November 2025 - ruby-dev - ml.ruby-lang.org

[ruby-dev:52181] [Ruby Bug#21673] Segmentation Fault in IRB when refining `Kernel#puts` using `Module#refine` (Regression since Ruby 3.4)
by yokomaru (Yoko Suzuki) 08 Dec '25

08 Dec '25

Issue #21673 has been reported by yokomaru (Yoko Suzuki). ---------------------------------------- Bug #21673: Segmentation Fault in IRB when refining `Kernel#puts` using `Module#refine` (Regression since Ruby 3.4) https://bugs.ruby-lang.org/issues/21673 * Author: yokomaru (Yoko Suzuki) * Status: Open * ruby -v: ruby 3.4.7 (2025-10-08 revision 7a5688e2a2) +PRISM [arm64-darwin24] * Backport: 3.2: UNKNOWN, 3.3: UNKNOWN, 3.4: UNKNOWN ---------------------------------------- In the IRB environment running Ruby 3.4 and later, the VM crashes with a Segmentation Fault when a module refining `Kernel#puts` is defined and `puts` is subsequently executed. The crash does not occur when the exact same code is executed as a regular Ruby script. **Environment** Reproduced on multiple environments: ``` macOS 15.5 (Apple Silicon M1, MacBook Pro) - ruby 3.4.7 (2025-10-08 revision 7a5688e2a2) +PRISM [arm64-darwin24] - ruby 3.5.0dev (2025-11-06 master cf4a034d59) +PRISM [arm64-darwin24] - irb 1.15.3 (also reproduced with 1.13.1) - Installed via rbenv ``` ``` Arch Linux (AArch64) - Linux 6.11.6-arch1-1 - ruby 3.4.7 (2025-10-08 revision 7a5688e2a2) +PRISM [x86_64-linux] - irb 1.15.3 - Installed via mise ``` This does not occur on: Ruby 3.3.10 + IRB 1.13.1 **Steps to Reproduce (Reproduction Script)** The crash reproduces with these steps (on Ruby 3.4+): 1. Start irb. ```bash $ irb ``` 2. Define the refinement module for `Kernel#puts`. ```ruby module Foo refine Kernel do def puts end end end # Explicit 'using Foo' is NOT required ``` 3. Execute `puts` at the IRB prompt. ```ruby puts # ← Segmentation Fault occurs here ``` **Expected Result** As observed in Ruby 3.3.10, the IRB session should continue to operate normally. **Actual Result (Execution Log Excerpt)** The full crash logs (for macOS and Arch Linux) and the macOS crash report are provided in the attached files. ``` $ irb irb(main):001* module Foo irb(main):002* refine Kernel do irb(main):003* def puts irb(main):004* end irb(main):005* end irb(main):006> end => #<refinement:Kernel@Foo> irb(main):007> put/Users/USER/.rbenv/versions/3.4.7/lib/ruby/gems/3.4.0/gems/irb-1.15.3/lib/irb/context.rb:636: [BUG] Segmentation fault at 0x0000000000000030 ruby 3.4.7 (2025-10-08 revision 7a5688e2a2) +PRISM [arm64-darwin24] puts -- Crash Report log information -------------------------------------------- See Crash Report log file in one of the following locations: * ~/Library/Logs/DiagnosticReports * /Library/Logs/DiagnosticReports for more details. Don't forget to include the above Crash Report log file in bug reports. -- Control frame information ----------------------------------------------- c:0049 p:---- s:0274 e:000273 CFUNC :public_method c:0048 p:---- s:0271 e:000270 CFUNC :bind_call c:0047 p:0221 s:0265 e:000264 METHOD /Users/USER/.rbenv/versions/3.4.7/lib/ruby/gems/3.4.0/gems/irb-1.15.3/lib/irb/context.rb:636 c:0046 p:0034 s:0251 e:000250 METHOD /Users/USER/.rbenv/versions/3.4.7/lib/ruby/gems/3.4.0/gems/irb-1.15.3/lib/irb/context.rb:648 c:0045 p:0010 s:0239 e:000238 BLOCK /Users/USER/.rbenv/versions/3.4.7/lib/ruby/gems/3.4.0/gems/irb-1.15.3/lib/irb/input-method.rb:277 c:0044 p:0024 s:0233 e:000232 METHOD /Users/USER/.rbenv/versions/3.4.7/lib/ruby/gems/3.4.0/gems/reline-0.6.2/lib/reline/line_editor.rb:787 <...snip...