Activity
From 09/19/2026 to 09/25/2026
Today
-
08:54 AM Ruby Revision 413145a2 (git): Fix crash in Array#pack when format string modified
- If the format string is modified during Array#pack (by conversion such
as to_str, to_int, etc.), it can cause an use-after-free since reading
p[-1] may be an use-after-free. We should read that byte before performing
the conversion.
The... -
07:09 AM Ruby Misc #22275: Ruby::Box support plan for RubyGems and Bundler
- I think that RubyGems / Bundler should not be loaded into Ruby::Box by default. I have shared a few of my thoughts with @tagomoris and based on that he implemented #22329.
But I'd like to go further. I think that it would be nice to h... -
06:59 AM Ruby Revision 2a96d32a (git): prism: Use _BitScanForward64 only on 64-bit MSVC
- _BitScanForward64 is not available for 32-bit x86, so the i386-mswin32 build failed at prism.c. Use the portable fallback there, as ntz_int64 in internal/bits.h does.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> -
- USE_SPAWNV needs spawnv without a working fork, which only Windows has since OS/2 support was removed. The non-Windows proc_spawn_cmd_internal and proc_spawn_sh were never compiled, and the Windows proc_spawn_cmd_internal macro was unuse...
-
- Neither configure.ac nor win32/Makefile.sub defines HAVE_SPAWNVE.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> -
- HAVE_FDATASYNC is never defined on Windows. win32/Makefile.sub does not define it and the mingw CRT has no fdatasync, so the branch has never been compiled.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> -
- __BOW__ (BSD on Windows) appears nowhere else in the tree.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> -
- On Windows, ruby/win32.h already includes it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> -
- win32/Makefile.sub and the mingw part of configure.ac already define HAVE_FCNTL_H, HAVE_SPAWNV and HAVE_TIMES, and leave HAVE_SYS_IOCTL_H undefined.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> -
- Regexp fixes are merged into ruby/ruby directly and the copies have diverged, so asking contributors to file them to k-takata/Onigmo only misleads them.
https://github.com/ruby/ruby/pull/19026
Co-Authored-By: Claude Opus 5.5 <noreply@a... -
- The Bundler downloader, Gem::RemoteFetcher and the compact index fetcher re-applied the source's userinfo whenever a redirect stayed on the same host, even when it moved to another port or scheme. RFC 9110 defines the protection space of...
-
05:21 AM Ruby Bug #22384: Regexp compile error in the 2nd+ branch of a top-level alternation leaks the parse tree (regression from #13332, Ruby 4.0)
- Fix and regression test: https://github.com/ruby/ruby/pull/19026. Verified on a build of v4.0.7 with the patch: Regexp.new("a|b(c") rescue nil goes from 134 B leaked per compile to 0, and 2M calls of /(?:a|b)c(d)/.to_s from +250 MB RSS t...
-
- **Affects:** ruby 4.0.6 and 4.0.7 (official docker images and a jemalloc-linked build), master (commit still present). **Not affected:** 3.4.6.
**Repro (plain Ruby, no extensions):**
```ruby
def rss_kb = File.read('/proc/self/status... -
- GetVersionExW always reports VER_PLATFORM_WIN32_NT, since Windows 9x support had been dropped in 8a02eed723 before Etc.uname was implemented on Windows.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> -
- GetSystemInfo reports PROCESSOR_ARCHITECTURE_ARM64 there, which fell through to "unknown".
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> -
- Thank you for this bug report. I have a [fix here](https://github.com/ruby/ruby/pull/19023).
-
- Otherwise configure succeeds and the same floor in Makefile.sub stops the first nmake.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> -
- Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
-
- Since 87435fe232 the build has needed the conforming preprocessor, which MSVC gained in 1915, so 1900 through 1914 passed this check and failed later with an unrelated message.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> -
- Concatenated large repeats reach a program past INT_MAX from a few hundred
kilobytes of source, and the offsets emitted into it wrap. Cap the size
while the program is emitted, which does not depend on the length pass that
overflows alo... -
- Nested bounded repeats let the int product tlen * qn->lower overflow, so
the check that keeps the compiler from unrolling a large repeat could pass
for an enormous one, hanging the compile or emitting wrapped jump offsets.
Compare agains... -
04:14 AM Ruby Bug #22092: `Array#sum` takes slow path, does not perform compensated summation of Float elements when init argument is a Float
- I believe there is a bug in the fix, when a block with side effects is passed in. I think this should fix it https://github.com/ruby/ruby/pull/19022
-
03:19 AM Ruby Bug #22383: Fix inverted `STR_SHARED` check in `rb_str_tmp_frozen_release`
- Sorry, confusing with [Bug #22382].
-
03:14 AM Ruby Bug #22383: Fix inverted `STR_SHARED` check in `rb_str_tmp_frozen_release`
- > With class Ractor alias join take end unless Ractor.method_defined?(:join), it reproduced on 3.3 an 3.4.
What reproduces?
I do have a few related fixes coming in another PR but this particular condition is still
else if (FL_... -
- With `class Ractor alias join take end unless Ractor.method_defined?(:join)`, it reproduced on 3.3 an 3.4.
-
- 4.0 Backport PR https://github.com/ruby/ruby/pull/19019
-
- PR https://github.com/ruby/ruby/pull/19018
-
- https://github.com/ruby/ruby/commit/45a2c95d0f7184c9cd64ddd26699af31bea8675d#diff-430d86fdb6c4a558ab0f1b6648bbfae1720e8bde84f026e95a52740014752040R1914
mistakenly rewrote
FL_TEST_RAW(orig, STR_SHARED) && !FL_TEST_RAW(orig, STR_... -
- Compiling the setter call could spend the whole 1ms budget on a busy CI runner, which stopped compilation before the next eval and failed with :not_compiled2. Check that compilation continues under a generous budget first, and only then ...
- 02:33 AM Ruby Revision 5d106710 (git): Bump taiki-e/install-action
- Bumps the github-actions group with 1 update in the / directory: [taiki-e/install-action](https://github.com/taiki-e/install-action).
Updates `taiki-e/install-action` from 2.87.17 to 2.87.18
- [Release notes](https://github.com/taiki-e... -
- The lockfile does not record overrides, so unlocking for a required_ruby_version or required_rubygems_version override happened on every run, which rejected every frozen install and updated the named gem on each plain `bundle install`. I...
-
- A transitive override outside the parent's requirement made check_lockfile report the parent as having invalid dependencies, so frozen installs of such a lockfile always failed.
https://github.com/ruby/rubygems/issues/9907
https://gith... -
- converge_overrides_outside_dependencies marked every transitive-only version override as a changed dependency, so frozen installs always failed and a plain `bundle install` re-resolved the target as if it had been updated. Compare the lo...
-
- The specification policy looks extensions up through builder_for, so gem build with an extension no builder handles went through build_error. It crashed with a NameError because fileutils was not loaded yet, or wrote gem_make.out into a ...
