July 2025 - ruby-core - ml.ruby-lang.org

[ruby-core:122518] [Ruby Bug#21438] use-after-free when resizing exivars
by byroot (Jean Boussier) 19 Jul '25

19 Jul '25

Issue #21438 has been reported by byroot (Jean Boussier). ---------------------------------------- Bug #21438: use-after-free when resizing exivars https://bugs.ruby-lang.org/issues/21438 * Author: byroot (Jean Boussier) * Status: Open * Backport: 3.2: WONTFIX, 3.3: REQUIRED, 3.4: REQUIRED ---------------------------------------- Here's a semi-reliable reproduction: ```ruby objs = 10_000.times.map do a = [] a.instance_variable_set(:@a, 1) a end GC.stress = true GC.auto_compact = true steps = 1000.times.map do a = [] a.instance_variable_set(:@a, 1) a.instance_variable_set(:@b, 2) a.instance_variable_set(:@c, 3) a.instance_variable_set(:@d, 4) a.instance_variable_set(:@e, 5) a.instance_variable_set(:@f, 6) a.instance_variable_set(:@g, 7) a.instance_variable_set(:@h, 8) # resize a.instance_variable_set(:@i, 9) a.instance_variable_set(:@j, 10) a end objs.clear GC.stress = false GC.auto_compact = false ``` The Exivar codepath uses `st_update` and allocate within the codebase. If GC trigger, it may remove entires from the table, or delete+insert in case of compaction, and this can trigger a table rebuild of the generic fields st_table in the middle of calling the st_update callback. This can cause entries to be reallocated or rearranged and the update to be for the wrong entry. Auto compaction isn't strictly required to trigger the bug, but makes it more likely. -- https://bugs.ruby-lang.org/

3 4

[ruby-core:122724] [Ruby Misc#21508] DevMeeting-2025-08-21
by mame (Yusuke Endoh) 18 Jul '25

18 Jul '25

Issue #21508 has been reported by mame (Yusuke Endoh). ---------------------------------------- Misc #21508: DevMeeting-2025-08-21 https://bugs.ruby-lang.org/issues/21508 * Author: mame (Yusuke Endoh) * Status: Open ---------------------------------------- # The next dev meeting **Date: 2025/08/21 13:00-17:00** (JST) Log: *TBD* - Dev meeting *IS NOT* a decision-making place. All decisions should be done at the bug tracker. - Dev meeting is a place we can ask Matz, nobu, nurse and other developers directly. - Matz is a very busy person. Take this opportunity to ask him. If you can not attend, other attendees can ask instead of you (if attendees can understand your issue). - We will write a record of the discussion in the file or to each ticket in English. - All activities are best-effort (keep in mind that most of us are volunteer developers). - The date, time and place of the meeting are scheduled according to when/where we can reserve Matz's time. - *DO NOT* discuss then on this ticket, please. # Call for agenda items If you have a ticket that you want matz and committers to discuss, please post it into this ticket in the following format: ``` * [Ticket ref] Ticket title (your name) * Comment (A summary of the ticket, why you put this ticket here, what point should be discussed, etc.) ``` Example: ``` * [Feature #14609] `Kernel#p` without args shows the receiver (ko1) * I feel this feature is very useful and some people say :+1: so let discuss this feature. ``` - It is recommended to add a comment by 2025/08/18. We hold a preparatory meeting to create an agenda a few days before the dev-meeting. - The format is strict. We'll use [this script to automatically create an markdown-style agenda](https://gist.github.com/mame/b0390509ce1491b43610b9ebb665eb86). We may ignore a comment that does not follow the format. - Your comment is mandatory. We cannot read all discussion of the ticket in a limited time. We appreciate it if you could write a short summary and update from a previous discussion. -- https://bugs.ruby-lang.org/

2 1

[ruby-core:120579] [Ruby master Feature#21020] Sync sig directory for prism of default gem.
by ksss (Yuki Kurihara) 18 Jul '25

18 Jul '25

Issue #21020 has been reported by ksss (Yuki Kurihara). ---------------------------------------- Feature #21020: Sync sig directory for prism of default gem. https://bugs.ruby-lang.org/issues/21020 * Author: ksss (Yuki Kurihara) * Status: Open ---------------------------------------- Currently, the type signatures (RBS) for the default gem is not available. **Prism** is the only default gem with type signatures, but this number is expected to increase in the future. As a first step to resolving this issue, I propose including the `sig` directory of Prism as a default gem in the synchronization process. PR: https://github.com/ruby/ruby/pull/12541 -- https://bugs.ruby-lang.org/