> -- Ruby level backtrace information ---------------------------------------- /Users/USER/.rbenv/versions/3.4.7/bin/irb:25:in '<main>' /Users/USER/.rbenv/versions/3.4.7/bin/irb:25:in 'load' /Users/USER/.rbenv/versions/3.4.7/lib/ruby/gems/3.4.0/gems/irb-1.15.3/exe/irb:9:in '<top (required)>' /Users/USER/.rbenv/versions/3.4.7/lib/ruby/gems/3.4.0/gems/irb-1.15.3/lib/irb.rb:54:in 'start' /Users/USER/.rbenv/versions/3.4.7/lib/ruby/gems/3.4.0/gems/irb-1.15.3/lib/irb.rb:173:in 'run' /Users/USER/.rbenv/versions/3.4.7/lib/ruby/gems/3.4.0/gems/irb-1.15.3/lib/irb.rb:173:in 'catch' /Users/USER/.rbenv/versions/3.4.7/lib/ruby/gems/3.4.0/gems/irb-1.15.3/lib/irb.rb:174:in 'block in run' /Users/USER/.rbenv/versions/3.4.7/lib/ruby/gems/3.4.0/gems/irb-1.15.3/lib/irb.rb:193:in 'eval_input' /Users/USER/.rbenv/versions/3.4.7/lib/ruby/gems/3.4.0/gems/irb-1.15.3/lib/irb.rb:278:in 'each_top_level_statement' <internal:kernel>:168:in 'loop' <...snip...> -- C level backtrace information ------------------------------------------- /Users/USER/.rbenv/versions/3.4.7/lib/libruby.3.4.dylib(rb_vm_bugreport+0xb6c) [0x102ccdaa8] /Users/USER/.rbenv/versions/3.4.7/lib/libruby.3.4.dylib(rb_bug_for_fatal_signal+0x100) [0x102b07bfc] /Users/USER/.rbenv/versions/3.4.7/lib/libruby.3.4.dylib(sigsegv+0x84) [0x102c2e2f4] /usr/lib/system/libsystem_platform.dylib(_sigtramp+0x38) [0x19e60c624] /Users/USER/.rbenv/versions/3.4.7/lib/libruby.3.4.dylib(rb_callable_method_entry_with_refinements+0xd8) [0x102caabb4] /Users/USER/.rbenv/versions/3.4.7/lib/libruby.3.4.dylib(rb_callable_method_entry_with_refinements+0xd8) [0x102caabb4] /Users/USER/.rbenv/versions/3.4.7/lib/libruby.3.4.dylib(obj_method+0x160) [0x102bcbf74] /Users/USER/.rbenv/versions/3.4.7/lib/libruby.3.4.dylib(vm_call0_body+0x35c) [0x102cc4b50] /Users/USER/.rbenv/versions/3.4.7/lib/libruby.3.4.dylib(rb_vm_call_kw+0xc4) [0x102cae300] /Users/USER/.rbenv/versions/3.4.7/lib/libruby.3.4.dylib(vm_call_cfunc_with_frame_+0xf0) [0x102cbf798] /Users/USER/.rbenv/versions/3.4.7/lib/libruby.3.4.dylib(vm_exec_core+0x46c8) [0x102ca77f0] /Users/USER/.rbenv/versions/3.4.7/lib/libruby.3.4.dylib(rb_vm_exec+0x1b4) [0x102ca1fa4] /Users/USER/.rbenv/versions/3.4.7/lib/libruby.3.4.dylib(invoke_block_from_c_bh+0x36c) [0x102cc7614] /Users/USER/.rbenv/versions/3.4.7/lib/libruby.3.4.dylib(rb_yield+0xa8) [0x102cafa54] /Users/USER/.rbenv/versions/3.4.7/lib/libruby.3.4.dylib(rb_ary_each+0x40) [0x102a5b7f8] /Users/USER/.rbenv/versions/3.4.7/lib/libruby.3.4.dylib(vm_call_cfunc_with_frame_+0xf0) [0x102cbf798] /Users/USER/.rbenv/versions/3.4.7/lib/libruby.3.4.dylib(vm_exec_core+0x2620) [0x102ca5748] /Users/USER/.rbenv/versions/3.4.7/lib/libruby.3.4.dylib(rb_vm_exec