Actions
Bug #22333
closed
Assertion Failed: ary_resize_capa:RARRAY_LEN(ary) <= capacity
Bug #22333:
Assertion Failed: ary_resize_capa:RARRAY_LEN(ary) <= capacity
Description
The following program:
def assert_raise(*a) = (yield rescue nil)
MIN_SIZE = ENV.fetch('SMALL_ARRAY_MIN', 0).to_i
MAX_SIZE = ENV.fetch('SMALL_ARRAY_MAX', 16).to_i
ITERATIONS = ENV.fetch('SMALL_ARRAY_ITERATIONS', 100).to_i
ARRAYS = (MIN_SIZE..MAX_SIZE).map do |size1|
(MIN_SIZE..MAX_SIZE).map do |size2|
end
end
ITERATIONS.times do
ARRAYS.each do |group|
group.each do |arr1, arr2|
end
end
end
assert_raise(FrozenError) { ARRAYS.instance_eval { initialize 3, 4 } } # dataflow fusion
makes the interpreter report:
../array.c:423: Assertion Failed: ary_resize_capa:RARRAY_LEN(ary) <= capacity
ruby 4.1.0dev (2026-09-15T05:36:12Z master 3296d5c99c) [x86_64-linux]
-- Control frame information -----------------------------------------------
c:0007 p:---- s:0027 e:000026 l:y b:0001 r:(nil) CFUNC :initialize
c:0006 p:0007 s:0021 e:000020 l:n b:---- r:(nil) BLOCK /tmp/test.rb:15 [FINISH]
c:0005 p:---- s:0018 e:000017 l:y b:0001 r:(nil) CFUNC :instance_eval
c:0004 p:0005 s:0014 e:000013 l:n b:---- r:(nil) BLOCK /tmp/test.rb:15
c:0003 p:0002 s:0011 e:000010 l:y b:0001 r:(nil) METHOD /tmp/test.rb:1
c:0002 p:0069 s:0006 e:000005 l:n b:---- r:(nil) EVAL /tmp/test.rb:15 [FINISH]
c:0001 p:0000 s:0003 E:001ed8 l:y b:---- r:(nil) DUMMY [FINISH]
-- Ruby level backtrace information ----------------------------------------
/tmp/test.rb:15:in '<main>'
/tmp/test.rb:1:in 'assert_raise'
/tmp/test.rb:15:in 'block in <main>'
/tmp/test.rb:15:in 'instance_eval'
/tmp/test.rb:15:in 'block (2 levels) in <main>'
/tmp/test.rb:15:in 'initialize'
-- Threading information ---------------------------------------------------
Total ractor count: 1
Ruby thread count for this ractor: 1
-- C level backtrace information -------------------------------------------
/home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby(___interceptor_backtrace) [0x5e65f4ed571a]
/home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby(rb_print_backtrace+0x14) [0x5e65f53b04ea] /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../vm_dump.c:1113
/home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby(rb_vm_bugreport) /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../vm_dump.c:1479
/home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby(rb_assert_failure_detail+0x233) [0x5e65f4e90b2b] /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../error.c:1258
/home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby(rb_assert_failure_detail+0x0) [0x5e65f4e908f8] /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../error.c:1234
/home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby(rb_assert_failure) (null):0
/home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby(ary_resize_capa+0x4a5) [0x5e65f5403485] /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../array.c:423
/home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby(rb_ary_initialize+0x308) [0x5e65f540f948] /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../array.c:1181
/home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby(vm_call_cfunc_with_frame_+0x27b) [0x5e65f537f20b] ../vm_insnhelper.c:3904
/home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby(vm_call_method_each_type+0x24a) [0x5e65f53694ba] ../vm_insnhelper.c:4896
/home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby(vm_call_method+0x39f) [0x5e65f5368c4f]
/home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby(vm_exec_core+0x113dc) [0x5
To reproduce:
/home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby --disable-gems --parser=parse.y /tmp/test.rb
Commit:
Build configuration:
../configure --prefix=... CC=clang-18 cflags="-fsanitize=address -fno-omit-frame-pointer -DUSE_MN_THREADS=0" cppflags="-DRUBY_DEBUG=1" optflags="-O1"
Operating System:
This bug was found by fusion-fuzz
Updated by
Actions