-
- A reinstall of the same version without build arguments picked up the stale file, so the arguments of the uninstalled copy came back through Gem::Specification#build_args and were reused by gem pristine.
https://github.com/ruby/rubygems... - 12:50 AM Ruby Revision da155f30 (git): [ruby/rubygems] Identify ML-DSA by OID and gate tests by capability
- RubyGems currently assumes an SSL library either supports every ML-DSA
operation or none of them. It also identifies ML-DSA keys using
library-specific display names.
Identify ML-DSA keys using standard SubjectPublicKeyInfo OIDs. Separa... -
- Since a094c99b74 the macro only switches isADS, and every use of isADS is inside `#if USE_NTFS`, so its non-NTFS definition was never referenced.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
09/24/2026
-
11:59 PM Ruby Revision e684c7ba (git): [DOC] Harmonize symlink methods
-
-
11:57 PM Ruby Bug #22382 (Open): IO#write of a shareable String from multiple Ractors causes use-after-free
- When several Ractors `IO#write` the same shareable, heap-allocated (non-embedded) String at the same moment, Ruby frees the String's buffer while the String is still alive. A later GC sweep double-frees it and aborts.
**Reproduction**... -
- It used InterlockedExchangeAdd64 on a 4-byte size_t, so the access also covered the following 4 bytes, which is the `tdata_unsafe_free_published` pointer for the caller in gc/default/default.c. Go through rb_atomic_t like the other size_...
-
- test_os_code only compared the written os_code with Zlib::OS_CODE itself, so it could not catch OS_CODE falling back to OS_UNIX.
https://github.com/ruby/zlib/commit/104cbd525f
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> -
- mkmf's create_header ignores $defs entries that do not start with -D, so the leading space dropped OS_CODE from extconf.h. The in-tree build of ruby/ruby then fell back to OS_UNIX in zlib.c, and Zlib::OS_CODE was 3 on Windows.
https://g... - 11:34 PM Ruby Revision 5cd1287f (git): Prefer __has_include over HAVE_STDCKDINT_H for <stdckdint.h>
- HAVE_STDCKDINT_H records what configure's compiler saw when ruby was
built. __has_include asks the compiler that is compiling the header
right now. When the two compilers are the same they always agree, so
checking __has_include first ... -
- They were forwarded to `msvcrt.stricmp` and `msvcrt.strnicmp`, which msvcrt.dll does not export, so they could never be resolved. Extensions get `_stricmp` and `_strnicmp` through the macros in include/ruby/win32.h.
Co-Authored-By: Clau... -
- For strings larger than or equal to IO_BUFFER_BLOCKING_SIZE (which is 1KB),
IO::Buffer#set_string will perform the memmove without GVL. In this time,
another thread can resize the IO::Buffer object. In that case, the buffer
may be freed ... -
09:54 PM Ruby Feature #22236 (Closed): New API for adjustable JIT warmup
- Applied in changeset commit:git|c29739cb3ef483c215b0c13d30c96cc21b0f680b.
----------
Implement RubyVM::YJIT.max_compile_time_ns
[Feature #22236]
Allows to give a time budget to YJIT. When YJIT goes over the budget
it pauses compilatio... -
- [Feature #22236]
Allows to give a time budget to YJIT. When YJIT goes over the budget
it pauses compilation until the budget is raised.
It is best effort, YJIT may go over, or have no choice but to compile
in some cases, but the goal i... - 08:46 PM Ruby Revision 03321869 (git): ZJIT: Don't allocate strings for backend labels (#19004)
- There is no sense in eagerly allocating a string; we either use a static
string ref or label a block by some combination of (HIR,LIR) pair. Just
store the information instead of allocating on the heap.
This is probably a very minor comp... -
08:05 PM Ruby Bug #22381 (Open): MatchData assigned to $~ is incorrectly reused
- ```ruby
m = /a/.match("a").dup # dup a MatchData (has no "busy" flag set)
$~ = m # assign to $~
/b/ =~ "b" # perform a match that sets $~
p m
# "b" on Ruby 4.0 (and 1.8-2.7, incorrect)
# "a" on Ruby 3.0-3.4 (correct)
```
This i... - 06:19 PM Ruby Revision 1533c109 (git): Preserve compare_by_identity in some Set operations
- Backport of f069efc3f69a89188bab4ac70c690aecce59023b
Fixes [Bug #22174]
Co-authored-by: Jeremy Evans <code@jeremyevans.net> -
06:01 PM Ruby Revision ff03ecf3 (git): ZJIT: Print `PatchPoint` reference to `Insn::Snapshot` when printing snapshots
- So both the definition and the usage are shown. Note that this
is only when, say, `--zjit-dump-hir=all`, where both ends are present. - 05:54 PM Ruby Revision 24be314b (git): Enable incremental marking when the process has > 1 objspace
- Previously, major GC incremental marking was disabled (even on the main Ractor)
when more than 1 Ractor was running. By changing the WB implementation, we now
have it back. - 05:17 PM Ruby Revision 4133daa1 (git): Ractor: wake receiver waiters inside the send critical section
- ractor_send_basket used to enqueue the basket under the receiver's lock,
release it, and then re-take the same lock inside ractor_wakeup_all to wake
the receiver. Every sender to a Ractor contends on that one lock, so the
second acquisit... - 04:59 PM Ruby Revision f9b763af (git): ZJIT: Reduce the amount of memory required for profiles (#19000)
- `resize` might over-reserve space speculatively but we know we're only
going to see a certain number of operands at that opcode. So don't
over-reserve; allocate a vec of the exact size we want.
For a run of lobsters, takes `zjit_alloc_b... - 04:58 PM Ruby Revision 10cc9824 (git): ZJIT: Remove `chase_insn` in `fold_constants` for `StringEqual` (#18998)
- Remove `chase_insn` in `fold_constants` for `StringEqual`
`left` and `right` are already canonical operand IDs when `fold_constants`
checks them.
`canonicalize` runs immediately before `fold_constants`.It updates
operands when the opti... - 02:29 PM Ruby Revision 3676b957 (git): ZJIT: Add line number mappings in Comment (#18752)
- Add line number comments to HIR printouts if enabled. Trying this out. Might help for something like Compiler Explorer. Also helps for debugging.
Requires `--zjit-dump-hir-map` to avoid messing with the default printout.
```
plum% cat ... -
02:22 PM Ruby Revision 645a0718 (git): Increase sleep in fork bootstrap test
- There have been occasional failures on the OpenBSD CI machine in
this bootstrap test. There is a race condition in the test that
you can theoretically hit on a very slow machine, and the OpenBSD
CI machine is running in qemu software emu... -
- This test is flaky on OpenBSD RubyCI, probably due to the fact that
the OpenBSD RubyCI machine is a software emulated virtual machine
running on another virtual machine. The test runs fine on OpenBSD
in general, and seems to pass the maj... -
-
- Drop `--repeat-count=2` and its dedicated settings because parallel
runs add CI time without testing state carried across repetitions. -
- Ignore `--repeat-count` during parallel tests because fresh workers
cannot expose state carried over between repetitions. -
- Keep the jobserver connection until all repetitions finish so that
later runs do not launch up to 256 workers without token limits. -
- Run `GC.start` in the process executing tests because collecting the
parent heap does not reclaim objects in parallel workers. -
-
-
-
-
11:33 AM Ruby Feature #22304 (Closed): Add rb_warn_to_remove_at() for deprecation warnings shown by default
- Applied in changeset commit:git|611bb146b08978aacb26bf4a4e8390e699628350.
