From: "byroot (Jean Boussier) via ruby-core" <ruby-core@...>
Date: 2025-03-31T18:49:51+00:00
Subject: [ruby-core:121490] [Ruby Bug#21208] `Ractor#send(move: true)` allow moving objects that are on the stack, and used by C code.

Issue #21208 has been reported by byroot (Jean Boussier).

----------------------------------------
Bug #21208: `Ractor#send(move: true)` allow moving objects that are on the stack, and used by C code.
https://bugs.ruby-lang.org/issues/21208

* Author: byroot (Jean Boussier)
* Status: Open
* Assignee: ractor
* Backport: 3.1: UNKNOWN, 3.2: UNKNOWN, 3.3: UNKNOWN, 3.4: UNKNOWN
----------------------------------------
The following script causes a crash:

```ruby
rac = Ractor.new do
  Ractor.receive
end

hash = Hash[*50.times]

hash.merge!(12 => 0, 14 => 0) do |key, old_val, new_val|
  if key == 12
    rac.send(hash, move: true)
  end
  new_val
end

p rac.take
```

Contrary to previous crashes related to `send(move: true)`, I'm afraid this one is with the design of the feature itself, not just the implementation.

If we allow objects to be moved, any C code that calls `rb_yield()` may cause memory corruption if one of the objects it uses is moved.

I personally can't see any realistic solution to this.



-- 
https://bugs.ruby-lang.org/
 ______________________________________________
 ruby-core mailing list -- ruby-core@ml.ruby-lang.org
 To unsubscribe send an email to ruby-core-leave@ml.ruby-lang.org
 ruby-core info -- https://ml.ruby-lang.org/mailman3/lists/ruby-core.ml.ruby-lang.org/