May 2024 - ruby-core - ml.ruby-lang.org

[ruby-core:117658] [Ruby master Feature#20448] Make coverage event hooking C API public
by ms-tob (Matt S) 21 May '24

21 May '24

Issue #20448 has been reported by ms-tob (Matt S). ---------------------------------------- Feature #20448: Make coverage event hooking C API public https://bugs.ruby-lang.org/issues/20448 * Author: ms-tob (Matt S) * Status: Open ---------------------------------------- # Abstract Gathering code coverage information is a well-known goal within software engineering. It is most commonly used to assess code coverage during automated testing. A lesser known use-case is coverage-guided fuzz testing, which will be the primary use-case presented in this issue. This issue exists to request that Ruby coverage event hooking be made part of its official, public C API. # Background Ruby currently provides a number of avenues for hooking events *or* gathering coverage information: 1. The [Coverage](https://ruby-doc.org/3.3.0/exts/coverage/Coverage.html) module 2. The [TracePoint](https://ruby-doc.org/3.3.0/TracePoint.html) module 3. The [rb_add_event_hook](https://ruby-doc.org/3.3.0/extension_rdoc.html#label-Hoo… extension function Unfortunately, none of these pieces of functionality solve this issue's specific use-case. The `Coverage` module is not a great fit for real-time coverage analysis with an unknown start and stop point. Coverage-guided fuzz testing requires this. The `TracePoint` module and `rb_add_event_hook` are not able to hook branch and line coverage events. Coverage-guided fuzz testing typically tracks branch events. # Proposal The ultimate goal is to enable Ruby C extensions to process coverage events in real-time. I did some cursory investigation into the Ruby C internals to determine what it would take to achieve this, but I'm by no means an expert, so my list may be incomplete. The good news is that much of this functionality already exists, but it's part of the private, internal-only C API. 1. Make `RUBY_EVENT_COVERAGE_LINE` and `RUBY_EVENT_COVERAGE_BRANCH` public: https://github.com/ruby/ruby/blob/v3_3_0/vm_core.h#L2182-L2184 a. This would be an addition to the current public event types: https://github.com/ruby/ruby/blob/v3_3_0/include/ruby/internal/event.h#L32-… 2. Allow initializing global coverage state so that coverage tracking can be fully enabled a. Currently, if `Coverage.setup` or `Coverage.start` is not called, then coverage events cannot be hooked. I do not fully understand why this is, but I believe it has something to do with `rb_get_coverages` and `rb_set_coverages`. If calls to `rb_get_coverages` return `NULL` (https://github.com/ruby/ruby/blob/v3_3_0/iseq.c#L641-L647, https://github.com/ruby/ruby/blob/v3_3_0/iseq.c#L864-L868) then coverage hooking will not be enabled. I believe the `Coverage` module initializes that state via a `rb_set_coverages` call here: https://github.com/ruby/ruby/blob/v3_3_0/ext/coverage/coverage.c#L112-L120. b. So, to achieve this goal, a C extension would need to be able to call `rb_set_coverages` or somehow initialize the global coverage state. I've actually been able to achieve this functionality by calling undocumented features and defining `RUBY_EVENT_COVERAGE_BRANCH`: ```c #include <ruby.h> #include <ruby/debug.h> #define RUBY_EVENT_COVERAGE_BRANCH 0x020000 // ... rb_event_flag_t events = RUBY_EVENT_COVERAGE_BRANCH; rb_event_hook_flag_t flags = ( RUBY_EVENT_HOOK_FLAG_SAFE | RUBY_EVENT_HOOK_FLAG_RAW_ARG ); rb_add_event_hook2( (rb_event_hook_func_t) event_hook_branch, events, counter_hash, flags ); ``` If I call `Coverage.setup(branches: true)`, and add this event hook, then branch hooking works as expected. `rb_add_event_hook2` will still respect the `RUBY_EVENT_COVERAGE_BRANCH` value if its passed. But it would be better if I could rely on official functionality rather than undocumented features. The above two points would be requirements for this functionality, but there's an additional nice-to-have: 3. Extend the public `tracearg` functionality to include additional coverage information a. Currently, `tracearg` offers information like `rb_tracearg_lineno` and `rb_tracearg_path`. It would be helpful if it also provided additional coverage information like `coverage.c`'s column information and a unique identifier for each branch. Currently, I can only use `(path, lineno)` as a unique identifier for a branch because that's what's offered by the public API, but more information like column number would be helpful for uniquely identify branches. Since there can be multiple `if` statements on a single line, this can provide ambiguous identification for a branch event. # Use cases This use-case was born out of a new coverage-guided Ruby fuzzer: https://github.com/trailofbits/ruzzy. You can read more about its implementation details here: https://blog.trailofbits.com/2024/03/29/introducing-ruzzy-a-coverage-guided…. You can also find the Ruby C extension code behind its implementation here: https://github.com/trailofbits/ruzzy/blob/v0.7.0/ext/cruzzy/cruzzy.c#L220-L…. So, the primary use-case here is enabling real-time, coverage-guided fuzz testing of Ruby code. However, as mentioned in the abstract, gathering code coverage information is useful in many domains. For example, it could enable new workflows in standard unit/integration test coverage. It could also enable gathering coverage information in real-time as an application is running. I see this as the most generalized form of gathering code coverage information, and something like the `Coverage` module as a specialized implementation. Another example, https://bugs.ruby-lang.org/issues/20282 may be solved by this more generalized solution. We are tracking this request downstream here: https://github.com/trailofbits/ruzzy/issues/9 # Discussion Fuzz testing is another tool in a testers toolbelt. It is an increasingly common way to improve software's robustness. Go has it built in to the standard library, Python has Atheris, Java has Jazzer, JavaScript has Jazzer.js, etc. OSS-Fuzz has helped identify and fix over 10,000 vulnerabilities and 36,000 bugs [using fuzzing](https://google.github.io/oss-fuzz/#trophies). Ruby deserves a good fuzzer, and improving coverage gathering would help achieve that goal. The `Coverage` module, `TracePoint` module, and `rb_add_event_hook` function seem like they could fulfill this goal. However, after deeper investigation, none of them fit the exact requirements for this use-case. # See also - https://bugs.ruby-lang.org/issues/20282 - https://github.com/google/atheris - https://security.googleblog.com/2020/12/how-atheris-python-fuzzer-works.html - https://github.com/CodeIntelligenceTesting/jazzer/ - https://www.code-intelligence.com/blog/java-fuzzing-with-jazzer - https://go.dev/doc/security/fuzz/ -- https://bugs.ruby-lang.org/

