psych 4.x breaks libv8 .location.yml deserialisation during extension building

[lloeki]

mini_racer deserialises some innocuous Ruby class serialised as YAML in the libv8-node gem, but psych 4.0 changed some behaviours around YAML.load to be more like safe_load.

• Use Psych.safe_load by default ruby/psych#487
• Introduce Psych.unsafe_load ruby/psych#488

A temporary workaround should be to revert to psych < 4.0.

I should be able to push a fix as soon as I get a window of opportunity to repro.

/Users/username/.asdf/installs/ruby/2.6.3/lib/ruby/gems/2.6.0/gems/psych-4.0.0/lib/psych/class_loader.rb:99:in `find': Tried to load unspecified class: Libv8::Node::Location::Vendor (Psych::DisallowedClass)
	from /Users/username/.asdf/installs/ruby/2.6.3/lib/ruby/gems/2.6.0/gems/psych-4.0.0/lib/psych/class_loader.rb:28:in `load'
	from /Users/username/.asdf/installs/ruby/2.6.3/lib/ruby/gems/2.6.0/gems/psych-4.0.0/lib/psych/visitors/to_ruby.rb:424:in `resolve_class'
	from /Users/username/.asdf/installs/ruby/2.6.3/lib/ruby/gems/2.6.0/gems/psych-4.0.0/lib/psych/visitors/to_ruby.rb:213:in `visit_Psych_Nodes_Mapping'
	from /Users/username/.asdf/installs/ruby/2.6.3/lib/ruby/gems/2.6.0/gems/psych-4.0.0/lib/psych/visitors/visitor.rb:30:in `visit'
	from /Users/username/.asdf/installs/ruby/2.6.3/lib/ruby/gems/2.6.0/gems/psych-4.0.0/lib/psych/visitors/visitor.rb:6:in `accept'
	from /Users/username/.asdf/installs/ruby/2.6.3/lib/ruby/gems/2.6.0/gems/psych-4.0.0/lib/psych/visitors/to_ruby.rb:35:in `accept'
	from /Users/username/.asdf/installs/ruby/2.6.3/lib/ruby/gems/2.6.0/gems/psych-4.0.0/lib/psych/visitors/to_ruby.rb:318:in `visit_Psych_Nodes_Document'
	from /Users/username/.asdf/installs/ruby/2.6.3/lib/ruby/gems/2.6.0/gems/psych-4.0.0/lib/psych/visitors/visitor.rb:30:in `visit'
	from /Users/username/.asdf/installs/ruby/2.6.3/lib/ruby/gems/2.6.0/gems/psych-4.0.0/lib/psych/visitors/visitor.rb:6:in `accept'
	from /Users/username/.asdf/installs/ruby/2.6.3/lib/ruby/gems/2.6.0/gems/psych-4.0.0/lib/psych/visitors/to_ruby.rb:35:in `accept'
	from /Users/username/.asdf/installs/ruby/2.6.3/lib/ruby/gems/2.6.0/gems/psych-4.0.0/lib/psych.rb:334:in `safe_load'
	from /Users/username/.asdf/installs/ruby/2.6.3/lib/ruby/gems/2.6.0/gems/psych-4.0.0/lib/psych.rb:369:in `load'
	from /Users/username/.asdf/installs/ruby/2.6.3/lib/ruby/gems/2.6.0/gems/sq_mini_racer-0.3.1.0.4/ext/mini_racer_extension/vendor/gems/libv8-node-15.5.1.0.beta1-x86_64-darwin-20/ext/libv8-node/location.rb:18:in `block in load!'
	from /Users/username/.asdf/installs/ruby/2.6.3/lib/ruby/gems/2.6.0/gems/sq_mini_racer-0.3.1.0.4/ext/mini_racer_extension/vendor/gems/libv8-node-15.5.1.0.beta1-x86_64-darwin-20/ext/libv8-node/location.rb:17:in `open'
	from /Users/username/.asdf/installs/ruby/2.6.3/lib/ruby/gems/2.6.0/gems/sq_mini_racer-0.3.1.0.4/ext/mini_racer_extension/vendor/gems/libv8-node-15.5.1.0.beta1-x86_64-darwin-20/ext/libv8-node/location.rb:17:in `load!'
	from /Users/username/.asdf/installs/ruby/2.6.3/lib/ruby/gems/2.6.0/gems/sq_mini_racer-0.3.1.0.4/ext/mini_racer_extension/vendor/gems/libv8-node-15.5.1.0.beta1-x86_64-darwin-20/lib/libv8/node.rb:8:in `configure_makefile'
	from extconf.rb:259:in `<main>'

[lloeki]

So, the person is using psych 3.3.1, therefore it's not psych 4.x at cause.

[lloeki]

Mishap: it's indeed actually psych 4.0 (and 4.0.1)... I forgot that during extension building the bundle is not active yet, so ext.rb sees whatever is the latest psych gem 🤦.

There should be an easy way to fix that, but if we can find a way to drop this .location.yml hack it would be for the better.

[lloeki]

Fixed via rubyjs/libv8-node@6bbb084, this will land in libv8-node 15.14.0.2.

[SamSaffron]

awesome @lloeki ! are you pushing a new release out there?

[lloeki]

Soon @SamSaffron, I'm looking into some other possible quick fixes to stuff in there.

... and I have mini_racer + node 16 (v8 9.0) running great over here :)

[SamSaffron]

wow awesome! looking forward to v8 9.0!

…

On Mon, Jun 21, 2021 at 5:50 PM Loic Nageleisen ***@***.***> wrote: Soon @SamSaffron <https://github.com/SamSaffron>, I'm looking into some other possible quick fixes to stuff in there. ... and I have mini_racer + node 16 (v8 9.0) running great over here :) — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#208 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAABIXJHZKOO76IOZWZALRLTT3VNXANCNFSM46J33YEQ> .

[SamSaffron]

@lloeki any news on v8 9.0?

[lloeki]

I've been quite busy following the Sqreen x Datadog acquisition, big roadmap for a couple of weeks still. If I can squeeze a 9.0 release somewhere I'll do it and ping back here.

[h0jeZvgoxFepBQ2C]

Can someone tell me how to fix this? We are using ruby 2.6.6 and get this error. Installing node 16 via nvm doesn't solve the error, it stays the same?

Also using this repository with the master branch doesn't work.. :(

[lloeki]

It doesn't and can't use a system node, as it needs some transient objects from Node builds.

I'm seeing the finish line on a very important project, I think I'll be able to tackle this very soon (EOW~next week).

[h0jeZvgoxFepBQ2C]

Ok, thank you very much!

[tisba]

@lloeki this issue is resolved via 16.10.0.0, correct?

[lloeki]

correct

[tisba]

Closing this as this has been resolved with libv8-node >= 16.10.0.0 (I hope I did not misunderstood you @lloeki and there is something to do about this 🙈).

[lloeki]

all good!