----------
[Feature #22304] Add rb_warn_to_remove_at and rb_warn_scheduled_deprecation
rb_warn_deprecated_to_remove_at warns only when Warning[:deprecated]
is en... -
- rb_warn_deprecated_to_remove_at warns only when Warning[:deprecated]
is enabled, so a deprecation scheduled to warn by default in a later
version needed a hand-written rb_warn and a separate commit to switch.
rb_warn_to_remove_at emits ... -
-
-
-
-
-
-
-
- rb_file_expand_path_internal is compiled only without _WIN32, where USE_NTFS has been 0 since 7eb8d74f34 stopped enabling it on Cygwin [Bug #13008]. Forcing it on no longer even compiles, as the block still calls strrdirsep with three ar...
-
- ntfs_tail was the only path helper still deriving it from enc on its own after 6fb50434e3 made the callers decide.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> -
- Clear temporary containers after extracting the result to avoid
retaining their contents through a captured block. -
- Keep the state for block-based `Enumerable#uniq` alive after it returns,
as `each` can retain and later invoke the internal block, making the
stack-allocated memo introduced in 29c669bb568 invalid. -
- Applied in changeset commit:git|ea2836f7ec905e4963b49ffdc550cdf3e82ad8c9.
----------
[Feature #17548] Allow `Dir.glob` to follow symlinks with `***`
Allow recursive matching through directory symlinks while stopping
at links to ancesto... -
- Allow recursive matching through directory symlinks while stopping
at links to ancestor directories to avoid cycles. -
- I merged the following four, since they fix plain bugs such as crashes and need no design decision.
* https://github.com/ruby/ruby/pull/18704: `alias $new $old` in a box created a separate variable.
* https://github.com/ruby/ruby/pull/1... -
-
- This is a backport request for the following crash:
```
$ RUBY_BOX=1 ruby --disable-gems -W:no-experimental -e 'GC.stress = true; module Enumerable; def m; end; end'
-e:1: [BUG] try to mark T_NONE object (obj: 0x00000001042efe28 T_N... -
- When the string buffer reaches BUFSIZ (8192 bytes), Marshal.dump will call
the write method on the IO object. This IO object can run arbitrary Ruby
code. If the object is a string, it writes the length of the string followed
by the bytes... -
08:19 AM Ruby Revision cc32a303 (git): [ruby/error_highlight] Use Thread::Backtrace::Location#syntax_tree when available
- https://github.com/ruby/error_highlight/commit/7755b9bff1
-
- Under RUBY_BOX=1 an assignment in a user box, the main box included, only
updates the box-local table and never reaches the global entry, so hooks
registered with trace_var never run.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> -
-
-
- The Enumerable version did not crash an unfixed build on Linux. Kernel
does on both Linux and macOS, but only while nothing in the main box has
written to it yet, and loading test/unit already has. So run the code
through assert_in_out... -
- rb_class_duplicate_classext builds the whole copy first and the caller only
then puts it in the class's table, so a GC in the middle collects the tables
it has made and marking the class afterwards walks into a freed object. Put
the cla... -
- rb_gvar_set and rb_gvar_get key the box table by var->id, so defined? on an aliased name looked for a key that is never written and returned nil.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> -
- Under RUBY_BOX=1 the box-local gvar table is keyed by the name used for
access, so `alias $b $a` gives the two names separate slots and they
stop being synonyms. Key it by the ID the shared rb_global_variable
was created with instead.
... -
06:58 AM Ruby Feature #22379 (Open): Remove prism mismatch warning from `#syntax_tree`
- #21795 added `#syntax_tree` for a few objects. Currently it is implemented in a way that uses the prism gem, using node_id. Because it is theoretically possible that node_ids from the internal cruby version of prism don't match with the ...
-
06:25 AM Ruby Revision 85fb0e52 (git): [ruby/openssl] ssl: clear error queue before raising SystemCallError
- Clear the OpenSSL error queue when an OpenSSL function fails with
SSL_ERROR_SYSCALL. ruby/openssl methods are expected not to leave stale
entries in the error queue.
While this no longer appears to happen with OpenSSL >= 3.0, LibreSSL
a... -
- It was only used to skip the Rust `cargo test` example while magnus could not build against Ruby master, and that skip went away with the magnus 0.9 template update.
https://github.com/ruby/rubygems/pull/9904
https://github.com/ruby/ru... -
06:02 AM Ruby Bug #22174: Set operations (&, ^, collect!, flatten, classify, divide) do not preserve compare_by_identity
- 4.0 backport PR: https://github.com/ruby/ruby/pull/18992
-
- Fixed in commit:f069efc3f69a89188bab4ac70c690aecce59023b
-
- File.expand_path walks past the root through its own call site, and
Pathname#sub_ext skips the length check File.extname does first, so both
reach the backward scan by routes the extname test does not exercise. -
- The fast path added in 11d29d32d2 skips trailing separators without a
lower bound, so a path made only of separators walks the cursor past the
start of the buffer and keeps reading until it meets a byte that is not
a separator. The retur... -
05:04 AM Ruby Revision 50e2da17 (git): remove unnecessary Inline keyword
- Oddly, when building with msvc (19.44), the linking fails only while disabling optimization (using the /Od option).
```
linking miniruby.exe
Creating library miniruby.lib and object miniruby.exp
set.obj : error LNK2019: unresolved ext... - 04:48 AM Ruby Revision a3c583af (git): [ruby/rubygems] update magnus version in rust extension gem template
- https://github.com/ruby/rubygems/commit/666723ae10
-
- The size assumed that `fd_array` follows a 4-byte `fd_count`, but on x64 SOCKET is 8 bytes and `fd_array` starts at offset 8. Filling the last slot of a set grown to 128, 192, ... sockets wrote 4 bytes past the allocation.
Co-Authored-B... -
- Apply suggestion from @nobu
Co-authored-by: Nobuyoshi Nakada <nobu.nakada@gmail.com> -
- msvc supports flexible array as it's language extensions.
The /Za msvc compiler option disables this and other extensions, but it is not necessary to consider it.
The Windows SDK headers contain anonymous unions/structs, and using /Za ma... -
- Using the option (one of -std:[c11|c17|clatest]) to enable standard C support in msvc causes the following error:
[BUG] vm_call_method: unsupported method type (-7)
Simply disable it. -
- It should delete `ruby/prism` now
- 03:01 AM Ruby Revision f069efc3 (git): Preserve compare_by_identity in some Set operations
- Adjust the specs to handle the backwards compatibility breakage.