2 8

[ruby-core:116026] [Ruby master Bug#20151] Can't build Ruby 3.1 on FreeBSD 14.0
by hsbt (Hiroshi SHIBATA) 21 May '24

21 May '24

Issue #20151 has been reported by hsbt (Hiroshi SHIBATA). ---------------------------------------- Bug #20151: Can't build Ruby 3.1 on FreeBSD 14.0 https://bugs.ruby-lang.org/issues/20151 * Author: hsbt (Hiroshi SHIBATA) * Status: Open * Priority: Normal * Backport: 3.0: UNKNOWN, 3.1: UNKNOWN, 3.2: UNKNOWN, 3.3: UNKNOWN ---------------------------------------- I couldn't install Ruby 3.1.3 on FreeBSD 14.0. ``` compiling util.c util.c:255:1: error: expected identifier or '(' ruby_qsort(void* base, const size_t nel, const size_t size, cmpfunc_t *cmp, void *d) ^ ./include/ruby/util.h:124:21: note: expanded from macro 'ruby_qsort' # define ruby_qsort qsort_r ^ /usr/include/stdlib.h:356:5: note: expanded from macro 'qsort_r' __generic(arg5, int (*)(void *, const void *, const void *), \ ^ /usr/include/sys/cdefs.h:322:2: note: expanded from macro '__generic' _Generic(expr, t: yes, default: no) ^ 1 error generated. *** Error code 1 Stop. ``` Compiler version is here: ``` FreeBSD clang version 16.0.6 (https://github.com/llvm/llvm-project.git llvmorg-16.0.6-0-g7cbf1a259152) ``` I could install Ruby 3.2.2. -- https://bugs.ruby-lang.org/

3 4

[ruby-core:117901] [Ruby master Feature#20492] Debug option for tempfile
by hadmut (Hadmut Danisch) 19 May '24