5 5

[ruby-core:122817] [Ruby Bug#21517] Behaviour of StringIO#readpartial with multibyte differs from IO#readpartial
by herwin (Herwin W) 18 Jul '25

18 Jul '25

Issue #21517 has been reported by herwin (Herwin W). ---------------------------------------- Bug #21517: Behaviour of StringIO#readpartial with multibyte differs from IO#readpartial https://bugs.ruby-lang.org/issues/21517 * Author: herwin (Herwin W) * Status: Open * ruby -v: ruby 3.4.5 (2025-07-16 revision 20cda200d3) +PRISM [x86_64-linux] (+ others) * Backport: 3.2: UNKNOWN, 3.3: UNKNOWN, 3.4: UNKNOWN ---------------------------------------- The specs for `IO#readpartial` have the following test (https://github.com/ruby/spec/blob/ed254bae321221f5cd24280beb37e5bddaff6bb6/…) ```ruby before :each do @rd, @wr = IO.pipe @rd.binmode @wr.binmode end it "reads after ungetc with multibyte characters in the buffer" do @wr.write("∂φ/∂x = gaîté") c = @rd.getc @rd.ungetc(c) @rd.readpartial(3).should == "\xE2\x88\x82" @rd.readpartial(3).should == "\xCF\x86/" end ``` This behaviour is different in `StringIO#readpartial`. If I add this as a spec: ```ruby it "reads after ungetc with multibyte characters in the buffer" do @string = StringIO.new(+"∂φ/∂x = gaîté") c = @string.getc @string.ungetc(c) @string.readpartial(3).should == "\xE2\x88\x82" @string.readpartial(3).should == "\xCF\x86/" end ``` it fails with every supported Ruby version, and even with 3.5-dev of today, with the message `Expected "\xE2\x88\x82" == "∂"` The `getc` + `ungetc` can be removed, but this does not change the behaviour. -- https://bugs.ruby-lang.org/

1 0

[ruby-core:122814] [Ruby Feature#17473] Make Pathname to embedded class of Ruby
by Eregon (Benoit Daloze) 18 Jul '25

18 Jul '25

Issue #17473 has been updated by Eregon (Benoit Daloze). hsbt (Hiroshi SHIBATA) wrote in #note-27: > Please separate the small PRs. I want to reduce the side effect like https://github.com/ruby/ruby/pull/13906. Let's discuss your concerns about the PR on https://github.com/ruby/pathname/pull/57 directly. ---------------------------------------- Feature #17473: Make Pathname to embedded class of Ruby https://bugs.ruby-lang.org/issues/17473#change-114101 * Author: hsbt (Hiroshi SHIBATA) * Status: Closed * Assignee: akr (Akira Tanaka) ---------------------------------------- pathname is one of most useful utility class of Ruby. I'm happy to use Pathname without require it. Any thought? -- https://bugs.ruby-lang.org/

1 0

[ruby-core:121592] [Ruby Bug#21256] `it` value is wrapped in an array when that doesn't happen with numbered parameter
by Earlopain (Earlopain _) 18 Jul '25

18 Jul '25

Issue #21256 has been reported by Earlopain (Earlopain _). ---------------------------------------- Bug #21256: `it` value is wrapped in an array when that doesn't happen with numbered parameter https://bugs.ruby-lang.org/issues/21256 * Author: Earlopain (Earlopain _) * Status: Open * ruby -v: ruby 3.4.2 (2025-02-15 revision d2930f8e7a) +PRISM [x86_64-linux] * Backport: 3.2: UNKNOWN, 3.3: UNKNOWN, 3.4: UNKNOWN ---------------------------------------- I have the following script: ```rb require "bundler/inline" gemfile do source "https://rubygems.org" gem "rspec-core", "3.13.3" gem "rspec-expectations", "3.13.3" end require "rspec/autorun" require "rspec/expectations" RSpec::Matchers.define :example do chain(:foo) { pp _1 } chain(:bar) { pp it } end RSpec.describe "demo" do it do example.foo(1) example.bar(2) end end ``` It calls two methods were the only difference is that one accesses the argument with `_1`, the other with `it`. It prints the following: ``` 1 [2] ``` So, `it` for some reason wraps it in an array. I appologise for the reproduction script, it uses `rspec` and the amount of metaprogramming it uses makes it impossible for me to reduce this further. When running with `parser=parse.y`, the expected output is returned (just `2`, no array). I also tested against current ruby-dev and it also happens there. -- https://bugs.ruby-lang.org/