While we will backport this to Ruby 4.0, to avoid temporary
breakage, leave Ruby 4.0 behavior unspecified until the fixes
are backported to it.
Co-authored-by: Jeremy Evan... - 02:30 AM Ruby Revision f55f1957 (git): Bump ruby/setup-ruby in the github-actions group across 1 directory
- Bumps the github-actions group with 1 update in the / directory: [ruby/setup-ruby](https://github.com/ruby/setup-ruby).
Updates `ruby/setup-ruby` from 1.324.0 to 1.325.0
- [Release notes](https://github.com/ruby/setup-ruby/releases)
- ... -
- Applied in changeset commit:git|4617d60fe4b5c18e7350d37b2f2c4508c62df708.
----------
[Bug #22339] Skip classes already freed while freeing a box
`RUBY_FREE_AT_EXIT=1` frees every object in an arbitrary order, so a
class a box refers to... -
- I was already aware of this, and https://github.com/ruby/ruby/pull/18710 fixes it by skipping classes that were already freed when a box is freed.
The ASAN double free in the description comes from `ruby_4_0` and has a separate cause. I... -
- `RUBY_FREE_AT_EXIT=1` frees every object in an arbitrary order, so a
class a box refers to can go before the box itself, and freeing a class
already frees its classext for that box. The box then reached rb_bug
with a T_NONE object, and ... -
12:09 AM Ruby Revision 1c91d9bc (git): ZJIT: Exit with the block arg on the stack from SendDirect args (#18983)
- 12:06 AM Ruby Revision 634de041 (git): [ruby/strscan] Don't match from the middle of a character
- (https://github.com/ruby/strscan/pull/219)
`#pos=` accepts an arbitrary byte offset, so the scan position can fall
in the middle of a multi-byte character such as UTF-16BE. Matching from
there made Onigmo read a whole character starting...
09/23/2026
- 10:30 PM Ruby Revision d7bd382a (git): ZJIT: Inline String#to_sym to StringIntern (#18981)
- Closes https://github.com/Shopify/ruby/issues/1061.
Also add a test to make sure `String#intern` generates the same HIR.
### Benchmarks
I had AI create 4 new microbenchmarks for this change and also run `protoboeuf-encode`.
They look... -
-
- Previously, `setlocal level=0` did not set the local in the frame state
during HIR build, unlike `setlocal_WC_0`. `getlocal` and `getlocal_WC_0`
had the same issue.
I don't know if it's possible to trigger an ZJIT issue with default
ise... -
-
- There were some difficulties after https://github.com/ruby/prism/pull/4223 was merged because
the excludes were out of sync. - 09:56 PM Ruby Revision 2ea36fd6 (git): ZJIT: Specialize sends with a Proc block arg into SendDirect (GH-18180)
- Guard the block arg of `foo(&blk)` when profiling shows it is exactly
a Proc, and pass it directly as the callee frame's block handler
instead of falling back to a dynamic send. - 08:36 PM Ruby Revision 9635fc03 (git): Don't allow writing to locals in cexpr (#18873)
- The JIT optimizer sees an `invokebuiltin` and would like to assume that calling it does not write back to the frame. A `Primitive` should never write to the frame by taking a pointer to a local, so this PR removes that functionality.
Pa... -
- 06:40 PM Ruby Revision d8177d64 (git): ZJIT: Move string encoding flags loading to HIR (#18894)
- Closes https://github.com/Shopify/ruby/issues/1051
The LIR generated without stats is the same, but now the `LoadField` can be deduped.
Same as #18251 but without moving the `xor` to the HIR.
Generate HIR is now:
```
v31:CU... -
-
- > Not an area of ruby I'm very familiar with, but I think perhaps we should also be extending sp in vm_callee_setup_arg and vm_call_iseq_setup_kwparm_kwarg?
These don't extend SP because they're fast paths that try to do minimal work... -
04:32 AM Ruby Bug #22335: Stack corruption with >31 keyword args and refined Integer#==
- ruby_3_4 commit:41e214d7100100a43c469e2628403d6916d1f0f8 merged revision(s) commit:d87ffb271a80fb108de3465d12ada829f3c130af.
-
04:47 PM Ruby Revision d74c656b (git): Document Range attributes begin and end
-
- Keyword tracking only needs membership, so replace identity hashes
with identity sets to avoid storing unused values. Add `rb_set_p`
for the type assertion in `vm_check_keyword`.
Add benchmarks for 31, 32 and 128 keyword parameters wit... -
- ```rb
# Reduced from the `httpx` gem
@var = Class.new.freeze.dup
@var.instance_variable_set(:@test, 123)
```
I expect this code to succeed. dup returns an unfrozen copy, so I should be able to set instance variables on it. However... -
10:12 AM Ruby Revision 94285c5c (git): [DOC] `Encoding.locale_charmap` never returns nil (#18943)
-
- https://github.com/ruby/mmtk/commit/2801d95aa4
-
09:17 AM Ruby Revision 420a1dee (git): [DOC] Add no argument example to `module_function`'s doc (#18962)
-
08:20 AM Ruby Bug #22254: [Prism] Clang UBSan reports NULL/0 memcpy while serializing empty strings
- Thank you very much for this.
-
- Fixed by https://github.com/ruby/ruby/commit/8cdc7b59571dd5ea4fc08638e88255d3f43d2e60
-
- storage behind `PM_STRING_EMPTY`
(https://github.com/ruby/prism/pull/4228)
Some places memcpy the source, and NULL there is undefined behaviour.
Fixes https://bugs.ruby-lang.org/issues/22254
https://github.com/ruby/prism/commit/d0b36c... -
- If the source string is modified in the block of String#unpack, it can
cause an use-after-free. For example, the following script crashes:
fmt = "A" * 1_000_000
str = "C" * 1_000_000
str.unpack(fmt) { fmt.clear } -
- Applied in changeset commit:git|0fab30f723810af1608d2162e2aef32b44a1ee3a.
----------
compile.c: ensure swapped element isn't skipped
[Bug #22377]
When we statically resolve a `swap` we need to make sure the element
we reordered will r... -
- Thanks for the repro, I think I know what's going on, I'll look into it.
-
- [Bug #22377]
When we statically resolve a `swap` we need to make sure the element
we reordered will receive its optimization pass. -
-
- ruby_3_4 commit:7bbe8e88007f8283a421cb31db86da32076126a6 merged revision(s) commit:ad23fd4a519fde4fc96c7326fb9b0347cbc347b8.
-
- ruby_3_4 commit:75309143a8494abd682bdd23f3b18ecc2e48a2e4 merged revision(s) commit:cb302881629f997f403e705425f69e5f6b0741ac, commit:c914aeb622ce7337223cd5c23f30daf9f7d3e7c4.
