June 2023 - ruby-core - ml.ruby-lang.org

[ruby-core:113026] [Ruby master Bug#19550] Memory leak in iclass for 32 bit systems
by peterzhu2118 (Peter Zhu) 17 Jul '23

17 Jul '23

Issue #19550 has been reported by peterzhu2118 (Peter Zhu). ---------------------------------------- Bug #19550: Memory leak in iclass for 32 bit systems https://bugs.ruby-lang.org/issues/19550 * Author: peterzhu2118 (Peter Zhu) * Status: Open * Priority: Normal * Backport: 2.7: DONTNEED, 3.0: DONTNEED, 3.1: DONTNEED, 3.2: REQUIRED ---------------------------------------- If !RCLASS_EXT_EMBEDDED (e.g. 32 bit systems) then the rb_classext_t is allocated throug malloc so it must be freed. The issue can be seen in the following script: ```ruby 20.times do 100_000.times do mod = Module.new Class.new do include mod end end # Output the Resident Set Size (memory usage, in KB) of the current Ruby process puts `ps -o rss= -p #{$$}` end ``` Before this fix, the max RSS is 280MB, while after this change, it's 30MB. -- https://bugs.ruby-lang.org/

2 2

[ruby-core:113005] [Ruby master Bug#19546] IO::Buffer is incorrectly invoking fiber scheduler interface.
by ioquatix (Samuel Williams) 16 Jul '23

16 Jul '23

Issue #19546 has been reported by ioquatix (Samuel Williams). ---------------------------------------- Bug #19546: IO::Buffer is incorrectly invoking fiber scheduler interface. https://bugs.ruby-lang.org/issues/19546 * Author: ioquatix (Samuel Williams) * Status: Open * Priority: Normal * Assignee: ioquatix (Samuel Williams) * Backport: 2.7: UNKNOWN, 3.0: UNKNOWN, 3.1: UNKNOWN, 3.2: UNKNOWN ---------------------------------------- The `IO::Buffer` implementation incorrectly calls rb_fiber_scheduler_io_write with the size_ts converted to VALUEs: https://github.com/ruby/ruby/blob/400ccb16eefe4e21c4e3eacab4fd0f208fc5e151/… But that function expects size_ts: https://github.com/ruby/ruby/blob/400ccb16eefe4e21c4e3eacab4fd0f208fc5e151/… (And probably the same for the other scheduler methods.) Fixed by <https://github.com/ruby/ruby/pull/7593>. -- https://bugs.ruby-lang.org/

2 2

[ruby-core:112721] [Ruby master Bug#19482] Fix crash when allocating classes with newobj hook
by peterzhu2118 (Peter Zhu) 16 Jul '23

16 Jul '23

Issue #19482 has been reported by peterzhu2118 (Peter Zhu). ---------------------------------------- Bug #19482: Fix crash when allocating classes with newobj hook https://bugs.ruby-lang.org/issues/19482 * Author: peterzhu2118 (Peter Zhu) * Status: Open * Priority: Normal * Backport: 2.7: DONTNEED, 3.0: DONTNEED, 3.1: DONTNEED, 3.2: REQUIRED ---------------------------------------- GitHub PR: https://github.com/ruby/ruby/pull/7464 We need to zero out the whole slot when running the newobj hook for a newly allocated class because the slot could be filled with garbage, which would cause a crash if a GC runs inside of the newobj hook. For example, the following script crashes: ```ruby require "objspace" GC.stress = true ObjectSpace.trace_object_allocations { 100.times do Class.new end } ``` -- https://bugs.ruby-lang.org/

2 1

[ruby-core:112723] [Ruby master Bug#19483] rubyzip not behaving well with YJIT
by k0kubun (Takashi Kokubun) 16 Jul '23

16 Jul '23

Issue #19483 has been reported by k0kubun (Takashi Kokubun). ---------------------------------------- Bug #19483: rubyzip not behaving well with YJIT https://bugs.ruby-lang.org/issues/19483 * Author: k0kubun (Takashi Kokubun) * Status: Open * Priority: Normal * Assignee: yjit * Backport: 2.7: DONTNEED, 3.0: DONTNEED, 3.1: DONTNEED, 3.2: REQUIRED ---------------------------------------- Copied from https://github.com/Shopify/yjit/issues/310 for backports. -- https://bugs.ruby-lang.org/