2 4

[ruby-core:122812] [Ruby Feature#17473] Make Pathname to embedded class of Ruby
by hsbt (Hiroshi SHIBATA) 18 Jul '25

18 Jul '25

Issue #17473 has been updated by hsbt (Hiroshi SHIBATA). Eregon (Benoit Daloze) wrote in #note-26: > That PR is actually easy to review as explained in its description, it restores pathname.rb as it used to be and includes all changes to pathname.rb since then, see https://github.com/ruby/pathname/pull/53/files/3736eab91f783cb087f873b99c25…. > IOW, it only adds code in pathname.rb and removes code in pathname.c, and then has separate commits for all other changes. > Making multiple smaller PRs does not make sense, especially since the Ruby code is just the one from before the migration to C. Please separate the small PRs. I want to reduce the side effect like https://github.com/ruby/ruby/pull/13906. And if you have another issue or proposal, please file new issue. ---------------------------------------- Feature #17473: Make Pathname to embedded class of Ruby https://bugs.ruby-lang.org/issues/17473#change-114099 * Author: hsbt (Hiroshi SHIBATA) * Status: Closed * Assignee: akr (Akira Tanaka) ---------------------------------------- pathname is one of most useful utility class of Ruby. I'm happy to use Pathname without require it. Any thought? -- https://bugs.ruby-lang.org/

1 0

[ruby-core:122798] [Ruby Bug#21516] Segfault in String#succ! on 32-bit i686
by leahneukirchen (Leah Neukirchen) 17 Jul '25

