[pull] master from ruby:master#1217
Merged
Merged
Conversation
The icc-x64 rubyci builder has been failing with heap corruption on abnormal fiber termination since cce7041 added a call to rb_proc_refinements_cref inside rb_fiber_start's setjmp region, which looks like a miscompilation of this setjmp-sensitive function by Intel oneAPI 2026.1. Hoist the call before EC_PUSH_TAG; the behavior is unchanged.
The inline GC allocation fast path previously only wrote the RBasic header. This means that any types whose fields must be initialized could not be handled safely, because a store performed after the fast/slow join happens once the object is already reachable by the GC. This commit introduces an `init` hook that runs inside the fast path, after the flags/klass stores and, for MMTk, before post_alloc_func makes the object visible to a concurrent collector. We also update the existing callers: - newarray and object allocation pass a no-op hook. - newhash moves its `ifnone = Qnil` store into the hook, so the field is initialized on the fast path and the redundant post-join store is removed; the slow path's rb_hash_new already sets ifnone.
Ensures the GC updates the baked-in VALUE during compaction.
`system('foo.exe %A')` looks past `%A` for a closing `%`, reading past
the end of the string.
It does not reproduce normally, but with page heap enabled it faults:
```
PS C:\> gflags /p /enable ruby.exe /full
PS C:\> ruby -e "system('x' * 1024 + '.exe %A')"
-e:1: [BUG] Segmentation fault
ruby 4.0.6 (2026-07-14 revision 03b6d3f) +PRISM [x64-mingw-ucrt]
-- Control frame information -----------------------------------------------
c:0003 p:---- s:0011 e:000010 l:y b:0001 CFUNC :system
c:0002 p:0013 s:0006 e:000005 l:n b:---- EVAL -e:1 [FINISH]
c:0001 p:0000 s:0003 E:001620 l:y b:---- DUMMY [FINISH]
-- Ruby level backtrace information ----------------------------------------
-e:1:in '<main>'
-e:1:in 'system'
-- Threading information ---------------------------------------------------
Total ractor count: 1
Ruby thread count for this ractor: 1
-- C level backtrace information -------------------------------------------
C:\WINDOWS\SYSTEM32\ntdll.dll(NtWaitForSingleObject+0x14) [0x00007ffbd55000e4]
C:\WINDOWS\System32\KERNELBASE.dll(WaitForSingleObjectEx+0xaf) [0x00007ffbd274c11f]
C:\Users\YusukeEndoh\scoop\apps\ruby\current\bin\x64-ucrt-ruby400.dll(rb_vm_bugreport+0x237) [0x00007ffb37262227]
C:\Users\YusukeEndoh\scoop\apps\ruby\current\bin\x64-ucrt-ruby400.dll(rb_bug_for_fatal_signal+0x9b) [0x00007ffb37000beb]
C:\Users\YusukeEndoh\scoop\apps\ruby\current\bin\x64-ucrt-ruby400.dll(rb_shape_free_all+0xfb5) [0x00007ffb37191985]
C:\WINDOWS\System32\ucrtbase.dll(seh_filter_exe+0x84) [0x00007ffbd2fff2e4]
[0x00007ff765e81080]
C:\WINDOWS\SYSTEM32\ntdll.dll(_chkstk+0x9f) [0x00007ffbd550479f]
*snip*
```
[Bug #22198]
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See Commits and Changes for more details.
Created by
pull[bot] (v2.0.0-alpha.4)
Can you help keep this open source service alive? 💖 Please sponsor : )