19 May '24

Issue #20492 has been reported by hadmut (Hadmut Danisch). ---------------------------------------- Feature #20492: Debug option for tempfile https://bugs.ruby-lang.org/issues/20492 * Author: hadmut (Hadmut Danisch) * Status: Open ---------------------------------------- Hi, the ruby lib tempfile is quite useful, but since it always deletes files once the object is garbage collected or the program terminates (or the program explicitely asks to remove the file) it is difficult to debug programs and to check the file contents, after program termination. Replacing all tempfile uses with regular file operations is awkward. It therefore would be useful, if file deletion of tempfiles could be completely turned of e.g. through an environment variable or by the program itself, like through a --debug option or when catching errors, like deleting all files during normal program termination, but not if there's a runtime error. regards -- https://bugs.ruby-lang.org/

3 2

[ruby-core:114070] [Ruby master Bug#19753] IO::Buffer#get_string can't handle negative offset
by noteflakes (Sharon Rosner) 18 May '24

18 May '24

Issue #19753 has been reported by noteflakes (Sharon Rosner). ---------------------------------------- Bug #19753: IO::Buffer#get_string can't handle negative offset https://bugs.ruby-lang.org/issues/19753 * Author: noteflakes (Sharon Rosner) * Status: Open * Priority: Normal * ruby -v: 3.2 * Backport: 3.0: UNKNOWN, 3.1: UNKNOWN, 3.2: UNKNOWN ---------------------------------------- ```ruby irb(main):001:0> b = IO::Buffer.for('abc') => #<IO::Buffer 0x00007f858f5450c0+3 EXTERNAL READONLY SLICE> ... irb(main):002:0> b.get_string(-1) => "\x00abc" irb(main):003:0> b.get_string(-1000, 3) (irb):3:in `get_string': Specified offset+length exceeds data size! (ArgumentError) from (irb):3:in `<main>' from /home/sharon/.rbenv/versions/3.2.0/lib/ruby/gems/3.2.0/gems/irb-1.7.1/exe/irb:9:in `<top (required)>' from /home/sharon/.rbenv/versions/3.2.0/bin/irb:25:in `load' from /home/sharon/.rbenv/versions/3.2.0/bin/irb:25:in `<main>' ``` Using a negative offset returns garbage in the string but it also might segfault: ```ruby irb(main):003:0> b = IO::Buffer.map(File.open('sgt-nodes.sql', 'r+')) => #<IO::Buffer 0x00007f189de14000+2008858 EXTERNAL MAPPED SHARED> irb(main):004:0> b.get_string(-1000) (irb):4: [BUG] Segmentation fault at 0x00007f189de13c18 ruby 3.2.0 (2022-12-25 revision a528908271) [x86_64-linux] -- Control frame information ----------------------------------------------- c:0021 p:---- s:0109 e:000108 CFUNC :get_string ... ``` ## Expected behaviour I think it might be nice to have `#get_string` behave like other methods taking an offset, like `String#[]`. For example: ```ruby irb(main):001:0> b = IO::Buffer.for('abc') => #<IO::Buffer 0x00007f858f5450c0+3 EXTERNAL READONLY SLICE> ... irb(main):002:0> b.get_string(-1) => "c" irb(main):003:0> b.get_string(-2) => "bc" irb(main):003:0> b.get_string(-1000) => "abc" irb(main):003:0> b.get_string(-1000, 2) => "ab" ``` -- https://bugs.ruby-lang.org/

5 9

[ruby-core:117835] [Ruby master Feature#20484] A new pragma for eager resolution of classes referenced in rescue clauses.
by jfrisby (Jon Frisby) 16 May '24

16 May '24

Issue #20484 has been reported by jfrisby (Jon Frisby). ---------------------------------------- Feature #20484: A new pragma for eager resolution of classes referenced in rescue clauses. https://bugs.ruby-lang.org/issues/20484 * Author: jfrisby (Jon Frisby) * Status: Open ---------------------------------------- I've been using Ruby for 20 years, and just today learned (the hard way) that the class name(s) referenced in a `rescue` clause are not resolved until an exception occurs. Upon reflection, this behavior probably makes sense in a lot of situations. Late resolution may simplify code loading for the developer. I would, however, love to see an opt-in feature (a la `frozen-string-literal`) to force resolution when the code is loaded/parsed. -- https://bugs.ruby-lang.org/