17 Jul '25

Issue #21516 has been reported by leahneukirchen (Leah Neukirchen). ---------------------------------------- Bug #21516: Segfault in String#succ! on 32-bit i686 https://bugs.ruby-lang.org/issues/21516 * Author: leahneukirchen (Leah Neukirchen) * Status: Open * ruby -v: 3.4.5 * Backport: 3.2: UNKNOWN, 3.3: UNKNOWN, 3.4: UNKNOWN ---------------------------------------- I noticed segfaults in the test suite of Ruby 3.4.5, related to String#succ! A very easy reproducer is: ./miniruby -e 'puts "ZZZZ999".succ!' $ ./miniruby -e 'puts "ZZZZ999".succ!' -e:1: [BUG] Segmentation fault at 0x9e968041 ruby 3.4.5 (2025-07-16 revision 20cda200d3) +PRISM [x86_64-linux-x32] -- Control frame information ----------------------------------------------- c:0003 p:---- s:0011 e:000010 CFUNC :succ! c:0002 p:0005 s:0007 e:000005 EVAL -e:1 [FINISH] c:0001 p:0000 s:0003 E:0017b8 DUMMY [FINISH] -- Ruby level backtrace information ---------------------------------------- -e:1:in '<main>' -e:1:in 'succ!' -- Threading information --------------------------------------------------- Total ractor count: 1 Ruby thread count for this ractor: 1 -- Machine register context ------------------------------------------------ GS: 0x00000063 FS: 0x00000000 ES: 0x0000002b DS: 0x0000002b EDI: 0x9e968049 ESI: 0x9e968041 EBP: 0x5896c1a0 ESP: 0xff97d638 EBX: 0x9e968046 EDX: 0x9e968049 ECX: 0x5896c1a0 EAX: 0x9e968041 TRA: 0x0000000e ERR: 0x00000004 EIP: 0x5681ea07 CS: 0x00000023 EFL: 0x00010293 UES: 0xff97d638 SS: 0x0000002b -- C level backtrace information ------------------------------------------- /builddir/ruby/ruby/miniruby(rb_print_backtrace+0x14) [0x568ae631] /builddir/ruby/ruby/vm_dump.c:823 /builddir/ruby/ruby/miniruby(rb_vm_bugreport) /builddir/ruby/ruby/vm_dump.c:1155 /builddir/ruby/ruby/miniruby(rb_bug_for_fatal_signal+0x86) [0x566e4ee6] /builddir/ruby/ruby/error.c:1130 /builddir/ruby/ruby/miniruby(sigsegv+0x4f) [0x5680e98f] /builddir/ruby/ruby/signal.c:934 linux-gate.so.1(__kernel_rt_sigreturn+0x0) [0xf7f475a0] /builddir/ruby/ruby/miniruby(search_nonascii+0x17) [0x5681ea07] /builddir/ruby/ruby/string.c:728 /builddir/ruby/ruby/miniruby(coderange_scan+0x59) [0x56821d09] /builddir/ruby/ruby/string.c:767 /builddir/ruby/ruby/miniruby(rbimpl_fl_unset_raw_raw+0x0) [0x56824715] /builddir/ruby/ruby/string.c:895 /builddir/ruby/ruby/miniruby(RB_FL_UNSET_RAW) ./include/ruby/internal/fl_type.h:669 /builddir/ruby/ruby/miniruby(RB_ENC_CODERANGE_SET) ./include/ruby/internal/encoding/coderange.h:131 /builddir/ruby/ruby/miniruby(rb_enc_str_coderange) /builddir/ruby/ruby/string.c:911 /builddir/ruby/ruby/miniruby(str_succ+0x69c) [0x5682545c] /builddir/ruby/ruby/string.c:5364 /builddir/ruby/ruby/miniruby(rb_str_succ_bang+0x15) [0x56829f85] /builddir/ruby/ruby/string.c:5380 /builddir/ruby/ruby/miniruby(vm_call_cfunc_with_frame_+0x106) [0x568860e6] /builddir/ruby/ruby/vm_insnhelper.c:3794 /builddir/ruby/ruby/miniruby(vm_call_method_each_type+0x76) [0x56894636] /builddir/ruby/ruby/vm_insnhelper.c:4772 /builddir/ruby/ruby/miniruby(vm_sendish+0xa2) [0x5689fecb] /builddir/ruby/ruby/vm_insnhelper.c:5961 /builddir/ruby/ruby/miniruby(vm_exec_core) /builddir/ruby/ruby/insns.def:898 /builddir/ruby/ruby/miniruby(vm_exec_loop+0x38) [0x56893d68] /builddir/ruby/ruby/vm.c:2622 /builddir/ruby/ruby/miniruby(rb_vm_exec) /builddir/ruby/ruby/vm.c:2598 /builddir/ruby/ruby/miniruby(rb_ec_exec_node+0x7f) [0x566eb0ef] /builddir/ruby/ruby/eval.c:281 /builddir/ruby/ruby/miniruby(ruby_run_node+0x58) [0x566ee558] /builddir/ruby/ruby/eval.c:319 /builddir/ruby/ruby/miniruby(main+0x70) [0x56648460] ./main.c:43 -- Other runtime information ----------------------------------------------- * Loaded script: -e * Loaded features: 0 enumerator.so 1 thread.rb 2 fiber.so 3 rational.so 4 complex.so 5 ruby2_keywords.rb * Process memory map: 56622000-56642000 r--p 00000000 fe:02 9210459 /builddir/ruby/ruby/miniruby 56642000-56941000 r-xp 00020000 fe:02 9210459 /builddir/ruby/ruby/miniruby 56941000-56b4c000 r--p 0031f000 fe:02 9210459 /builddir/ruby/ruby/miniruby 56b4c000-56b54000 r--p 0052a000 fe:02 9210459 /builddir/ruby/ruby/miniruby 56b54000-56b55000 rw-p 00532000 fe:02 9210459 /builddir/ruby/ruby/miniruby 56b55000-56b5e000 rw-p 00000000 00:00 0 58967000-58abb000 rw-p 00000000 00:00 0 [heap] f43b8000-f5a48000 r--s 00000000 fe:02 9210459 /builddir/ruby/ruby/miniruby f5a48000-f5a4b000 r--p 00000000 fe:02 11307369 /usr/lib/libgcc_s.so.1 f5a4b000-f5a79000 r-xp 00003000 fe:02 11307369 /usr/lib/libgcc_s.so.1 f5a79000-f5a7e000 r--p 00031000 fe:02 11307369 /usr/lib/libgcc_s.so.1 f5a7e000-f5a7f000 r--p 00035000 fe:02 11307369 /usr/lib/libgcc_s.so.1 f5a7f000-f5a80000 rw-p 00036000 fe:02 11307369 /usr/lib/libgcc_s.so.1 f5a80000-f5ab0000 rw-p 00000000 00:00 0 [anon:Ruby:GC:default:heap_page_body_allocate] f5abf000-f5ac0000 ---p 00000000 00:00 0 [anon:Ruby:fiber_pool_allocate_memory] f5ac0000-f5b11000 rw-p 00000000 00:00 0 [anon:Ruby:fiber_pool_allocate_memory] f5b11000-f5b12000 ---p 00000000 00:00 0 [anon:Ruby:fiber_pool_allocate_memory] f5b12000-f5b63000 rw-p 00000000 00:00 0 [anon:Ruby:fiber_pool_allocate_memory] f5b63000-f5b64000 ---p 00000000 00:00 0 [anon:Ruby:fiber_pool_allocate_memory] f5b64000-f5bb5000 rw-p 00000000 00:00 0 [anon:Ruby:fiber_pool_allocate_memory] f5bb5000-f5bb6000 ---p 00000000 00:00 0 [anon:Ruby:fiber_pool_allocate_memory] f5bb6000-f5c07000 rw-p 00000000 00:00 0 [anon:Ruby:fiber_pool_allocate_memory] f5c07000-f5c08000 ---p 00000000 00:00 0 [anon:Ruby:fiber_pool_allocate_memory] f5c08000-f5c59000 rw-p 00000000 00:00 0 [anon:Ruby:fiber_pool_allocate_memory] f5c59000-f5c5a000 ---p 00000000 00:00 0 [anon:Ruby:fiber_pool_allocate_memory] f5c5a000-f5cab000 rw-p 00000000 00:00 0 [anon:Ruby:fiber_pool_allocate_memory] f5cab000-f5cac000 ---p 00000000 00:00 0 [anon:Ruby:fiber_pool_allocate_memory] f5cac000-f5cfd000 rw-p 00000000 00:00 0 [anon:Ruby:fiber_pool_allocate_memory] f5cfd000-f5cfe000 ---p 00000000 00:00 0 [anon:Ruby:fiber_pool_allocate_memory] f5cfe000-f5d4f000 rw-p 00000000 00:00 0 [anon:Ruby:fiber_pool_allocate_memory] f5d4f000-f5d50000 ---p 00000000 00:00 0 f5d50000-f6550000 rw-p 00000000 00:00 0 f6550000-f6590000 rw-p 00000000 00:00 0 [anon:Ruby:GC:default:heap_page_body_allocate] f659f000-f759f000 rw-p 00000000 00:00 0 [anon:Ruby:Init_default_shapes:shape_cache] f759f000-f765f000 rw-p 00000000 00:00 0 [anon:Ruby:Init_default_shapes:shape_list] f765f000-f7690000 rw-p 00000000 00:00 0 f7690000-f76a0000 rw-p 00000000 00:00 0 [anon:Ruby:GC:default:heap_page_body_allocate] f76a9000-f772a000 rw-p 00000000 00:00 0 f772a000-f79a4000 r--p 00074000 fe:02 11307480 /usr/lib/locale/locale-archive f79a4000-f7ba4000 r--p 00000000 fe:02 11307480 /usr/lib/locale/locale-archive f7ba4000-f7ba6000 rw-p 00000000 00:00 0 f7ba6000-f7bc9000 r--p 00000000 fe:02 11307064 /usr/lib/libc.so.6 f7bc9000-f7d69000 r-xp 00023000 fe:02 11307064 /usr/lib/libc.so.6 f7d69000-f7dc5000 r--p 001c3000 fe:02 11307064 /usr/lib/libc.so.6 f7dc5000-f7dc7000 r--p 0021f000 fe:02 11307064 /usr/lib/libc.so.6 f7dc7000-f7dc8000 rw-p 00221000 fe:02 11307064 /usr/lib/libc.so.6 f7dc8000-f7dd2000 rw-p 00000000 00:00 0 f7dd2000-f7de0000 r--p 00000000 fe:02 11307059 /usr/lib/libm.so.6 f7de0000-f7ead000 r-xp 0000e000 fe:02 11307059 /usr/lib/libm.so.6 f7ead000-f7edf000 r--p 000db000 fe:02 11307059 /usr/lib/libm.so.6 f7edf000-f7ee0000 r--p 0010c000 fe:02 11307059 /usr/lib/libm.so.6 f7ee0000-f7ee1000 rw-p 0010d000 fe:02 11307059 /usr/lib/libm.so.6 f7ee1000-f7ee2000 r--p 00000000 fe:02 11307767 /usr/lib/libcrypt.so.2.0.0 f7ee2000-f7efe000 r-xp 00001000 fe:02 11307767 /usr/lib/libcrypt.so.2.0.0 