+0x1b4) [0x102ca1fa4] /Users/USER/.rbenv/versions/3.4.7/lib/libruby.3.4.dylib(invoke_block_from_c_bh+0x36c) [0x102cc7614] /Users/USER/.rbenv/versions/3.4.7/lib/libruby.3.4.dylib(rb_yield+0xa8) [0x102cafa54] /Users/USER/.rbenv/versions/3.4.7/lib/libruby.3.4.dylib(rb_protect+0xb0) [0x102b13918] /Users/USER/.rbenv/versions/3.4.7/lib/ruby/3.4.0/arm64-darwin24/io/console.bundle(ttymode+0x1e0) [0x102462ab4] /Users/USER/.rbenv/versions/3.4.7/lib/ruby/3.4.0/arm64-darwin24/io/console.bundle(ttymode) (null):0 /Users/USER/.rbenv/versions/3.4.7/lib/ruby/3.4.0/arm64-darwin24/io/console.bundle(console_raw+0x40) [0x102460ca0] /Users/USER/.rbenv/versions/3.4.7/lib/libruby.3.4.dylib(vm_call_cfunc_with_frame_+0xf0) [0x102cbf798] /Users/USER/.rbenv/versions/3.4.7/lib/libruby.3.4.dylib(vm_exec_core+0x2620) [0x102ca5748] /Users/USER/.rbenv/versions/3.4.7/lib/libruby.3.4.dylib(rb_vm_exec+0x134) [0x102ca1f24] /Users/USER/.rbenv/versions/3.4.7/lib/libruby.3.4.dylib(invoke_block_from_c_bh+0x36c) [0x102cc7614] /Users/USER/.rbenv/versions/3.4.7/lib/libruby.3.4.dylib(rb_yield+0xa8) [0x102cafa54] /Users/USER/.rbenv/versions/3.4.7/lib/libruby.3.4.dylib(rb_ensure+0xac) [0x102b13a70] /Users/USER/.rbenv/versions/3.4.7/lib/libruby.3.4.dylib(vm_call_cfunc_with_frame_+0xf0) [0x102cbf798] /Users/USER/.rbenv/versions/3.4.7/lib/libruby.3.4.dylib(vm_exec_core+0x2620) [0x102ca5748] /Users/USER/.rbenv/versions/3.4.7/lib/libruby.3.4.dylib(rb_vm_exec+0x134) [0x102ca1f24] /Users/USER/.rbenv/versions/3.4.7/lib/libruby.3.4.dylib(invoke_block_from_c_bh+0x36c) [0x102cc7614] /Users/USER/.rbenv/versions/3.4.7/lib/libruby.3.4.dylib(catch_i+0x6c) [0x102cc6d50] /Users/USER/.rbenv/versions/3.4.7/lib/libruby.3.4.dylib(vm_catch_protect+0xbc) [0x102cb1b70] /Users/USER/.rbenv/versions/3.4.7/lib/libruby.3.4.dylib(rb_f_catch+0x70) [0x102cb2560] /Users/USER/.rbenv/versions/3.4.7/lib/libruby.3.4.dylib(vm_call_cfunc_with_frame_+0xf0) [0x102cbf798] /Users/USER/.rbenv/versions/3.4.7/lib/libruby.3.4.dylib(vm_exec_core+0x2620) [0x102ca5748] /Users/USER/.rbenv/versions/3.4.7/lib/libruby.3.4.dylib(rb_vm_exec+0x1b4) [0x102ca1fa4] /Users/USER/.rbenv/versions/3.4.7/lib/libruby.3.4.dylib(load_iseq_eval+0x224) [0x102b73b50] /Users/USER/.rbenv/versions/3.4.7/lib/libruby.3.4.dylib(rb_load_internal+0x84) [0x102b70e8c] /Users/USER/.rbenv/versions/3.4.7/lib/libruby.3.4.dylib(rb_f_load+0x8c) [0x102b72aa0] /Users/USER/.rbenv/versions/3.4.7/lib/libruby.3.4.dylib(vm_call_cfunc_with_frame_+0xf0) [0x102cbf798] /Users/USER/.rbenv/versions/3.4.7/lib/libruby.3.4.dylib(vm_exec_core+0x46c8) [0x102ca77f0] /Users/USER/.rbenv/versions/3.4.7/lib/libruby.3.4.dylib(rb_vm_exec+0x134) [0x102ca1f24] /Users/USER/.rbenv/versions/3.4.7/lib/libruby.3.4.dylib(rb_ec_exec_node+0x8c) [0x102b12c14] /Users/USER/.rbenv/versions/3.4.7/lib/libruby.3.4.dylib(ruby_run_node+0x40) [0x102b12b3c] /Users/USER/.rbenv/versions/3.4.7/bin/ruby(main+0x68) [0x1022c0618] ``` ---Files-------------------------------- backtrace_ruby-3.4.7_macos.txt (111 KB) backtrace_ruby-3.4.7_archlinux.txt (90.4 KB) macos_crash_report_ruby-3.4.7.ips.txt (31.4 KB) -- https://bugs.ruby-lang.org/