-
- ruby_3_4 commit:93d1c2d7c3782cfbe0448849bd2cb79ce66c3860 merged revision(s) commit:ee786598f10c6def72265fb7105fe505f563f52f, commit:54f254aa41eb624429e6b884c0a6381eeeac50d0, commit:15dbb08ba8b69877c8012e0f5950f3f26a3abffe, commit:249de20...
-
- MEMO: related commit hashes.
commit:ee786598f10c6def72265fb7105fe505f563f52f
commit:54f254aa41eb624429e6b884c0a6381eeeac50d0
commit:15dbb08ba8b69877c8012e0f5950f3f26a3abffe
commit:249de200d5be1f1d1f936e40949a6b48ac9b6e25 -
- [PATCH] [Bug] win32: create directory symlinks for relative directory targets
File.symlink decided whether to create a directory symlink by calling
GetFileAttributesW on the target as given, which resolves a relative
... -
- [PATCH] [Bug #22335] Use identity hashes for keyword argument tracking
With more than 31 keyword arguments, tracking unevaluated defaults
uses an integer-keyed Hash whose collisions can invoke methods when
`Integ... -
- [PATCH] [Bug #22340] Fix stat on symbolic-link loops on Windows
Preserve `ELOOP` instead of hiding symbolic-link resolution errors
with the file-enumeration fallback, so existence checks return false. -
- [PATCH] Fix memory leak of transcoding when fallback raises
When the fallback function in transcode_loop raises, it will leak the memory
in rb_econv_t. The following script reproduces the leak:
10.times do
... -
- 02:41 AM Ruby Revision 8c0eb987 (git): Bump taiki-e/install-action
- Bumps the github-actions group with 1 update in the / directory: [taiki-e/install-action](https://github.com/taiki-e/install-action).
Updates `taiki-e/install-action` from 2.87.16 to 2.87.17
- [Release notes](https://github.com/taiki-e... -
- The precision in Time.new calls to_int which can modify the string passed
into Time.new. This can cause an use-after-free. For example, the following
script crashes:
str = "2000-01-01 00:00:00" + "0" * 1_000_000
obj = Object.new... -
-
-
09/22/2026
- 11:20 PM Ruby Revision 59bd0509 (git): ZJIT: Change HasType into CondBranchHasType (#18633)
- We use `HasType`+`CondBranch` a lot—it is how we do polymorphic dispatch in HIR—so it's pretty hot. Without smarter instruction fusion/instruction selection, this generates a lot of code. Kokubun identified this in https://github.com/Sho...
-
- Missed by the "operands_unification" pass, somehow.
See 0023 below:
```text
$ ./miniruby --parser=parse.y --dump=insns -e '
assign = ->(outer) {
m = Module.new
m.set_temporar... - 10:15 PM Ruby Revision dcbf89e0 (git): ZJIT: Make LIR Abort a terminator (#18967)
- It's an abrupt end to a block, but it definitely ends the block. No need
to put a return instruction after it. -
- Uninitialized classes, created by `Class.allocate`, are a recurring source of bugs (most recently #22341). Every place that inspects a class's superclass chain has to check whether the class has been initialized, and it's easy to forget ...
- 09:18 PM Ruby Revision 7e0d49ae (git): ZJIT: Add HIR comment to terminators too (#18890)
- We previously only had this in `gen_insn` which left terminators
un-commented. -
- `Time.new("2026-02-30T00:00:00Z")` returns a `Time` object that is internally inconsistent.
It shows as Feb 30 or Mar 2 depending on what methods are called:
```ruby
t = Time.new("2026-02-30T00:00:00Z") # => 2026-02-30 00:00:00 UTC
... - 07:52 PM Ruby Revision e77b7b6f (git): ZJIT: Specialize Struct class .new (#18835)
- We can use `ObjectAllocClass` for Structs because they are basically
a `__members__` ivar lookup for sizing plus the default allocator.
Requires #18888 to make sure the constructor does not raise. -
- (https://github.com/ruby/prism/pull/4232)
Followup to https://github.com/ruby/prism/commit/ba16ae22561179998e4208e4c37262b47f693c11
I can't run rake `cargo:test`:
```
$ cargo build
Compiling ruby-prism-sys v1.9.0 (ruby-prism/rust/ru... -
- It might be worth noting for anyone that wants to try this, if you do LTO with fat LTO objects and a static build (as described at the top) this will make native extension compilation much slower.
You can speed this up by stripping t... - 04:36 PM Ruby Revision 8d4efc14 (git): ZJIT: Elide Kernel#dup for more classes (#18872)
- `rb_obj_dup` skips immediates:
```c
VALUE
rb_obj_dup(VALUE obj)
{
VALUE dup;
if (special_object_p(obj)) {
return obj;
}
// ...
}
static inline int
special_object_p(VALUE obj)
{
if (SPECIAL_CONST_P(obj)) re... -
- I've opened a GitHub PR for this: https://github.com/ruby/ruby/pull/18961
-
- `io.gets(rs, limit)` ignores the `limit` value and reads until `rs` is found or EOF, if the `limit`-th byte of the stream matches `rs`'s last byte and:
1. The potential start of the record separator, the `limit-rs.bytesize`-th byte of... - 03:08 PM Ruby Revision 720994eb (git): ZJIT: Fold Class#superclass (#18682)
- I saw that YJIT has a fast-path for this so I figured we should too.
-
- Fix https://github.com/ruby/fileutils/pull/195
https://github.com/ruby/fileutils/commit/b2d9b72739 -
- Fix https://github.com/ruby/fileutils/pull/194
https://github.com/ruby/fileutils/commit/8b1efe473e -
- Fix https://github.com/ruby/fileutils/pull/193
https://github.com/ruby/fileutils/commit/6fd04f3cea -
- Fix https://github.com/ruby/fileutils/pull/192
https://github.com/ruby/fileutils/commit/df83e4bb04 -
- Fix https://github.com/ruby/fileutils/pull/191
https://github.com/ruby/fileutils/commit/ff78cfd3a4 -
- Windows reports self-referential links as existing, so use a missing
target to test a dangling link rather than a symbolic-link loop.
https://github.com/ruby/fileutils/commit/803fe3be07 -
- Cover single, multiple, and dangling links through `ln_s`, keeping
valid-link tests available where dangling links are unsupported.
Fix https://github.com/ruby/fileutils/pull/190
https://github.com/ruby/fileutils/commit/189aefb679 -
- Cover removal of existing and missing files through `rm_f` and
verify the `safe_unlink` alias.
Fix https://github.com/ruby/fileutils/pull/189
https://github.com/ruby/fileutils/commit/902bcce36b -
- Cover removal of existing and missing trees through `rm_rf` and
verify the `rmtree` alias.
Fix https://github.com/ruby/fileutils/pull/188
https://github.com/ruby/fileutils/commit/07cc858f16 -
- Check the result and effects of `mv` and verify the `move` alias.