f7efe000-f7f18000 r--p 0001d000 fe:02 11307767 /usr/lib/libcrypt.so.2.0.0 f7f18000-f7f19000 r--p 00036000 fe:02 11307767 /usr/lib/libcrypt.so.2.0.0 f7f19000-f7f1a000 rw-p 00037000 fe:02 11307767 /usr/lib/libcrypt.so.2.0.0 f7f1a000-f7f22000 rw-p 00000000 00:00 0 f7f22000-f7f24000 r--p 00000000 fe:02 11307365 /usr/lib/libz.so.1.3.1 f7f24000-f7f34000 r-xp 00002000 fe:02 11307365 /usr/lib/libz.so.1.3.1 f7f34000-f7f3a000 r--p 00012000 fe:02 11307365 /usr/lib/libz.so.1.3.1 f7f3a000-f7f3b000 r--p 00017000 fe:02 11307365 /usr/lib/libz.so.1.3.1 f7f3b000-f7f3c000 rw-p 00018000 fe:02 11307365 /usr/lib/libz.so.1.3.1 f7f41000-f7f43000 rw-p 00000000 00:00 0 f7f43000-f7f45000 r--p 00000000 00:00 0 [vvar] f7f45000-f7f47000 r--p 00000000 00:00 0 [vvar_vclock] f7f47000-f7f49000 r-xp 00000000 00:00 0 [vdso] f7f49000-f7f4a000 r--p 00000000 fe:02 11307070 /usr/lib/ld-linux.so.2 f7f4a000-f7f72000 r-xp 00001000 fe:02 11307070 /usr/lib/ld-linux.so.2 f7f72000-f7f7d000 r--p 00029000 fe:02 11307070 /usr/lib/ld-linux.so.2 f7f7d000-f7f7f000 r--p 00034000 fe:02 11307070 /usr/lib/ld-linux.so.2 f7f7f000-f7f80000 rw-p 00036000 fe:02 11307070 /usr/lib/ld-linux.so.2 ff95d000-ff97e000 rw-p 00000000 00:00 0 [stack] Segmentation fault Backtrace in gdb: Thread 1 "miniruby" received signal SIGSEGV, Segmentation fault. search_nonascii (p=<optimized out>, e=0xb3b91049 <error: Cannot access memory at address 0xb3b91049>) at string.c:729 729 if (*s & NONASCII_MASK) { (gdb) bt #0 search_nonascii (p=<optimized out>, e=0xb3b91049 <error: Cannot access memory at address 0xb3b91049>) at string.c:729 #1 0x56754d09 in coderange_scan (p=0xb3b91041 <error: Cannot access memory at address 0xb3b91041>, len=8, enc=0x56a961a0) at string.c:767 #2 0x56757715 in enc_coderange_scan (str=4122077840, enc=<optimized out>) at ./include/ruby/internal/core/rstring.h:430 #3 rb_enc_str_coderange (str=4122077840) at string.c:910 #4 0x5675845c in str_succ (str=str@entry=4122077840) at string.c:5364 #5 0x5675cf85 in rb_str_succ_bang (str=4122077840) at string.c:5380 #6 0x567b90e6 in vm_call_cfunc_with_frame_ (ec=0x56a9598c, reg_cfp=0xf77a6fd8, calling=<optimized out>, argc=0, argv=0xf7727030, stack_bottom=0xf772702c) at /builddir/ruby/ruby/vm_insnhelper.c:3794 #7 0x567c7636 in vm_call_method_each_type (ec=0x56a9598c, cfp=0xf77a6fd8, calling=0xffffd9e8) at /builddir/ruby/ruby/vm_insnhelper.c:4772 #8 0x567d2ecb in vm_sendish (ec=<optimized out>, reg_cfp=<optimized out>, cd=<optimized out>, block_handler=<optimized out>, method_explorer=<optimized out>) at /builddir/ruby/ruby/vm_callinfo.h:415 #9 vm_exec_core (ec=0xb3b91041, ec@entry=0x56a9598c) at /builddir/ruby/ruby/insns.def:898 #10 0x567c6d68 in vm_exec_loop (ec=<optimized out>, state=<optimized out>, tag=<optimized out>, result=10) at vm.c:2622 #11 rb_vm_exec (ec=0x56a9598c) at vm.c:2598 #12 0x5661e0ef in rb_ec_exec_node (ec=ec@entry=0x56a9598c, n=n@entry=0xf5b1eaf4) at eval.c:281 #13 0x56621558 in ruby_run_node (n=0xf5b1eaf4) at eval.c:319 #14 0x5657b460 in rb_main (argc=5, argv=0xffffdc34) at ./main.c:43 #15 main (argc=<optimized out>, argv=<optimized out>) at ./main.c:68 I can trigger this with "./configure CFLAGS="-O2 -g" The -O2 is important. With -flto=auto it goes away, with -O0 or -O3 too. I use gcc (GCC) 14.2.1 20250405 on Void Linux with glibc 2.41. On 64-bit x86_64 it works fine with same versions. I have bisected the issue to https://github.com/ruby/ruby/commit/14d154076876 but I don't see how this can introduce the bug. I assume it's some undefined behavior that is potentially triggered. (However reverting that patch works...) I think the behavior is related to the embedded string being expanded into a proper string, but my internal-fu isn't good enough. I hope this helps to debug the issue. -- https://bugs.ruby-lang.org/