4 5

[ruby-core:112304] [Ruby master Bug#19427] Marshal.load(source, freeze: true) doesn't freeze in some cases
by andrykonchin (Andrew Konchin) 16 May '24

16 May '24

Issue #19427 has been reported by andrykonchin (Andrew Konchin). ---------------------------------------- Bug #19427: Marshal.load(source, freeze: true) doesn't freeze in some cases https://bugs.ruby-lang.org/issues/19427 * Author: andrykonchin (Andrew Konchin) * Status: Open * Priority: Normal * ruby -v: 3.1 * Backport: 2.7: UNKNOWN, 3.0: UNKNOWN, 3.1: UNKNOWN, 3.2: UNKNOWN ---------------------------------------- I've noticed that the `freeze` option doesn't work in the following cases: - when dumped object extends a module - when dumped object responds to `#marshal_dump` and `#marshal_load` methods - when dumped object responds to `#_dump` method Is it expected behaviour or a known issue? Examples: ```ruby module M end object = Object.new object.extend(M) object = Marshal.load(Marshal.dump(object), freeze: true) object.frozen? # => false ``` ```ruby class UserMarshal attr_accessor :data def initialize @data = 'stuff' end def marshal_dump() :data end def marshal_load(data) @data = data end end object = Marshal.load(Marshal.dump(UserMarshal.new), freeze: true) object.frozen? # => false ``` ```ruby class UserDefined attr_reader :a, :b def initialize @a = 'stuff' @b = @a end def _dump(depth) Marshal.dump [:stuff, :stuff] end def self._load(data) a, b = Marshal.load data obj = allocate obj.instance_variable_set :@a, a obj.instance_variable_set :@b, b obj end end ``` -- https://bugs.ruby-lang.org/

5 13

[ruby-core:117885] [Ruby master Misc#20491] Proposal for new branch maintainers
by hsbt (Hiroshi SHIBATA) 16 May '24

16 May '24

Issue #20491 has been reported by hsbt (Hiroshi SHIBATA). ---------------------------------------- Misc #20491: Proposal for new branch maintainers https://bugs.ruby-lang.org/issues/20491 * Author: hsbt (Hiroshi SHIBATA) * Status: Open * Assignee: matz (Yukihiro Matsumoto) ---------------------------------------- In RubyKaigi 2024, I, naruse and nagachika discussed about maintaining stable branches. We propose the following members for the new branch maintainer of current stable branches. * `ruby_3_3`: @k0kubun * `ruby_3_2`: @nagachika * `ruby_3_1`: @hsbt (me) We consider to how resolve #20432 's request at the next time. And `ruby_3_1` still have some critical build issues like #20151 , #20451 and others. I consider to release to fix that soon without security fixes. @matz Can you approve an above plan? -- https://bugs.ruby-lang.org/

2 3

[ruby-core:112873] [Ruby master Bug#19530] `Array#sum` and `Enumerable#sum` sometimes show different behaviours
by dstosik (David Stosik) 16 May '24

16 May '24

Issue #19530 has been reported by dstosik (David Stosik). ---------------------------------------- Bug #19530: `Array#sum` and `Enumerable#sum` sometimes show different behaviours https://bugs.ruby-lang.org/issues/19530 * Author: dstosik (David Stosik) * Status: Open * Priority: Normal * ruby -v: ruby 3.2.1 (2023-02-08 revision 31819e82c8) [arm64-darwin22] * Backport: 2.7: UNKNOWN, 3.0: UNKNOWN, 3.1: UNKNOWN, 3.2: UNKNOWN ---------------------------------------- Hi everyone. 👋🏻 We recently discovered that `Array#sum` and `Enumerable#sum` will output different results in some edge cases. Here's the smallest script I managed to write to reproduce the issue: ``` ruby class Money def initialize(amount) @amount = amount.to_f end def +(other) self.class.new(@amount + other.to_f) end def to_f @amount end end p [7.0].each.sum(Money.new(0)).class #=> Money p [7.0] .sum(Money.new(0)).class #=> Float 💥 ``` I understand that it is expected that `#sum` may not honor custom definitions of the `#+` method (particularly when the summed values are `Float`). However, I would like to bring your attention to the fact that, in the example above, calling `#sum` on an `Array` of `Float` values and calling `#sum` on an `Enumerable` that yields the same `Float` values will return results of different types. I've reproduced the same behaviour with multiple versions of Ruby going from 2.6.5 to 3.2.1. Ideally, I would expect `[7.0].sum(Money.new(0))` to return a `Money` object identical to the one returned by `[7.0].each.sum(Money.new(0))`. I think it would make sense if at least they returned an identical value (even if it is a `Float`). -- https://bugs.ruby-lang.org/

