Issue #22333 has been reported by 0599jiangyc@gmail.com (Yuancheng Jiang). ---------------------------------------- Bug #22333: Assertion Failed: ary_resize_capa:RARRAY_LEN(ary) <= capacity https://bugs.ruby-lang.org/issues/22333 * Author: 0599jiangyc@gmail.com (Yuancheng Jiang) * Status: Open * Backport: 3.3: UNKNOWN, 3.4: UNKNOWN, 4.0: UNKNOWN ---------------------------------------- The following program: ```ruby def assert_raise(*a) = (yield rescue nil) MIN_SIZE = ENV.fetch('SMALL_ARRAY_MIN', 0).to_i MAX_SIZE = ENV.fetch('SMALL_ARRAY_MAX', 16).to_i ITERATIONS = ENV.fetch('SMALL_ARRAY_ITERATIONS', 100).to_i ARRAYS = (MIN_SIZE..MAX_SIZE).map do |size1| (MIN_SIZE..MAX_SIZE).map do |size2| end end ITERATIONS.times do ARRAYS.each do |group| group.each do |arr1, arr2| end end end assert_raise(FrozenError) { ARRAYS.instance_eval { initialize 3, 4 } } # dataflow fusion ``` makes the interpreter report: ``` ../array.c:423: Assertion Failed: ary_resize_capa:RARRAY_LEN(ary) <= capacity ruby 4.1.0dev (2026-09-15T05:36:12Z master 3296d5c99c) [x86_64-linux] -- Control frame information ----------------------------------------------- c:0007 p:---- s:0027 e:000026 l:y b:0001 r:(nil) CFUNC :initialize c:0006 p:0007 s:0021 e:000020 l:n b:---- r:(nil) BLOCK /tmp/test.rb:15 [FINISH] c:0005 p:---- s:0018 e:000017 l:y b:0001 r:(nil) CFUNC :instance_eval c:0004 p:0005 s:0014 e:000013 l:n b:---- r:(nil) BLOCK /tmp/test.rb:15 c:0003 p:0002 s:0011 e:000010 l:y b:0001 r:(nil) METHOD /tmp/test.rb:1 c:0002 p:0069 s:0006 e:000005 l:n b:---- r:(nil) EVAL /tmp/test.rb:15 [FINISH] c:0001 p:0000 s:0003 E:001ed8 l:y b:---- r:(nil) DUMMY [FINISH] -- Ruby level backtrace information ---------------------------------------- /tmp/test.rb:15:in '<main>' /tmp/test.rb:1:in 'assert_raise' /tmp/test.rb:15:in 'block in <main>' /tmp/test.rb:15:in 'instance_eval' /tmp/test.rb:15:in 'block (2 levels) in <main>' /tmp/test.rb:15:in 'initialize' -- Threading information --------------------------------------------------- Total ractor count: 1 Ruby thread count for this ractor: 1 -- C level backtrace information ------------------------------------------- /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby(___interceptor_backtrace) [0x5e65f4ed571a] /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby(rb_print_backtrace+0x14) [0x5e65f53b04ea] /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../vm_dump.c:1113 /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby(rb_vm_bugreport) /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../vm_dump.c:1479 /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby(rb_assert_failure_detail+0x233) [0x5e65f4e90b2b] /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../error.c:1258 /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby(rb_assert_failure_detail+0x0) [0x5e65f4e908f8] /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../error.c:1234 /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby(rb_assert_failure) (null):0 /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby(ary_resize_capa+0x4a5) [0x5e65f5403485] /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../array.c:423 /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby(rb_ary_initialize+0x308) [0x5e65f540f948] /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../array.c:1181 /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby(vm_call_cfunc_with_frame_+0x27b) [0x5e65f537f20b] ../vm_insnhelper.c:3904 /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby(vm_call_method_each_type+0x24a) [0x5e65f53694ba] ../vm_insnhelper.c:4896 /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby(vm_call_method+0x39f) [0x5e65f5368c4f] /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby(vm_exec_core+0x113dc) [0x5 ``` To reproduce: ``` /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby --disable-gems --parser=parse.y /tmp/test.rb ``` Commit: ``` 3296d5c99ce005e4698fb27a405e01d766ad2647 ``` Build configuration: ``` ../configure --prefix=... CC=clang-18 cflags="-fsanitize=address -fno-omit-frame-pointer -DUSE_MN_THREADS=0" cppflags="-DRUBY_DEBUG=1" optflags="-O1" ``` Operating System: ``` Ubuntu 24.04 host, Docker ffe-ruby:latest ``` *This bug was found by [fusion-fuzz](https://github.com/fusion-fuzz/fusion-fuzz)* -- https://bugs.ruby-lang.org/