free_table(RANY(obj)->as.hash.ntbl);
 	}
         else {
             RB_DEBUG_COUNTER_INC(obj_hash_empty);