From: "peterzhu2118 (Peter Zhu) via ruby-core" <ruby-core@...>
Date: 2026-09-16T08:22:10+00:00
Subject: [ruby-core:126739] [Ruby Bug#22321] Assertion Failed: rb_vm_search_method_slowpath:RB_TYPE_2_P(klass, RUBY_T_CLASS, RUBY_T_ICLASS): klass: T_MODULE

Issue #22321 has been updated by peterzhu2118 (Peter Zhu).


Thank you for the report, [I have a fix here](https://github.com/ruby/ruby/pull/18865).

----------------------------------------
Bug #22321: Assertion Failed: rb_vm_search_method_slowpath:RB_TYPE_2_P(klass, RUBY_T_CLASS, RUBY_T_ICLASS): klass: T_MODULE
https://bugs.ruby-lang.org/issues/22321#change-119036

* Author: 0599jiangyc@gmail.com (Yuancheng Jiang)
* Status: Open
* Backport: 3.3: UNKNOWN, 3.4: UNKNOWN, 4.0: UNKNOWN
----------------------------------------
The following program:

```ruby
def assert_equal(*a) = nil
bug15629_m1 = Module.new do
  def foo; end
end
bug15629_m2 = Module.new do
  def foo; end
end
bug15629_c = Class.new do
  include bug15629_m1
  include bug15629_m2
end
o  = bug15629_c.new
m = o.method(:foo)
sm = m.super_method
assert_equal(sm, m.unbind.bind(o).super_method)
begin ObjectSpace.each_object(sm.class).first(50).each(&:inspect); GC.start(full_mark: true, immediate_sweep: true); Marshal.load(Marshal.dump(sm)); rescue Exception; end  # dataflow fusion
```

makes the interpreter report:

```
../vm_insnhelper.c:2264: Assertion Failed: rb_vm_search_method_slowpath:RB_TYPE_2_P(klass, RUBY_T_CLASS, RUBY_T_ICLASS): klass: T_MODULE
ruby 4.1.0dev (2026-09-15T05:36:12Z master 3296d5c99c) [x86_64-linux]

-- Control frame information -----------------------------------------------
c:0004 p:---- s:0019 e:000018 l:y b:0001 r:(nil) CFUNC  :inspect
c:0003 p:---- s:0016 e:000015 l:y b:0001 r:(nil) CFUNC  :each
c:0002 p:0087 s:0012 E:001198 l:n b:---- r:(nil) EVAL   /tmp/test.rb:16 [FINISH]
c:0001 p:0000 s:0003 E:001ed8 l:y b:---- r:(nil) DUMMY  [FINISH]

-- Ruby level backtrace information ----------------------------------------
/tmp/test.rb:16:in '<main>'
/tmp/test.rb:16:in 'each'
/tmp/test.rb:16:in 'inspect'

-- Threading information ---------------------------------------------------
Total ractor count: 1
Ruby thread count for this ractor: 1

-- C level backtrace information -------------------------------------------
/home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby(___interceptor_backtrace) [0x56e7d13b671a]
/home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby(rb_print_backtrace+0x14) [0x56e7d18914ea] /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../vm_dump.c:1113
/home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby(rb_vm_bugreport) /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../vm_dump.c:1479
/home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby(rb_assert_failure_detail+0x233) [0x56e7d1371b2b] /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../error.c:1258
/home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby(rb_vm_search_method_slowpath+0x558) [0x56e7d17f1478]
/home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby(vm_search_method_slowpath0+0x32) [0x56e7d17f2ca2] ../vm_insnhelper.c:2295
/home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby(gccct_method_search_slowpath+0x4d) [0x56e7d184980d] ../vm_eval.c:419
/home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby(rb_funcallv_scope+0x1a4) [0x56e7d18280c4] ../vm_eval.c:1064
/home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby(rb_inspect+0x15) [0x56e7d15a2335] /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../object.c:733
/home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby(method_inspect+0x52b) [0x56e7d15c81ab] /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../proc.c:4101
/home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby(vm_call0_body+0x100a) [0x56e7d18759ba] ../vm_eval.c:164
/home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby(rb_call0+0x4c5) [0x56e7d1878705] ../vm_eval.c:101
/home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby(rb_funcall_with_block_kw+0x14d) [0x56e7d1829b7d] ../vm_eval.c:896
/home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby(vm_yield_with_symbol+0x1ff) [0x56e7d187ce8f] ../vm_insnhelper.c:5291
/home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/b
```

To reproduce:

```
/home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby --disable-gems --parser=parse.y /tmp/test.rb
```

Commit:

```
3296d5c99ce005e4698fb27a405e01d766ad2647
```

Build configuration:

```
../configure --prefix=... CC=clang-18 cflags="-fsanitize=address -fno-omit-frame-pointer -DUSE_MN_THREADS=0" cppflags="-DRUBY_DEBUG=1" optflags="-O1"
```

Operating System:

```
Ubuntu 24.04 host, Docker ffe-ruby:latest
```

*This bug was found by [fusion-fuzz](https://github.com/fusion-fuzz/fusion-fuzz)*



-- 
https://bugs.ruby-lang.org/
______________________________________________
 ruby-core mailing list -- ruby-core@ml.ruby-lang.org
 To unsubscribe send an email to ruby-core-leave@ml.ruby-lang.org
 ruby-core info -- https://ml.ruby-lang.org/mailman3/lists/ruby-core.ml.ruby-lang.org/