Fix https://github.com/ruby/fileutils/pull/187
https://github.com/ruby/fileutils/commit/3bed6e74a1 -
- Check `mkdir_p` return values and verify the `makedirs` and `mkpath`
aliases without duplicating directory creation tests.
Fix https://github.com/ruby/fileutils/pull/186
https://github.com/ruby/fileutils/commit/72ff748e26 -
- Verify that `ln` creates hard links and that `link` remains an alias.
Fix https://github.com/ruby/fileutils/pull/185
https://github.com/ruby/fileutils/commit/46db9d557b -
- Avoid duplicating working-directory coverage already in `test_pwd`.
Fix https://github.com/ruby/fileutils/pull/183
https://github.com/ruby/fileutils/commit/d937a3d5ba -
- Cover directory changes, block behavior, and verbose output through
`cd`, and verify that `chdir` remains an alias.
Fix https://github.com/ruby/fileutils/pull/182
https://github.com/ruby/fileutils/commit/8476509760 -
- Fix https://github.com/ruby/fileutils/pull/181
https://github.com/ruby/fileutils/commit/4b041318e9 -
- Cover equal and different file contents in `test_cmp` and verify
that `compare_file` and `identical?` remain aliases.
Fix https://github.com/ruby/fileutils/pull/180
Fix https://github.com/ruby/fileutils/pull/184
https://github.com/ruby... -
- Great catch! This is my mistake from https://github.com/ruby/ruby/commit/e01e89f55c82be8db5d8ccbf305ee38e3769e582
It should be safe to remove that assertion, but I also think it should probably be forbidden to include on an uninitiali... -
02:20 PM Ruby Bug #22341 (Open): Class#superclass can crash the interpreter in debug build
- While implementing this in ZJIT, @nirvdrum reported, and I investigated, a potential interpreter crash:
module M; end
C = Class.allocate
C.include M
C.superclass
In a debug build, this crashes:
plum% ./bui... -
- Applied in changeset commit:git|ad23fd4a519fde4fc96c7326fb9b0347cbc347b8.
----------
[Bug #22340] Fix stat on symbolic-link loops on Windows
Preserve `ELOOP` instead of hiding symbolic-link resolution errors
with the file-enumeration f... -
- On Windows, `File.stat` succeeds on a self-referential symbolic link instead of raising `Errno::ELOOP`, and `File.exist?` returns `true`. Opening the same link raises `Errno::ELOOP`.
I noticed this while adding symbolic-link tests to... -
- Preserve `ELOOP` instead of hiding symbolic-link resolution errors
with the file-enumeration fallback, so existence checks return false. - 01:48 PM Ruby Revision 7ba699ae (git): Make fibers RUBY_TYPED_THREAD_SAFE_FREE
- Now fibers can be collected by multiple ractors at once when those Ractors
are running local GCs. Fibers are created in the Ractor that owns them, so
if multiple Ractors have unmarked fibers during local GC sweeping, we can
now collect t... - 01:39 PM Ruby Revision 1070504b (git): Make non-Array Struct __members__ a bug (#18888)
- We should not ever hit this from Ruby code; user code cannot modify
ivars that do not start with @.
This makes `num_members` leaf and therefore Struct class allocation also
leaf. - 01:36 PM Ruby Revision ce75c108 (git): Allow disabling `zjit-stats` in tool/zjit_diff.rb (#18893)
- When running benchmarks, sometimes there is a overhead in the statistics collection, so it can be useful to disable `zjit-stats`.
In my case I was investigating https://github.com/Shopify/ruby/issues/1051 and was confused why I was not ... -
- [PATCH] Fix out-of-bounds in Array#permutation when array modified
Calling to_int on the count may run Ruby code that modifies the array.
This can cause an out-of-bounds in Array#permutation. For example, the
fol... -
- [PATCH] Fix buffer overflow in String#rpartition
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
The conversion of the pattern to string can cause the string to b... -
- If the Dir object is closed in the block of Dir#each/each_child/scan, then
it will crash because dirp->dir will be a NULL pointer. The following
script demonstrates the crash:
d = Dir.open("/")
d.each { d.close } -
-
- Also simplify the notation of the special const reserved words.
-
- Show that dangling symbolic links return false and clean up the
example files.
Follow up on ruby/ruby#18571. -
- Calling to_int on the count may run Ruby code that modifies the array.
This can cause an out-of-bounds in Array#permutation. For example, the
following code crashes:
ary = (1..1_000).to_a
obj = Object.new
obj.define_singleto... -
- 02:11 AM Ruby Revision 6454569c (git): Bump the github-actions group across 1 directory with 5 updates
- Bumps the github-actions group with 5 updates in the / directory:
| Package | From | To |
| --- | --- | --- |
| [ruby/setup-ruby](https://github.com/ruby/setup-ruby) | `1.323.0` | `1.324.0` |
| [github/codeql-action/init](https://github...
09/21/2026
-
- The conversion of the pattern to string can cause the string to be modified.
This can cause a buffer overflow since it uses the original length of the
string. For example, the following script reports a buffer overflow with
ASAN:
s ... -
- https://github.com/ruby/mmtk/commit/3f94f904eb
-
- ## Summary
With `RUBY_BOX=1` and `RUBY_FREE_AT_EXIT=1`, Ruby crashes or hangs while freeing boxes at VM
shutdown. No user box needs to be created: the built-in boxes are enough.
`box_entry_free()` walks `box->classext_cow_classes`... -
- Fix ruby/rdoc#1592.
-
03:58 PM Ruby Revision f07f65b7 (git): [PRISM] Source file no longer static literal
-
- Ref: https://bugs.ruby-lang.org/issues/17593.
Because `__FILE__` is currently considered a static literal,
it's entirely evaluated during compilation.
The problem is that ISeqs can be serialized and reloaded later,
but since `__FILE__`... -
02:33 PM Ruby Bug #22335: Stack corruption with >31 keyword args and refined Integer#==
- Thank you for the prompt fix.
Not an area of ruby I'm very familiar with, but I think perhaps we should also be extending sp in `vm_callee_setup_arg` and `vm_call_iseq_setup_kwparm_kwarg`? Getting rid of the method dispatch fixes the ... - 01:55 PM Ruby Revision 61de3dd7 (git): [ruby/openssl] Make ruby/openssl types RUBY_TYPED_THREAD_SAFE_FREE
- It's safe to free these types during Ractor-local GC in Ruby 4.1. We've
seen the freeing of this type show up in profiles before.
https://github.com/ruby/openssl/commit/e481c6408f
Co-authored-by: Kazuki Yamaguchi <k@rhe.jp> -
12:40 PM Ruby Feature #22068: Adding post-quantum cryptography (PQC) support across Ruby standard libraries
- Note that I sent PR to support SLH-DSA in ruby/openssl. However, I don't have a plan to add the SLH-DSA tests across the standard libraries except for ruby/openssl. Because I think SLH-DSA is a kind of unpopular PQC algorithm used for th...