5 6

[ruby-dev:52176] [Ruby Bug#21666] Math.lgamma(-1).should == [infinity_value, 1] fails with Fedora glibc-2.42.9000-8.fc44
by mtasaka (Mamoru TASAKA) 08 Dec '25

08 Dec '25

Issue #21666 has been reported by mtasaka (Mamoru TASAKA). ---------------------------------------- Bug #21666: Math.lgamma(-1).should == [infinity_value, 1] fails with Fedora glibc-2.42.9000-8.fc44 https://bugs.ruby-lang.org/issues/21666 * Author: mtasaka (Mamoru TASAKA) * Status: Open * ruby -v: ruby 3.5.0dev (2025-11-04 master 55257b5038) +PRISM [x86_64-linux] * Backport: 3.2: UNKNOWN, 3.3: UNKNOWN, 3.4: UNKNOWN ---------------------------------------- With Fedora glibc-2.42.9000-8.fc44 the following test: https://github.com/ruby/ruby/blob/cdcb490d2bceb4ff8d6fce349047a2b722e6ae87/… fails like ``` 1) Math.lgamma returns [Infinity, 1] when passed -1 FAILED Expected [Infinity, -1] == [Infinity, 1] to be truthy but was false /builddir/build/BUILD/ruby-3.5.0_20251103.2332git4001e81a8e-build/ruby-3.5.0-4001e81a8e/spec/ruby/core/math/lgamma_spec.rb:10:in 'block (3 levels) in <top (required)>' /builddir/build/BUILD/ruby-3.5.0_20251103.2332git4001e81a8e-build/ruby-3.5.0-4001e81a8e/spec/ruby/core/math/lgamma_spec.rb:3:in '<top (required)>' ``` (With the help from glibc developer: https://bugzilla.redhat.com/show_bug.cgi?id=2412227 ) POSIX.1-2024 says (ref: https://pubs.opengroup.org/onlinepubs/9799919799/functions/lgamma.html ) > If $x$ is a non-positive integer, a pole error shall occur and > lgamma(), lgammaf(), and lgammal() shall return +HUGE_VAL, +HUGE_VALF, and +HUGE_VALL, respectively. but also says: > The sign of $ \Gamma(x) $ shall be returned in the external integer signgam. > If $x$ is NaN, -Inf, or a negative integer, the value of signgam is **unspecified**.` So on this line: https://github.com/ruby/ruby/blob/cdcb490d2bceb4ff8d6fce349047a2b722e6ae87/… when `d` is -1 (or negative integer), the value of `sign` is unspeficied. -- https://bugs.ruby-lang.org/

4 6

[ruby-dev:52175] [Ruby Bug#21663] IO#pos will corrupt the file position in specific situation.
by t_nagaya (Tsutomu Nagaya) 02 Nov '25