3 3

[ruby-core:117888] [Ruby master Feature#16461] Proc#using
by shugo (Shugo Maeda) 16 May '24

16 May '24

Issue #16461 has been updated by shugo (Shugo Maeda). Sorry for the delay. Eregon (Benoit Daloze) wrote in #note-10: > Reading #12086 again, I feel #12281 is a much simpler alternative (`using(refinement) { literal block }`). > Wouldn't #12281 be enough? > > `block.using(IntegerDivExt)` is mutating state and this feels too magic and dangerous to me. > I think DSL users can accept to wrap their DSL code with `using(refinement) { ... }` (or `using refinement` in a module/file). > That's actually not more verbose than `using Proc::Refinements` and I think so much clearer. It looks too redundant to me because `using` is needed for each block. > We could have additional requirements to ensure it's truly lexical and the `refinement` given to a given `using(refinement) { ... }` call site is always the same. > I think that would be good, because then we know code inside always use the given refinements, much like how `using refinement` works today. > > For the `User.where { :age > 3 }` case, if we want to avoid an extra `using(refinement) { ... }`, I think it could be fine to automatically enable refinements in that block *if* we can ensure it's still fully lexical. > Concretely that would mean for that block `{ :age > 3 }` it's always called with the same refinements, no matter where it's called from. > Attempting to use any other refinement would raise an error. > > Maybe a way to design this restriction could be to annotate the method `where` with "enables MyRefinement on the lexical block given to it". > ```ruby > class ModelClassMethods > def where(&block) > ... > block.call / yield > end > instance_method(:where).use_refinements_for_block(ActiveRecord::WhereDSL) > end > > User.where { :age > 3 } > ``` I like the idea, but if `where` is polymorphic, the block can be called with different refinements, can't it? ```ruby def age_over_three(model_class) model_class.where { :age > 3 } end ``` Do you mean to save the refinements when the block is called at the first time, and to raise an exception when the block is called with different refinements? If so, it's similar to what I meant to realize by Proc.using. ---------------------------------------- Feature #16461: Proc#using https://bugs.ruby-lang.org/issues/16461#change-108304 * Author: shugo (Shugo Maeda) * Status: Assigned * Assignee: matz (Yukihiro Matsumoto) ---------------------------------------- ## Overview I propose Proc#using to support block-level refinements. ```ruby module IntegerDivExt refine Integer do def /(other) quo(other) end end end def instance_eval_with_integer_div_ext(obj, &block) block.using(IntegerDivExt) # using IntegerDivExt in the block represented by the Proc object obj.instance_eval(&block) end # necessary where blocks are defined (not where Proc#using is called) using Proc::Refinements p 1 / 2 #=> 0 instance_eval_with_integer_div_ext(1) do p self / 2 #=> (1/2) end p 1 / 2 #=> 0 ``` ## PoC implementation For CRuby: https://github.com/shugo/ruby/pull/2 For JRuby: https://github.com/shugo/jruby/pull/1 ## Background I proposed [Feature #12086: using: option for instance_eval etc.](https://bugs.ruby-lang.org/issues/12086) before, but it has problems: * Thread safety: The same block can be invoked with different refinements in multiple threads, so it's hard to implement method caching. * _exec family support: {instance,class,module}_exec cannot be supported. * Implicit use of refinements: every blocks can be used with refinements, so there was implementation difficulty in JRuby and it has usability issue in headius's opinion. ## Solutions in this proposal ### Thread safety Proc#using affects the block represented by the Proc object, neither the specific Proc object nor the specific block invocation. Method calls in a block are resolved with refinements which are used by Proc#using in the block at the time. Once all possible refinements are used in the block, there is no need to invalidate method cache anymore. See [these tests](https://github.com/shugo/ruby/pull/2/commits/1c922614ad7d1fb43b73e19… to understand how it works. Which refinements are used is depending on the order of Proc#using invocations until all Proc#using calls are finished, but eventually method calls in a block are resolved with the same refinements. ### * _exec family support [Feature #12086](https://bugs.ruby-lang.org/issues/12086) was an extension of _eval family, so it cannot be used with _exec family, but Proc#using is independent from _eval family, and can be used with _exec family: ```ruby def instance_exec_with_integer_div_ext(obj, *args, &block) block.using(IntegerDivExt) obj.instance_exec(*args, &block) end using Proc::Refinements p 1 / 2 #=> 0 instance_exec_with_integer_div_ext(1, 2) do |other| p self / other #=> (1/2) end p 1 / 2 #=> 0 ``` ### Implicit use of refinements Proc#using can be used only if `using Proc::Refinements` is called in the scope of the block represented by the Proc object. Otherwise, a RuntimeError is raised. There are two reasons: * JRuby creates a special CallSite for refinements at compile-time only when `using` is called at the scope. * When reading programs, it may help understanding behavior. IMHO, it may be unnecessary if libraries which uses Proc#using are well documented. `Proc::Refinements` is a dummy module, and has no actual refinements. -- https://bugs.ruby-lang.org/

