From: "alanwu (Alan Wu) via ruby-core" <ruby-core@...>
Date: 2026-08-18T21:07:27+00:00
Subject: [ruby-core:126438] [Ruby Bug#22237] GC.auto_compact corrupts a String or segfaults from String#tr with dup or gsub

Issue #22237 has been updated by alanwu (Alan Wu).

Backport changed from 4.0: REQUIRED to 4.0: DONE

Backport PR was merged https://github.com/ruby/ruby/pull/18290

----------------------------------------
Bug #22237: GC.auto_compact corrupts a String or segfaults from String#tr with dup or gsub
https://bugs.ruby-lang.org/issues/22237#change-118585

* Author: curi (Elliot Temple)
* Status: Closed
* ruby -v: ruby 4.0.6 (2026-07-14 revision 03b6d3f889) +YJIT +PRISM [arm64-darwin25]
* Backport: 4.0: DONE
----------------------------------------
`GC.auto_compact = true` can cause memory corruption or segfaults with string methods. Ruby 4.0.6, arm64 macOS, YJIT enabled, 100 runs: 35 clean, 27 corruption, 38 segfault. I also saw the issue with Ruby 4.0.4, x86-64 Debian, or YJIT disabled.

``` ruby
# ruby --disable-gems autocompact-test.rb

puts RUBY_DESCRIPTION
input = "aaa"
iterations = Integer(ENV.fetch("ITERATIONS", 10_000_000))
$stdout.sync = true
GC.auto_compact = true
Object.new # increases chance of memory corruption or segfault

iterations.times do |i|
  s = input.tr("\u0080", "\u20AC").dup
  # gsub(/x/, "") instead of dup works too
  # the tr, gsub and dup should all return the original input bytes

  unless s == input
    warn "Corrupt output at iteration #{i}: #{s.bytes.inspect}"
    warn GC.stat.slice(:major_gc_count, :compact_count, :total_moved_objects).inspect
    exit 2
  end
end
```



-- 
https://bugs.ruby-lang.org/
______________________________________________
 ruby-core mailing list -- ruby-core@ml.ruby-lang.org
 To unsubscribe send an email to ruby-core-leave@ml.ruby-lang.org
 ruby-core info -- https://ml.ruby-lang.org/mailman3/lists/ruby-core.ml.ruby-lang.org/