02 Nov '25

Issue #21663 has been reported by t_nagaya (Tsutomu Nagaya). ---------------------------------------- Bug #21663: IO#pos will corrupt the file position in specific situation. https://bugs.ruby-lang.org/issues/21663 * Author: t_nagaya (Tsutomu Nagaya) * Status: Open * ruby -v: ruby 3.2.3 (2024-01-18 revision 52bb2ac0a6) [x64-mingw-ucrt] * Backport: 3.2: UNKNOWN, 3.3: UNKNOWN, 3.4: UNKNOWN ---------------------------------------- `IO#pos` and `IO#tell` will corrupt the file position in the following situation. ### Situation: - Running on Windows. (`RUBY_CRLF_ENVIRONMENT` is defined.) - The filesize is over 0x100000000 bytes. - The file is opened in text mode. - There are several `CRLF`s written around 0x100000000. - Some read operations to fill internal buffer (`rbuf`) has been performed. - The real file position (associated with the file descriptor) is somewhat greater than 0x100000000. ### Code to reproduce: ```ruby file = "./test_file" # Prepare a test file f = File.open(file, "wb:binary") f.truncate(0x100000000) f.pos = f.size - 13 f.puts("0123456789\r\n9876543210\r\n" * 10) f.close # Operations to reproduce f = File.open(file, "r:utf-8") f.seek(0x100000000 - 13) puts "%#x" % f.pos p f.gets puts "%#x" % f.pos p f.gets puts "%#x" % f.pos f.close ``` ### Actual result: ``` 0xfffffff3 "0123456789\n" 0x100000012 "789\n" 0x100000017 ``` ### Expected result: ``` 0xfffffff3 "0123456789\n" 0xffffffff "9876543210\n" 0x10000000b ``` ### Notes: Currently, io.c has the following code. In the above situation, `extra_max` may be set to 0 or a small integer value by casting it as the type `long` (assumed 4 bytes). So `newlines` is set lower than the actual count, the file does not seek back correctly. ```c /* * IO unread with taking care of removed '\r' in text mode. */ static void io_unread(rb_io_t *fptr, bool discard_rbuf) { rb_off_t r, pos; ssize_t read_size; long i; long newlines = 0; long extra_max; char *p; char *buf; rb_io_check_closed(fptr); if (fptr->rbuf.len == 0 || fptr->mode & FMODE_DUPLEX) { return; } errno = 0; if (!rb_w32_fd_is_text(fptr->fd)) { r = lseek(fptr->fd, -fptr->rbuf.len, SEEK_CUR); if (r < 0 && errno) { if (errno == ESPIPE) fptr->mode |= FMODE_DUPLEX; if (!discard_rbuf) return; } goto end; } pos = lseek(fptr->fd, 0, SEEK_CUR); if (pos < 0 && errno) { if (errno == ESPIPE) fptr->mode |= FMODE_DUPLEX; if (!discard_rbuf) goto end; } /* add extra offset for removed '\r' in rbuf */ extra_max = (long)(pos - fptr->rbuf.len); p = fptr->rbuf.ptr + fptr->rbuf.off; /* if the end of rbuf is '\r', rbuf doesn't have '\r' within rbuf.len */ if (*(fptr->rbuf.ptr + fptr->rbuf.capa - 1) == '\r') { newlines++; } for (i = 0; i < fptr->rbuf.len; i++) { if (*p == '\n') newlines++; if (extra_max == newlines) break; p++; } buf = ALLOC_N(char, fptr->rbuf.len + newlines); while (newlines >= 0) { r = lseek(fptr->fd, pos - fptr->rbuf.len - newlines, SEEK_SET); if (newlines == 0) break; if (r < 0) { newlines--; continue; } read_size = _read(fptr->fd, buf, fptr->rbuf.len + newlines); if (read_size < 0) { int e = errno; free(buf); rb_syserr_fail_path(e, fptr->pathv); } if (read_size == fptr->rbuf.len) { lseek(fptr->fd, r, SEEK_SET); break; } else { newlines--; } } free(buf); end: fptr->rbuf.off = 0; fptr->rbuf.len = 0; clear_codeconv(fptr); return; } ``` -- https://bugs.ruby-lang.org/

1 0