March 2026 - ruby-dev - ml.ruby-lang.org

[ruby-dev:52204] [Ruby Bug#21933] Ruby::Box: named capture local variable can become nil after non-matching lines
by katsyoshi (Katsuyoshi MATSUMOTO) 02 Apr '26

02 Apr '26

Issue #21933 has been reported by katsyoshi (Katsuyoshi MATSUMOTO). ---------------------------------------- Bug #21933: Ruby::Box: named capture local variable can become nil after non-matching lines https://bugs.ruby-lang.org/issues/21933 * Author: katsyoshi (Katsuyoshi MATSUMOTO) * Status: Open * ruby -v: 4.0.1 * Backport: 3.2: UNKNOWN, 3.3: UNKNOWN, 3.4: UNKNOWN, 4.0: UNKNOWN ---------------------------------------- Environment: - Ruby 4.0.1 - RUBY_BOX=1 - OS: Linux x86_64 Summary: With Ruby::Box enabled, a named capture local variable from `=~` may become nil, even when the regexp matches. This happens after iterating over non-matching lines first. Reproducer: sample.rb ``` ruby text = <<~ASM .intel_syntax noprefix .globl main main: nop ASM cur=nil text.each_line do |line| if /^(?<label>[_A-Za-z.]\w*):/ =~ line p [:matched, line.inspect, label.inspect] cur = label break end end p [:cur, cur.inspect] ``` ``` shell Expected: [:matched, "\"main:\\n\"", "\"main\""] [:cur, "\"main\""] ``` Actual (with RUBY_BOX=1): ``` shell [:matched, "\"main:\\n\"", "nil"] [:cur, "nil"] ``` Control: Without RUBY_BOX=1, the same script returns "main" as expected. -- https://bugs.ruby-lang.org/

3 2

[ruby-dev:52206] [Ruby Bug#21952] Ruby::Box double free at process exit when `fiddle/import` is required in multiple boxes
by katsyoshi (Katsuyoshi MATSUMOTO) 29 Mar '26

29 Mar '26

Issue #21952 has been reported by katsyoshi (Katsuyoshi MATSUMOTO). ---------------------------------------- Bug #21952: Ruby::Box double free at process exit when `fiddle/import` is required in multiple boxes https://bugs.ruby-lang.org/issues/21952 * Author: katsyoshi (Katsuyoshi MATSUMOTO) * Status: Open * ruby -v: ruby 4.0.1 (2026-01-13 revision e04267a14b) +PRISM [x86_64-linux] * Backport: 3.2: UNKNOWN, 3.3: UNKNOWN, 3.4: UNKNOWN, 4.0: UNKNOWN ---------------------------------------- I found what looks like a separate `Ruby::Box` bug from the existing `require` and `LoadError` issues such as `#21760`. This is not a `LoadError` case. I was able to reduce it to a reproducer where requiring `fiddle/import` from multiple boxes causes Ruby to abort at process exit with a double free. Environment: - ruby 4.0.1 (2026-01-13 revision e04267a14b) +PRISM [x86_64-linux] - Linux x86_64 - `RUBY_BOX=1` ## Reproducer Create `/tmp/fiddle_require.rb`: ```ruby require "rubygems" $:.unshift(*Gem::Specification.find_by_name("fiddle").full_require_paths) require "fiddle/import" ``` Then run: ```sh RUBY_BOX=1 ruby -e 'b1 = Ruby::Box.new; b1.require("/tmp/fiddle_require.rb"); b2 = Ruby::Box.new; b2.require("/tmp/fiddle_require.rb")' ``` ## Expected behavior Both `Ruby::Box#require` calls succeed, and Ruby exits normally. ## Actual behavior Ruby aborts at process exit with: ```text free(): double free detected in tcache 2 [BUG] Aborted ``` The C backtrace points into Ruby's `Ruby::Box` cleanup path, including: - `free_classext_for_box` - `cleanup_all_local_extensions` - `box_entry_free` - `rb_class_classext_free` - `cvar_table_free_i` - `ruby_sized_xfree` ## ASAN I also rebuilt Ruby with AddressSanitizer and reran the same reproducer. ASAN reports: - `AddressSanitizer: attempting to call malloc_usable_size() for pointer which is not owned` - the pointer was originally allocated by `rb_cvar_set` - it was then freed once via `cvar_table_free_i` - and later reached the same `cvar_table_free_i` cleanup path again through `free_classext_for_box` and `box_entry_free` This makes it look like a class-variable-related allocation created while loading `fiddle/import` is being freed twice during `Ruby::Box` cleanup. ## Notes - I first noticed this while testing `fiddle` together with shared libraries, but shared library loading is not required for the crash. - `dlload` is not necessary. - Reusing the same Ruby module name is not necessary. - As a control case, one box requiring `fiddle/import` and another box requiring a plain Ruby file exits normally. - The explicit `$:` adjustment above is only there to avoid the separate `Ruby::Box#require` issue where `require "fiddle/import"` may otherwise fail with `LoadError` under `RUBY_BOX=1`. So this seems to be a separate crash bug in `Ruby::Box` cleanup triggered by loading `fiddle/import` in multiple boxes. ---Files-------------------------------- asan-sample.txt (13.7 KB) -- https://bugs.ruby-lang.org/

2 1

[ruby-dev:52196] [Ruby Feature#21857] Introduce to_proc pattern
by sanfrecce-osaka (Masatoshi Moritsuka) 21 Mar '26

21 Mar '26

Issue #21857 has been reported by sanfrecce-osaka (Masatoshi Moritsuka). ---------------------------------------- Feature #21857: Introduce to_proc pattern https://bugs.ruby-lang.org/issues/21857 * Author: sanfrecce-osaka (Masatoshi Moritsuka) * Status: Open ---------------------------------------- When object has some logics, we can use `&object` syntax with Enumerable or Array, etc. ```ruby users.any?(&:admin?) ``` There are some times when I want to write pattern matching similar to the syntax, but currently we either have to write proc or combine pin operator with `to_proc`, which is a bit verbose. ```ruby users in [*, ^(:admin?.to_proc), *] users in [*, -> (user) { user.admin? }, *] ``` Therefore, I propose introducing a new pattern into pattern matching. The pattern matches an object such that `pattern.to_proc === object`. This allows us to write code with a familiarity close to the syntax we're accustomed to. ```ruby users in [*, &:admin?, *] ``` -- https://bugs.ruby-lang.org/

2 2