2 3

[ruby-core:122734] [Ruby Bug#21511] Use-after-free of the execution context after the fiber object carrying it is freed in GC
by tuonigou (tianyang sun) 17 Jul '25

17 Jul '25

Issue #21511 has been reported by tuonigou (tianyang sun). ---------------------------------------- Bug #21511: Use-after-free of the execution context after the fiber object carrying it is freed in GC https://bugs.ruby-lang.org/issues/21511 * Author: tuonigou (tianyang sun) * Status: Open * ruby -v: ruby 3.4.1 (2025-06-13 revision de8de51182) +PRISM [x86_64-linux] * Backport: 3.2: UNKNOWN, 3.3: UNKNOWN, 3.4: UNKNOWN ---------------------------------------- In bootstraptest/test_thread.rb, ``` ruby assert_equal 'ok', %{ File.write("zzz_t1.rb", <<-END) begin Thread.new { fork { GC.start } }.join pid, status = Process.wait2 $result = status.success? ? :ok : :ng rescue NotImplementedError $result = :ok end END require "./zzz_t1.rb" $result } ``` ``` shell # in build/ make btest BTESTS="file_containing_above.rb" # or ruby --disable=gems "../bootstraptest/runner.rb" --ruby="./miniruby -I../lib -I. -I.ext/common -r./x86_64-linux-fake --disable-gems" file_containing_above.rb ``` Suppose **thread 1** called the `Thread.new` and created **thread 2** The forked process by thread 2 that initiates GC with `GC.start` would sweep the fiber object embedded in `RTypedData` in the `gc_sweep_rest()` stage of sweep in `fiber_free()`. That fiber object contains the execution context of thread 1, `rb_execution_context_t saved_ec` field of `cont`. Since the fiber object is freed, the allocated area pointed by it should be invalid, including the embedded struct for ec, but after thread 2 joins, thread 1 still uses the ec in rb_current_thread(), causing a use after free. -- https://bugs.ruby-lang.org/

3 9

[ruby-core:122623] [Ruby Bug#21460] Pattern matching crash: unexpected `PM_CALL_NODE`
by bendrissou (Bachir Bendrissou) 16 Jul '25

