Bug #22341: Class#superclass can crash the interpreter in debug build

• Status: Open
• Assignee: -
• Target version: -
• Backport: 3.3: UNKNOWN, 3.4: UNKNOWN, 4.0: UNKNOWN

[tekknolagi (Maxwell Bernstein)]

While implementing this in ZJIT, @nirvdrum (Kevin Menard) reported, and I investigated, a potential interpreter crash:

module M; end
C = Class.allocate
C.include M
C.superclass

In a debug build, this crashes:

plum% ./build-dev/miniruby crash.rb
../object.c:2398: Assertion Failed: rb_class_superclass:!RCLASS_SUPER(klass)
ruby 4.1.0dev (2026-09-22T14:09:58Z mb-class-superclass 05c0248e3a) +PRISM [arm64-darwin25]

-- Crash Report log information --------------------------------------------
   See Crash Report log file in one of the following locations:
     * ~/Library/Logs/DiagnosticReports
     * /Library/Logs/DiagnosticReports
   for more details.
Don't forget to include the above Crash Report log file in bug reports.

-- Control frame information -----------------------------------------------
c:0003 p:---- s:0010 e:000009 l:y b:0001 r:0x0 CFUNC  :superclass
c:0002 p:0027 s:0006 e:000005 l:n b:---- r:0x0 EVAL   crash.rb:4 [FINISH]
c:0001 p:0000 s:0003 E:001fc8 l:y b:---- r:0x0 DUMMY  [FINISH]

-- Ruby level backtrace information ----------------------------------------
crash.rb:4:in '<main>'
crash.rb:4:in 'superclass'

-- Threading information ---------------------------------------------------
Total ractor count: 1
Ruby thread count for this ractor: 1

-- C level backtrace information -------------------------------------------
/Users/emacs/Documents/code/ruby/build-dev/miniruby(rb_print_backtrace+0x24) [0x100b210c4] /Users/emacs/Documents/code/ruby/build-dev/../vm_dump.c:1113
/Users/emacs/Documents/code/ruby/build-dev/miniruby(rb_print_backtrace) (null):0
/Users/emacs/Documents/code/ruby/build-dev/miniruby(rb_vm_bugreport+0x3ac) [0x100b21490] /Users/emacs/Documents/code/ruby/build-dev/../vm_dump.c:1479
/Users/emacs/Documents/code/ruby/build-dev/miniruby(rb_assert_failure_detail+0x138) [0x10079c6b4] /Users/emacs/Documents/code/ruby/build-dev/../error.c:1258
/Users/emacs/Documents/code/ruby/build-dev/miniruby(rb_assert_failure_detail+0x0) [0x10079c57c] /Users/emacs/Documents/code/ruby/build-dev/../error.c:1234
/Users/emacs/Documents/code/ruby/build-dev/miniruby(rb_assert_failure) (null):0
/Users/emacs/Documents/code/ruby/build-dev/miniruby(rb_class_superclass+0x254) [0x1008b1d18] /Users/emacs/Documents/code/ruby/build-dev/../object.c:2398
/Users/emacs/Documents/code/ruby/build-dev/miniruby(ractor_safe_call_cfunc_0+0x30) [0x100b0a8bc] ../vm_insnhelper.c:3720
/Users/emacs/Documents/code/ruby/build-dev/miniruby(vm_call_cfunc_with_frame_+0x290) [0x100af8900] ../vm_insnhelper.c:3904
/Users/emacs/Documents/code/ruby/build-dev/miniruby(vm_call_cfunc_with_frame+0x6c) [0x100af8bfc] ../vm_insnhelper.c:3950
/Users/emacs/Documents/code/ruby/build-dev/miniruby(vm_call_cfunc_other+0x38c) [0x100af84d0] ../vm_insnhelper.c:3976
/Users/emacs/Documents/code/ruby/build-dev/miniruby(vm_call_cfunc+0x128) [0x100aede50] ../vm_insnhelper.c:4058
/Users/emacs/Documents/code/ruby/build-dev/miniruby(vm_call_method_each_type+0x200) [0x100aecf90] ../vm_insnhelper.c:4896
/Users/emacs/Documents/code/ruby/build-dev/miniruby(vm_call_method+0xe8) [0x100aecba4] ../vm_insnhelper.c:5022
/Users/emacs/Documents/code/ruby/build-dev/miniruby(vm_call_general+0x28) [0x100a9b1f8] ../vm_insnhelper.c:5066
/Users/emacs/Documents/code/ruby/build-dev/miniruby(vm_sendish+0x708) [0x100ab4424] ../vm_insnhelper.c:6283
/Users/emacs/Documents/code/ruby/build-dev/miniruby(vm_exec_core) ../insns.def:911
/Users/emacs/Documents/code/ruby/build-dev/miniruby(rb_vm_exec+0x118) [0x100a9c92c] /Users/emacs/Documents/code/ruby/build-dev/../vm.c:2901
/Users/emacs/Documents/code/ruby/build-dev/miniruby(rb_iseq_eval_main+0x34) [0x100adef20] /Users/emacs/Documents/code/ruby/build-dev/../vm.c:3254
/Users/emacs/Documents/code/ruby/build-dev/miniruby(rb_ec_exec_node+0x100) [0x1007ac1f8] /Users/emacs/Documents/code/ruby/build-dev/../eval.c:300
/Users/emacs/Documents/code/ruby/build-dev/miniruby(ruby_run_node+0x94) [0x1007ac0ac] /Users/emacs/Documents/code/ruby/build-dev/../eval.c:338
/Users/emacs/Documents/code/ruby/build-dev/miniruby(rb_main+0x40) [0x10067ca2c] /Users/emacs/Documents/code/ruby/build-dev/../main.c:42
/Users/emacs/Documents/code/ruby/build-dev/miniruby(main+0x70) [0x10067c9b8] /Users/emacs/Documents/code/ruby/build-dev/../main.c:62

[jhawthorn (John Hawthorn)]

Great catch! This is my mistake from https://github.com/ruby/ruby/commit/e01e89f55c82be8db5d8ccbf305ee38e3769e582

It should be safe to remove that assertion, but I also think it should probably be forbidden to include on an uninitialized class

module M; end
C = Class.allocate
C.include M # IMO should raise "TypeError: uninitialized class"