-
- I agree that this is worth backporting, I did https://github.com/ruby/ruby/pull/18945 for 4.0. Backport for 3.4 is fine too I guess, it someone wants to do it.
-
- We need to keep track of pending pages in RubyHeapTrigger otherwise a large
allocation may cause infinite number of GCs to be ran since it will always
appear that we have enough space in the heap (and thus the heap won't grow)
but still ... -
- @jneen you should probably open this as a PR to ruby, yes. The pr to upstream can happen after.
Currently ruby has no tests for duplicate character classes I think, so it would be nice to add some tests in that PR to show it still war... -
09:14 AM Ruby Bug #22325 (Closed): out of bounds read in array
- Applied in changeset commit:git|8befacf9e6c898a0f79dcb53bdd2e4cea24e0d1c.
----------
Guard against oob read in rb_ary_aref1
When the array is shrunk during rb_arithmetic_sequence_beg_len_step,
ary_subseq_len returns -1. Return an empty... -
- When the array is shrunk during rb_arithmetic_sequence_beg_len_step,
ary_subseq_len returns -1. Return an empty array instead of passing the
negative length to ary_make_partial or ary_make_partial_step.
[Bug #22325] -
- Fix https://github.com/ruby/fileutils/pull/177
https://github.com/ruby/fileutils/commit/86278df2f7 -
- Fixed by ruby/ruby#17545.
https://github.com/ruby/fileutils/commit/9e957c2330 -
- [PATCH] Fix use-after-free in String#% when array modified
If the array object passed into String#% is modified during conversion
(such as via to_s, to_i, to_f, etc.) then it can be a use-after-free if
the buffer... -
- [PATCH] Fix out-of-bounds access in String#byteindex/byterindex
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
If the source string is modified when converting o... -
- vo.x (Vit Ondruch) wrote:
> My proposal is to change the `require_relative` in following way:
> ...
Do you mean `require_relative` should load the file in the current working directory?
I don't think it is reasonable behavior.
`requi... -
- https://github.com/ruby/ruby/pull/17545
-
- If the source string is modified when converting offset to an integer,
then there could be an out-of-bounds access because the length of the
string is captured before to_int is called. For example, the following
script triggers an ASAN e... -
05:31 AM Ruby Feature #22274: Make `IO::Buffer` no longer experimental.
- > Thanks, that makes sense. At the moment a locked buffer can be frozen, and #locked on a frozen buffer still increments lock_count, so I assume both will be handled as part of the implementation.
Correct :) -
05:26 AM Ruby Feature #22274: Make `IO::Buffer` no longer experimental.
- ioquatix (Samuel Williams) wrote in #note-10:
> As per my design, a buffer that is frozen does not need to update or touch `locked_count` (in fact, only a buffer with `locked_count == 0` can be frozen). Once frozen, all operations (that... -
- ioquatix (Samuel Williams) wrote in #note-6:
> `freeze` is for "safe to share this Ruby object" and `readonly` means the backing buffer cannot be modified by this view.
As far as I know, there is currently no API to make an existing ... -
- > Even on a frozen buffer, #locked updates lock_count with a non-atomic read-modify-write, so two Ractors calling #locked on the same buffer would cause a data race on it. It seems that freezing alone is not sufficient for sharing.
As p... -
- ioquatix (Samuel Williams) wrote in #note-6:
> Therefore, I'm against a frozen buffer meaning underlying memory cannot be modified.
If Matz agrees, I don't have a strong opinion on how freeze should be interpreted. However, under thi... -
- ioquatix (Samuel Williams) wrote in #note-6:
> For the purpose of sharing `IO::Buffer`, `freeze`ing this state is sufficient.
Even on a frozen buffer, `#locked` updates `lock_count` with a non-atomic read-modify-write, so two Ractors... - 03:07 AM Ruby Revision 647e6e61 (git): [ruby/fileutils] Remove redundant condition
- Since `Process.uid` returns `0` always on mingw or mswin, `root_in_posix?` returns `true` too.
https://github.com/ruby/fileutils/commit/d18fbf0c56 - 03:07 AM Ruby Revision be820c30 (git): [ruby/fileutils] Skip test_rm_r_no_permissions test under root
- Skip the test_rm_r_no_permissions test under the root user, as deletion always succeeds.
Signed-off-by: Jiaying Song <jiaying.song.cn@windriver.com>
https://github.com/ruby/fileutils/commit/3c831389c5 -
03:05 AM Ruby Revision 508ee642 (git): [ruby/fileutils] Skip chown tests when the target group is not assignable
- In user-namespace environments (e.g. ChromeOS Crostini) getgroups(2) can report supplementary groups such as the overflow GID 65534 (nobody) that a non-root process cannot actually chgrp a file to. TestFileUtils#setup built @groups strai...
- 02:59 AM Ruby Revision 0cb17e33 (git): [ruby/fileutils] Remove unused fu_copy_stream0 helper
- fu_copy_stream0 has had no caller since b26846bf replaced both uses with direct IO.copy_stream calls in 2008. The retained private wrapper is unreachable.
https://github.com/ruby/fileutils/commit/feba38f651 -
02:57 AM Ruby Revision 26f43967 (git): [ruby/fileutils] Fix relative symlink target generation
- https://github.com/ruby/fileutils/commit/7de921e801
-
- String#tr can crash if keys are removed from the translation hash since
we stack allocate a buffer pairs. If entries are deleted during runtime,
then we won't fill the pairs buffer which can crash because it will be
reading uninitialized... -
-
-
-
-
-
01:25 AM Ruby Feature #15833 (Rejected): Some refactors for shared-root array
-
- This ticket is too old
09/20/2026
-
- Dan0042 (Daniel DeLorme) wrote in #note-8:
> Does the updated target version need to be backported to every branch ?
There is a similar case. Ruby 3.3 still says "Process::Status#& is deprecated and will be removed in Ruby 3.4", althoug... -
05:17 PM Ruby Feature #22304: Add rb_warn_to_remove_at() for deprecation warnings shown by default
- > A major version bump is a chance to introduce incompatibilities, so I think we should decide for each deprecation whether to keep the schedule or to remove it at the major version.
Ok I see, that makes sense. It might also be useful... -
- ioquatix (Samuel Williams) wrote in #note-6:
> Implemented in [https://github.com/ruby/ruby/pull/18911](https://github.com/ruby/ruby/pull/18911)
Great, this will make semantics match more closely and ensure reliable behavior.
ioquatix ... -
-
- Once all `*.rbinc` files have been generated, the command should not
be required anymore. -
- If the array object passed into String#% is modified during conversion
(such as via to_s, to_i, to_f, etc.) then it can be a use-after-free if
the buffer of the array is freed.