1 0

[ruby-core:114403] [Ruby master Feature#19840] [Proposal] Expand Find pattern to Multiple Find
by FlickGradley (Nick Bradley) 16 May '24

16 May '24

Issue #19840 has been reported by FlickGradley (Nick Bradley). ---------------------------------------- Feature #19840: [Proposal] Expand Find pattern to Multiple Find https://bugs.ruby-lang.org/issues/19840 * Author: FlickGradley (Nick Bradley) * Status: Open * Priority: Normal ---------------------------------------- Hello! I love Ruby's pattern matching features. I would like to propose an expansion of the Find pattern which allows the selection of multiple matching elements of an array. I often find myself dealing with data like this: ``` ruby { results: [{ id: 1, name: "foo" }, { id: 2, name: "bar" }, ... ] } ``` My problem is that I need to retrieve all the `id` values from the nested array of hashes, and I don't know how many there will be in advance. It seems that the Find pattern could be expanded from allowing `pattern` (matching a single element) to `*pattern`. Examples: ``` ruby # Base case case { results: [{ id: 1, name: "foo" }, { id: 2, name: "bar" }] } in results: [*{ id: ids }] "matched: #{ids}" else "not matched" end #=> matched: [1, 2] # With * at the end (rest of args) - same result case { results: [{ id: 1, name: "foo" }, { id: 2, name: "bar" }] } in results: [*{ id: ids }, *] "matched: #{ids}" else "not matched" end #=> matched: [1, 2] # When one element doesn't match and there is no *rest case { results: [{ name: "foo" }, { id: 2, name: "bar" }] } in results: [*{ id: ids }] "matched: #{ids}" else "not matched" end #=> not matched ``` Similarly, `*Constant` could work to pull out types with an As pattern: ``` ruby case [1, 2, 3, "string"] in *Integer => nums, * "matched: #{nums}" else "not matched" end #=> matched: [1, 2, 3] ``` Other patterns would work in the same way. Essentially, this expands the concept of `*` in pattern matching to mean "a variable number of `things matching subpattern`". Today, the only pattern supported by `*` is a variable binding - but it could be any of the other subpatterns as well. This proposal does imply that this would work: ``` ruby a = 2 [1, 2, 2, 3] in [*, *^a, *] #=> true ``` To me, the `*` represents the variable number of matches, so the syntax makes intuitive sense. But others may have different opinions about `*^` being adjacent. It may also imply this would work, though we could restrict the number of non-variable patterns (in other words, patterns that have the possibility of not matching) to 1 per Array so that this isn't possible.. I'm not sure something like this would be useful or clear. ``` ruby a = 2 [1, 2, "hello", "ruby"] in [*Integer, *String] #=> true ``` This feature feels like the missing piece of the Find pattern to me - I often want to "Find Multiple". If others agree, I would be happy to contribute by working on this feature and creating a pull request. -- https://bugs.ruby-lang.org/

3 2