16 Jul '25

Issue #21460 has been reported by bendrissou (Bachir Bendrissou). ---------------------------------------- Bug #21460: Pattern matching crash: unexpected `PM_CALL_NODE` https://bugs.ruby-lang.org/issues/21460 * Author: bendrissou (Bachir Bendrissou) * Status: Open * ruby -v: ruby 3.5.0dev (2025-06-11 commit 970813d982) +PRISM * Backport: 3.2: UNKNOWN, 3.3: UNKNOWN, 3.4: UNKNOWN ---------------------------------------- Hi, Pattern matching crashes when using an arithmetic expression like `-1**2` in a hash pattern. Ruby attempts to process the expression as a PM_CALL_NODE, which results in a compiler crash rather than a syntax or match error. ### Input ``` foo => -1**2 ``` ### Output ``` input.rb: [BUG] Unexpected node type in pattern matching expression: PM_CALL_NODE ruby 3.5.0dev (2025-06-11T18:07:43Z master 970813d982) +PRISM [x86_64-linux] -- Control frame information ----------------------------------------------- c:0001 p:0000 s:0003 E:000720 DUMMY [FINISH] -- Threading information --------------------------------------------------- Total ractor count: 1 Ruby thread count for this ractor: 1 -- C level backtrace information ------------------------------------------- /lib/x86_64-linux-gnu/libasan.so.5(__interceptor_backtrace+0x40) [0x7f0716ea0d40] ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:4022 /home/program/build/ruby(rb_print_backtrace+0x11) [0x55d00b05dda9] ../vm_dump.c:843 /home/program/build/ruby(rb_vm_bugreport) ../vm_dump.c:1175 /home/program/build/ruby(rb_bug_without_die_internal+0xc5) [0x55d00a720b21] ../error.c:1097 /home/program/build/ruby(rb_bug) ../error.c:1115 /home/program/build/ruby(pm_compile_pattern+0x3e76) [0x55d00aee1b46] ../prism_compile.c:3171 /home/program/build/ruby(ADD_ELEM+0x0) [0x55d00aeb2793] ../prism_compile.c:8125 /home/program/build/ruby(pm_compile_match_required_node) ../prism_compile.c:8130 /home/program/build/ruby(pm_compile_node) ../prism_compile.c:9847 /home/program/build/ruby(pm_compile_node+0x529d) [0x55d00aea7bdd] ../prism_compile.c:10330 /home/program/build/ruby(pm_compile_scope_node+0x3f42) [0x55d00aeff382] ../prism_compile.c:7012 /home/program/build/ruby(pm_compile_node+0x1b50) [0x55d00aea4490] ../prism_compile.c:10201 /home/program/build/ruby(APPEND_LIST+0x0) [0x55d00af062a4] ../prism_compile.c:10502 /home/program/build/ruby(pm_iseq_compile_node) ../prism_compile.c:10506 /home/program/build/ruby(pm_iseq_new_with_opt_try+0x3e) [0x55d00a840c5e] ../iseq.c:1050 /home/program/build/ruby(rb_protect+0x30f) [0x55d00a7343ff] ../eval.c:1059 /home/program/build/ruby(pm_iseq_new_with_opt+0x482) [0x55d00a84ec12] ../iseq.c:1103 /home/program/build/ruby(pm_iseq_new_main+0xbc) [0x55d00a84f2ac] ../iseq.c:951 /home/program/build/ruby(process_options+0x2d32) [0x55d00a9eeb12] ../ruby.c:2641 /home/program/build/ruby(ruby_process_options+0x3f0) [0x55d00a9f1290] ../ruby.c:3199 /home/program/build/ruby(ruby_options+0x2a7) [0x55d00a731407] ../eval.c:117 /home/program/build/ruby(rb_main+0x19) [0x55d00a7227ff] ../main.c:42 /home/program/build/ruby(main) ../main.c:62 /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf3) [0x7f07169ec083] /home/program/build/ruby(_start) [0x55d00a723dce] -- Other runtime information ----------------------------------------------- * Loaded script: input.rb * Loaded features: 0 enumerator.so 1 thread.rb 2 fiber.so 3 rational.so 4 complex.so 5 ruby2_keywords.rb 6 set.rb Aborted ``` ### Environment Ruby version: ruby 3.5.0dev (2025-06-11 commit 970813d982) +PRISM Platform: x86_64-linux Built from source Parser backend: Prism (default) -- https://bugs.ruby-lang.org/

3 4