Bug #22321: Assertion Failed: rb_vm_search_method_slowpath:RB_TYPE_2_P(klass, RUBY_T_CLASS, RUBY_T_ICLASS): klass: T_MODULE

• Status: Closed
• Assignee: -
• Target version: -
• Backport: 3.3: WONTFIX, 3.4: DONE, 4.0: REQUIRED

[[e-mail] (Yuancheng Jiang)]

The following program:

def assert_equal(*a) = nil
bug15629_m1 = Module.new do
  def foo; end
end
bug15629_m2 = Module.new do
  def foo; end
end
bug15629_c = Class.new do
  include bug15629_m1
  include bug15629_m2
end
o  = bug15629_c.new
m = o.method(:foo)
sm = m.super_method
assert_equal(sm, m.unbind.bind(o).super_method)
begin ObjectSpace.each_object(sm.class).first(50).each(&:inspect); GC.start(full_mark: true, immediate_sweep: true); Marshal.load(Marshal.dump(sm)); rescue Exception; end  # dataflow fusion

makes the interpreter report:

../vm_insnhelper.c:2264: Assertion Failed: rb_vm_search_method_slowpath:RB_TYPE_2_P(klass, RUBY_T_CLASS, RUBY_T_ICLASS): klass: T_MODULE
ruby 4.1.0dev (2026-09-15T05:36:12Z master 3296d5c99c) [x86_64-linux]

-- Control frame information -----------------------------------------------
c:0004 p:---- s:0019 e:000018 l:y b:0001 r:(nil) CFUNC  :inspect
c:0003 p:---- s:0016 e:000015 l:y b:0001 r:(nil) CFUNC  :each
c:0002 p:0087 s:0012 E:001198 l:n b:---- r:(nil) EVAL   /tmp/test.rb:16 [FINISH]
c:0001 p:0000 s:0003 E:001ed8 l:y b:---- r:(nil) DUMMY  [FINISH]

-- Ruby level backtrace information ----------------------------------------
/tmp/test.rb:16:in '<main>'
/tmp/test.rb:16:in 'each'
/tmp/test.rb:16:in 'inspect'

-- Threading information ---------------------------------------------------
Total ractor count: 1
Ruby thread count for this ractor: 1

-- C level backtrace information -------------------------------------------
/home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby(___interceptor_backtrace) [0x56e7d13b671a]
/home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby(rb_print_backtrace+0x14) [0x56e7d18914ea] /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../vm_dump.c:1113
/home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby(rb_vm_bugreport) /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../vm_dump.c:1479
/home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby(rb_assert_failure_detail+0x233) [0x56e7d1371b2b] /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../error.c:1258
/home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby(rb_vm_search_method_slowpath+0x558) [0x56e7d17f1478]
/home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby(vm_search_method_slowpath0+0x32) [0x56e7d17f2ca2] ../vm_insnhelper.c:2295
/home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby(gccct_method_search_slowpath+0x4d) [0x56e7d184980d] ../vm_eval.c:419
/home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby(rb_funcallv_scope+0x1a4) [0x56e7d18280c4] ../vm_eval.c:1064
/home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby(rb_inspect+0x15) [0x56e7d15a2335] /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../object.c:733
/home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby(method_inspect+0x52b) [0x56e7d15c81ab] /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../proc.c:4101
/home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby(vm_call0_body+0x100a) [0x56e7d18759ba] ../vm_eval.c:164
/home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby(rb_call0+0x4c5) [0x56e7d1878705] ../vm_eval.c:101
/home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby(rb_funcall_with_block_kw+0x14d) [0x56e7d1829b7d] ../vm_eval.c:896
/home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby(vm_yield_with_symbol+0x1ff) [0x56e7d187ce8f] ../vm_insnhelper.c:5291
/home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/b

To reproduce:

/home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby --disable-gems --parser=parse.y /tmp/test.rb

Commit:

3296d5c99ce005e4698fb27a405e01d766ad2647

Build configuration:

../configure --prefix=... CC=clang-18 cflags="-fsanitize=address -fno-omit-frame-pointer -DUSE_MN_THREADS=0" cppflags="-DRUBY_DEBUG=1" optflags="-O1"

Operating System:

Ubuntu 24.04 host, Docker ffe-ruby:latest

This bug was found by fusion-fuzz

[peterzhu2118 (Peter Zhu)]

Thank you for the report, I have a fix here.

[peterzhu2118 (Peter Zhu)]

• Backport changed from 3.3: UNKNOWN, 3.4: UNKNOWN, 4.0: UNKNOWN to 3.3: WONTFIX, 3.4: REQUIRED, 4.0: REQUIRED

[peterzhu2118 (Peter Zhu)]

• Status changed from Open to Closed

Applied in changeset git|d38952c45e27becbe160f832aea823546899ad2e.

---

Fix Method#inspect when klass is iclass

[Bug #22321]

In the following script, the klass of the Method object is an iclass, which
will raise an error "NoMethodError: undefined method 'inspect' for an instance of M":

module M
  def foo = 1
end

class C
  include M
end

obj = C.new
meth = obj.method(:foo).unbind.bind(obj)
puts meth.inspect

[nagachika (Tomoyuki Chikanaga)]

• Backport changed from 3.3: WONTFIX, 3.4: REQUIRED, 4.0: REQUIRED to 3.3: WONTFIX, 3.4: DONE, 4.0: REQUIRED

ruby_3_4 9bfc30e701db71c3bfec531422ebea7e2c1cdfb5 merged revision(s) d38952c45e27becbe160f832aea823546899ad2e.