Ruby Issue Tracking System

Today

11:27 AM Ruby Revision 47dddf78 (git): [ruby/mmtk] Directly call functions in C binding

This commit removes RubyUpcalls and instead directly calls functions in
the C binding from Rust. This also allows LTO to inline C calls from Rust.
https://github.com/ruby/mmtk/commit/0f5a049a2d peterzhu2118 (Peter Zhu)

04:14 AM Ruby Revision 83fdd0da (git): [ruby/mmtk] Build with LTO when able

https://github.com/ruby/mmtk/commit/2dbb8005aa peterzhu2118 (Peter Zhu)

10/12/2026

09:45 AM Ruby Revision 9e8bf735 (git): [ruby/mmtk] Resize objects to optimal size when moving

https://github.com/ruby/mmtk/commit/6d83b67d9a peterzhu2118 (Peter Zhu)

10/10/2026

02:00 PM Ruby Revision 11f5412c (git): Fix crash in IO#close for uninitialized IO object

IO#reopen can make an uninitialized IO object look initialized, which can
trigger a crash when IO#close is called.
For example, the following code crashes:
io = IO.allocate
begin
io.reopen("")
rescue SystemCallError
... peterzhu2118 (Peter Zhu)

10/09/2026

11:07 PM Ruby Revision 738b4971 (git): Fix buffer overflow in Array#values_at

Array#values_at can execute arbitrary code during execution which may
modify the source array. This can cause a buffer overflow if the new length
of the array has decreased. The following script crashes:
a = (0..100_000).to_a
ob... peterzhu2118 (Peter Zhu)

11:06 PM Ruby Revision 117b6497 (git): Fix use-after-free in String#encode when string modified

[Bug #22330]
The following script demonstrates a use-afer-free where we see corruption:
s = "あ" * 10_000
s.encode("US-ASCII", fallback: proc { |c| s.clear; "?" })
Raises may different errors such as:
"\xCB" followed by "\... peterzhu2118 (Peter Zhu)

11:06 PM Ruby Revision 8b1a1084 (git): [Bug #22336] Fix use-after-free in `IO::Buffer#get_string`. (#18919)

peterzhu2118 (Peter Zhu)

11:06 PM Ruby Revision fc7d08ae (git): Fix crash when returning splat

[Bug #22334]
If we return a with a keyword splat, then each element does not necessarily
push two values onto the stack, so we cannot compile this as a simple sequence
of key-value pairs combined with newhash. The following script repro... peterzhu2118 (Peter Zhu)

11:06 PM Ruby Revision 4e9102bf (git): Fix use-after-free when clearing array during zip

[Bug #22319]
Array#zip triggers an use-after-free it does not account for when the call
to rb_check_array_type modifies the source array. The following script crashes:
a = (1..100_000).to_a
evil = Object.new; $a = a
def evi... peterzhu2118 (Peter Zhu)

11:06 PM Ruby Revision f8cb02fb (git): Fix use-after-free when clearing array during flatten

[Bug #22318]
Array#flatten triggers an use-after-free it does not account for when the
call to rb_check_array_type modifies the source array. The following script
crashes:
a = (1..100_000).to_a
$a = a
bad = Object.new
d... peterzhu2118 (Peter Zhu)