Bug #22009: ERROR: AddressSanitizer: attempting to call malloc_usable_size() for pointer which is not owned: with ASAN and DEBUG enabled build

• Status: Closed
• Assignee: -
• Target version: -
• Backport: 3.3: UNKNOWN, 3.4: UNKNOWN, 4.0: UNKNOWN

[yahonda (Yasuo Honda)]

Background

I am using ruby-head built and deployed by https://github.com/ruby/ruby-dev-builder for my repository.
https://github.com/rsim/oracle-enhanced/blob/master/.github/workflows/ruby_head.yml

Recently, the ruby-head version has not been updated since ruby 4.1.0dev (2026-03-29T05:57:51Z :detached: f9175a9e5f) +PRISM [aarch64-linux].

According to the ruby-dev-builder log file:

• The last successful build : https://github.com/ruby/ruby-dev-builder/actions/runs/23716940676
• The first failing build :https://github.com/ruby/ruby-dev-builder/actions/runs/23763490942
• The latest failing build : https://github.com/ruby/ruby-dev-builder/actions/runs/24686105004

Steps to reproduce

mkdir work
cd work
git clone https://github.com/ruby/ruby.git
git clone https://github.com/ruby/ruby-dev-builder.git

cd ruby

../ruby-dev-builder/asan_libs.rb \
  --prefix=$HOME/.rubies/ruby-asan \
  --cc=clang \
  --cflags='-fsanitize=address -fno-omit-frame-pointer -ggdb3 -O3' \
  --ldflags="-Wl,-rpath=$HOME/.rubies/ruby-asan/lib" \
  --makeopts=-j4

export cppflags="-DENABLE_PATH_CHECK=0 -DRUBY_DEBUG=1 -DVM_CHECK_MODE=1 -DUSE_MN_THREADS=0"
export optflags="-O3 -fno-omit-frame-pointer"
export debugflags="-fsanitize=address -ggdb3"
export CC=clang
export cflags="-I$HOME/.rubies/ruby-asan/include"
export LDFLAGS="-L$HOME/.rubies/ruby-asan/lib -Wl,-rpath=$HOME/.rubies/ruby-asan/lib"
export RUBY_TEST_TIMEOUT_SCALE=5

./autogen.sh
./configure --prefix=$HOME/.rubies/ruby-asan --enable-shared --disable-install-doc --enable-yjit
make -j4 && make install
make test-spec MSPECOPT="spec/ruby/library/objectspace/dump_all_spec.rb" 2>&1 | tee error.log

Expected behavior

This spec should pass.

Actual behavior

It raises ERROR: AddressSanitizer: attempting to call malloc_usable_size() for pointer which is not owned:

[yahonda (Yasuo Honda)]

• File error.log error.log added

Here is the entire log generated by make test-spec MSPECOPT="spec/ruby/library/objectspace/dump_all_spec.rb" 2>&1 | tee error.log

[yahonda (Yasuo Honda)]

With Claude Code help, It only reproduces with both ASAN and DEBUG options enabled. But not sure if this is the right fix though.

https://github.com/ruby/ruby/commit/e47063e5bc52929924b633cffed33fc9132030c4

[jhawthorn (John Hawthorn)]

• Assignee set to jhawthorn (John Hawthorn)

That makes sense that this crashes. We're allowing the GC to provide xmalloc and xfree, and in Ruby 4.1dev under debug that has additional padding. We should have an xmalloc equivalent of malloc_usable_size (at least in the one place we use it)

[jhawthorn (John Hawthorn)]

• Status changed from Open to Closed
• Assignee deleted (jhawthorn (John Hawthorn))

Oh! Looks like this was already fixed by https://github.com/ruby/ruby/pull/16792