This commit changes it to detect if the buffer has been cha... -
- Avoid incorrect variadic argument forwarding in `RUBY_ASSERT_MESG_WHEN`
by the traditional MSVC preprocessor, which breaks `VM_ASSERT` when
`RUBY_DEBUG` is enabled. -
- [PATCH] Raise the ModGC `make check` timeout for MMTk to 90 minutes
MMTk's `make check` on macos-26 takes 27 minutes at the median and 37 at the 90th percentile, so the default 40 minute step limit sits inside the distribution o... -
- [PATCH] Add timeout scale to macOS ModGC CI jobs
Same fix as commit 8e8682fc2312164c49d3bf4a15d1f464d2644598, which added
RUBY_TEST_TIMEOUT_SCALE=10 to all macOS check jobs in macos.yml but did
not cover modgc.ym... -
- ruby_3_4 commit:bce3c89801d667a2cc38940228b8656f46879e7e merged revision(s) commit:b61da996afb02715cb16703a55f57c4417fd2d5b.
-
- ruby_3_4 commit:350ef312531ac79eb2771f6d5cd242d720657d0b merged revision(s) commit:d7fe390c85d1a0aeda104026134d19b86199f9b7.
-
- ruby_3_4 commit:b82e5058907869051d336449dd67f16b007ad7b8 merged revision(s) commit:20ca4e1f647107df1a5ae75b514f20b587091405.
-
- ruby_3_4 commit:2a77c0f6f9ee7752a3594455bac24812d8aeba9d merged revision(s) commit:0c9f3f1e68e23a9ba2d7fdfdb86bd7ddcaf5e9d9.
-
- ruby_3_4 commit:3ebd235fb667e37b9f5cb4dcf61b19f07c4d2b34 merged revision(s) commit:5eeaedc3d3014a12264aa252c751e14ba0fc5507.
-
- ruby_3_4 commit:ce5cca10a5143da2ccea33a53190e39a6b923241 merged revision(s) commit:685144e3d60513ccde1c6cb4bed20597cb860002.
-
- ruby_3_4 commit:cf53d1a7283dbe78830cabd9e72124208d8380d3 merged revision(s) commit:5831948a66412922e1abafd2c38fd6400e420581.
-
- ruby_3_4 commit:9bfc30e701db71c3bfec531422ebea7e2c1cdfb5 merged revision(s) commit:d38952c45e27becbe160f832aea823546899ad2e.
-
- [PATCH] [Bug #22336] Fix use-after-free in `IO::Buffer#get_string`. (#18919)
-
- [PATCH] Fix crash when returning splat
[Bug #22334]
If we return a with a keyword splat, then each element does not necessarily
push two values onto the stack, so we cannot compile this as a simple sequence
... -
- [PATCH] Fix Method#inspect when klass is iclass
[Bug #22321]
In the following script, the klass of the Method object is an iclass, which
will raise an error "NoMethodError: undefined method 'inspect' for an inst... -
- [PATCH] [Bug #22322] Take transcoder names from declared transcoders
Fix use-after-free of dangling pointers. -
- [PATCH] Fix use-after-free when clearing array during zip
[Bug #22319]
Array#zip triggers an use-after-free it does not account for when the call
to rb_check_array_type modifies the source array. The following s... -
- [PATCH] Fix use-after-free when clearing array during flatten
[Bug #22318]
Array#flatten triggers an use-after-free it does not account for when the
call to rb_check_array_type modifies the source array. The fol... -
- [PATCH] Fix crash when source string modified in String#unpack
[Bug #22315]
The following script crashes because there is a use-after-free on the
source string during String#unpack:
s = "C" * 400000... -
- The 'r/R' specifiers are added in 4.1. I suppose we don't have to backport this.
-
- ruby_3_4 commit:72aa33a12683d7e351ca406a4cad45e5f1f98e26 merged revision(s) commit:e5132b162737829f744b2b23908b9d08479db977.
-
- ruby_3_4 commit:1e1e90990c14805ee327630168360d3b6530aab3 merged revision(s) commit:46c287e2ca39da63d5164e2b7227308a41554c9a.
-
- [PATCH] Fix the `intern` VM instruction to be `leaf=false` (also in YJIT, ZJIT)
rb_str_intern can raise EncodingError and call its initializer.
This call can push a Ruby frame.
Fix in the VM, YJIT, and ZJIT. -
- [PATCH] [Bug #22264] Warn for duplicate keys after leading keyword splat
Leading keyword splats must not suppress duplicate literal key
warnings. -
- [PATCH] Fix splicing an array that shares its buffer with a longer array
Arrays sharing one buffer have the same data pointer, so rb_ary_splice()
took `a` in `b = a.dup; b.pop; b.concat(a)` for `b` itself and rebased
... -
- merged to rubu_3_4 at https://github.com/ruby/ruby/commit/c5a0ddafbbe1ad4477e6c9c60612d5b34ac41f01.
-
- The separator can be modified in the block yielded by String#each_line.
When that happens, the pointer can change which can cause an use-after-free.
For example, the following script crashes:
sep = "x" * 1_000_000
s = "a#{sep}b#... -
-
-
-
09/19/2026
-
- Applied in changeset commit:git|d87ffb271a80fb108de3465d12ada829f3c130af.
----------
[Bug #22335] Use identity hashes for keyword argument tracking
With more than 31 keyword arguments, tracking unevaluated defaults
uses an integer-keye... -
-
- With more than 31 keyword arguments, tracking unevaluated defaults
uses an integer-keyed Hash whose collisions can invoke methods when
`Integer#==` is refined or redefined, corrupting argument locals above
`cfp->sp`. Use identity hashes... -
- The selector conversion may run aribtrary Ruby code and modify the source
string. This can cause a use-after-free if it resizes the source string.
For example, the following script causes corruption:
s = "-" * 1000 + "abc" + "-" * 1... -
11:58 AM Ruby Feature #17593: load_iseq_eval should override the ISeq path
- Seems there new movement on related changes but I wanted to add some thoughts.
__FILE__ as syntax rather than method eliminates a bunch of side effect behavior that makes __dir__ troublesome:
* It needs access to the caller frame o... -
-
- The frozen check in `OBJ_FREEZE` makes the separate check redundant,
and immediate values are always frozen, so the old assertion is
unreachable. -
- Avoid calling `rb_obj_freeze_inline` for already frozen objects,
including immediate values, to match `rb_obj_freeze` semantics. -
- `rb_freeze_singleton_class` is an implementation detail of
`RB_OBJ_FREEZE`, so deprecate direct calls from extension libraries
before removing its public declaration in Ruby 4.2. -
-
- @matz
## Slices
Implemented in https://github.com/ruby/ruby/pull/18911
## Freeze
> freezing to mean that the object's own state is immutable
I agree with that. An `IO::Buffer`'s own state consists of:
```c
struct rb_io... -
- Applied in changeset commit:git|b61da996afb02715cb16703a55f57c4417fd2d5b.
----------
[Bug #22336] Fix use-after-free in `IO::Buffer#get_string`. (#18919) -
-
- Thank you for this bug report. I believe [this PR](https://github.com/ruby/ruby/pull/18870) should have fixed this bug. I will mark this issue for backport.