2 1

[ruby-core:112578] [Ruby master Bug#19463] YJIT `[BUG] Stack consistency error` under certain invalidation scenarios
by alanwu (Alan Wu) 16 Jul '23

16 Jul '23

Issue #19463 has been reported by alanwu (Alan Wu). ---------------------------------------- Bug #19463: YJIT `[BUG] Stack consistency error` under certain invalidation scenarios https://bugs.ruby-lang.org/issues/19463 * Author: alanwu (Alan Wu) * Status: Open * Priority: Normal * ruby -v: ruby 3.2.1 (2023-02-08 revision 31819e82c8) +YJIT [arm64-darwin22] * Backport: 2.7: DONTNEED, 3.0: DONTNEED, 3.1: DONTNEED, 3.2: REQUIRED ---------------------------------------- > test.rb:19: [BUG] Stack consistency error (sp: 15, bp: 16) With the following: ```ruby klass = Class.new do def self.lookup(hash, key) = hash[key] def self.foo(a, b) = [] def self.test(hash, key) [lookup(hash, key), key, "".freeze] # 05 opt_send_without_block :lookup # 07 getlocal_WC_0 :hash # 09 opt_str_freeze "" # 12 newarray 3 # 14 leave # # YJIT will put instructions (07..14) into a block. # When String#freeze is redefined from within lookup(), # the return address to the block is still on-stack. We rely # on invalidation patching the code at the return address # to service this situation correctly. end end # get YJIT to compile test() hash = { 1 => [] } 31.times { klass.test(hash, 1) } # inject invalidation into lookup() evil_hash = Hash.new do |_, key| class String undef :freeze def freeze = :ugokanai end key end p klass.test(evil_hash, 1) ``` The fix is fairly simple and I'll apply it shortly. -- https://bugs.ruby-lang.org/

2 1

[ruby-core:113779] [Ruby master Feature#19714] Add Refinement#refined_module
by shugo (Shugo Maeda) 15 Jul '23

15 Jul '23

Issue #19714 has been reported by shugo (Shugo Maeda). ---------------------------------------- Feature #19714: Add Refinement#refined_module https://bugs.ruby-lang.org/issues/19714 * Author: shugo (Shugo Maeda) * Status: Assigned * Priority: Normal * Assignee: matz (Yukihiro Matsumoto) * Target version: 3.3 ---------------------------------------- Eregon (Benoit Daloze) wrote in https://bugs.ruby-lang.org/issues/12737#note-15: > `Refinement#refined_class` is a bit strange given it can return a module. > How about adding `Refinement#refined_module` as an alias for clarity? I'm for it. What do you think, Matz? -- https://bugs.ruby-lang.org/

4 6

[ruby-core:113888] [Ruby master Bug#19726] Script loadde twice when requiring self
by johannes (Johannes Krude) 14 Jul '23

14 Jul '23

Issue #19726 has been reported by johannes (Johannes Krude). ---------------------------------------- Bug #19726: Script loadde twice when requiring self https://bugs.ruby-lang.org/issues/19726 * Author: johannes (Johannes Krude) * Status: Open * Priority: Normal * Backport: 3.0: UNKNOWN, 3.1: UNKNOWN, 3.2: UNKNOWN ---------------------------------------- The executed program is not added to `$LOADED_FEATURES` unexpectedly resulting in the program possibly being loaded twice: a.rb: ``` #!/usr/bin/env ruby require "./b" C = 42 return unless __FILE__ == $0 puts C ``` b.rb: ``` require "./a" ``` This results in: ``` $ ./a.rb ./a.rb:5: warning: already initialized constant C /home/johannes/t/a.rb:5: warning: previous definition of C was here 42 ``` Ruby version: ``` $ sudo docker run ruby:3.3.0-preview1 ruby --version ruby 3.3.0preview1 (2023-05-12 master a1b01e7701) [x86_64-linux] ``` **This could be solved by always adding the executed program to `$LOADED_FEATURES`.** As a workaround, executed programs can be prepended with: ``` require "pathname" if __FILE__ == $0 $LOADED_FEATURES << Pathname.new(__FILE__).expand_path.to_s end ``` -- https://bugs.ruby-lang.org/

5 5

[ruby-core:113864] [Ruby master Bug#19723] [RFC] Deprecate/disallow passing `"|command..." values to open-uri's URI.open() method
by postmodern (Hal Brodigan) 14 Jul '23

14 Jul '23

Issue #19723 has been reported by postmodern (Hal Brodigan). ---------------------------------------- Bug #19723: [RFC] Deprecate/disallow passing `"|command..." values to open-uri's URI.open() method https://bugs.ruby-lang.org/issues/19723 * Author: postmodern (Hal Brodigan) * Status: Open * Priority: Normal * Backport: 3.0: UNKNOWN, 3.1: UNKNOWN, 3.2: UNKNOWN ---------------------------------------- Due to `Kernel.open()` supporting opening pipe-commands (ex: `"|command-here..."`) this has led to multiple [1] security [2] vulnerabilities [3], where malicious user-input eventually is passed to `Kernel.open()`. One of the code-paths that malicious user-input can reach `Kernel.open()` is via open-uri's `URI.open()` method. RuboCop even recommends avoiding using `URI.open()` in favor of `uri = URI.parse(...); uri.open` to avoid accidentally opening malicious `"|command..."` inputs. I propose that `URI.open()` should not accept pipe-commands, as they are neither URIs nor files. One could even argue that `URI.open()` should only accept URIs and never fallback to `Kernel.open()`. [1]: https://45w1nkv.medium.com/ruby-code-vulnerability-analysis-confirmsnssubsc… [2]: https://bishopfox.com/blog/ruby-vulnerabilities-exploits [3]: https://blog.heroku.com/identifying-ruby-ftp-cve -- https://bugs.ruby-lang.org/

3 3

[ruby-core:113251] [Ruby master Feature#19600] Method `clamp?`
by sawa (Tsuyoshi Sawada) 13 Jul '23

13 Jul '23

Issue #19600 has been reported by sawa (Tsuyoshi Sawada). ---------------------------------------- Feature #19600: Method `clamp?` https://bugs.ruby-lang.org/issues/19600 * Author: sawa (Tsuyoshi Sawada) * Status: Open * Priority: Normal ---------------------------------------- Currently, we have pairs of non-predicate and predicate methods like `String#match` and `String#match?`. They are brain-friendly, and make programmers happier. Along this line, I propose the following: 1. Since by #19588, `Comparable#clamp`'s behavior is made the same as `Range#cover?` for range arguments, alias `Range#cover?` as `Range#clamp?`. 2. Synchronize the specification of `Comparable#between?` with `Comparable#clamp`, i.e., a. Allow `Comparable#between?` to take range arguments, and b. Allow `Comparable#between?` to take `nil` as either or both of its arguments, or as either or both ends of its range argument. 3. Alias `Comparable#between?` as `Comparable#clamp?` -- https://bugs.ruby-lang.org/

4 3

[ruby-core:113693] [Ruby master Feature#19698] Need an idiomatic way to define an empty range
by shouichi (Shouichi KAMIYA) 12 Jul '23

12 Jul '23

Issue #19698 has been reported by shouichi (Shouichi KAMIYA). ---------------------------------------- Feature #19698: Need an idiomatic way to define an empty range https://bugs.ruby-lang.org/issues/19698 * Author: shouichi (Shouichi KAMIYA) * Status: Open * Priority: Normal ---------------------------------------- It seems there is no idiomatic way to define an empty range. We can define empty ranges in several ways such as ``` ruby irb(main):001:0> (0...0).none? => true irb(main):002:0> (1...-1).none? => true ``` I think the above examples do not communicate the intention well. -- https://bugs.ruby-lang.org/

3 2