From: "0599jiangyc@... (Yuancheng Jiang) via ruby-core" <ruby-core@...>
Date: 2026-09-18T04:14:35+00:00
Subject: [ruby-core:126768] [Ruby Bug#22333] Assertion Failed: ary_resize_capa:RARRAY_LEN(ary) <= capacity

Issue #22333 has been reported by 0599jiangyc@gmail.com (Yuancheng Jiang).

----------------------------------------
Bug #22333: Assertion Failed: ary_resize_capa:RARRAY_LEN(ary) <= capacity
https://bugs.ruby-lang.org/issues/22333

* Author: 0599jiangyc@gmail.com (Yuancheng Jiang)
* Status: Open
* Backport: 3.3: UNKNOWN, 3.4: UNKNOWN, 4.0: UNKNOWN
----------------------------------------
The following program:

```ruby
def assert_raise(*a) = (yield rescue nil)
MIN_SIZE = ENV.fetch('SMALL_ARRAY_MIN', 0).to_i
MAX_SIZE = ENV.fetch('SMALL_ARRAY_MAX', 16).to_i
ITERATIONS = ENV.fetch('SMALL_ARRAY_ITERATIONS', 100).to_i
ARRAYS = (MIN_SIZE..MAX_SIZE).map do |size1|
  (MIN_SIZE..MAX_SIZE).map do |size2|
  end
end
ITERATIONS.times do
  ARRAYS.each do |group|
    group.each do |arr1, arr2|
    end
  end
end
assert_raise(FrozenError) { ARRAYS.instance_eval { initialize 3, 4 } }  # dataflow fusion
```

makes the interpreter report:

```
../array.c:423: Assertion Failed: ary_resize_capa:RARRAY_LEN(ary) <= capacity
ruby 4.1.0dev (2026-09-15T05:36:12Z master 3296d5c99c) [x86_64-linux]

-- Control frame information -----------------------------------------------
c:0007 p:---- s:0027 e:000026 l:y b:0001 r:(nil) CFUNC  :initialize
c:0006 p:0007 s:0021 e:000020 l:n b:---- r:(nil) BLOCK  /tmp/test.rb:15 [FINISH]
c:0005 p:---- s:0018 e:000017 l:y b:0001 r:(nil) CFUNC  :instance_eval
c:0004 p:0005 s:0014 e:000013 l:n b:---- r:(nil) BLOCK  /tmp/test.rb:15
c:0003 p:0002 s:0011 e:000010 l:y b:0001 r:(nil) METHOD /tmp/test.rb:1
c:0002 p:0069 s:0006 e:000005 l:n b:---- r:(nil) EVAL   /tmp/test.rb:15 [FINISH]
c:0001 p:0000 s:0003 E:001ed8 l:y b:---- r:(nil) DUMMY  [FINISH]

-- Ruby level backtrace information ----------------------------------------
/tmp/test.rb:15:in '<main>'
/tmp/test.rb:1:in 'assert_raise'
/tmp/test.rb:15:in 'block in <main>'
/tmp/test.rb:15:in 'instance_eval'
/tmp/test.rb:15:in 'block (2 levels) in <main>'
/tmp/test.rb:15:in 'initialize'

-- Threading information ---------------------------------------------------
Total ractor count: 1
Ruby thread count for this ractor: 1

-- C level backtrace information -------------------------------------------
/home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby(___interceptor_backtrace) [0x5e65f4ed571a]
/home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby(rb_print_backtrace+0x14) [0x5e65f53b04ea] /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../vm_dump.c:1113
/home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby(rb_vm_bugreport) /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../vm_dump.c:1479
/home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby(rb_assert_failure_detail+0x233) [0x5e65f4e90b2b] /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../error.c:1258
/home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby(rb_assert_failure_detail+0x0) [0x5e65f4e908f8] /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../error.c:1234
/home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby(rb_assert_failure) (null):0
/home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby(ary_resize_capa+0x4a5) [0x5e65f5403485] /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../array.c:423
/home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby(rb_ary_initialize+0x308) [0x5e65f540f948] /home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/ruby-src/build/../array.c:1181
/home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby(vm_call_cfunc_with_frame_+0x27b) [0x5e65f537f20b] ../vm_insnhelper.c:3904
/home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby(vm_call_method_each_type+0x24a) [0x5e65f53694ba] ../vm_insnhelper.c:4896
/home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby(vm_call_method+0x39f) [0x5e65f5368c4f]
/home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby(vm_exec_core+0x113dc) [0x5
```

To reproduce:

```
/home/fuzz/WorkSpace/fusion-fuzz/projects/ruby/install/bin/ruby --disable-gems --parser=parse.y /tmp/test.rb
```

Commit:

```
3296d5c99ce005e4698fb27a405e01d766ad2647
```

Build configuration:

```
../configure --prefix=... CC=clang-18 cflags="-fsanitize=address -fno-omit-frame-pointer -DUSE_MN_THREADS=0" cppflags="-DRUBY_DEBUG=1" optflags="-O1"
```

Operating System:

```
Ubuntu 24.04 host, Docker ffe-ruby:latest
```

*This bug was found by [fusion-fuzz](https://github.com/fusion-fuzz/fusion-fuzz)*



-- 
https://bugs.ruby-lang.org/
______________________________________________
 ruby-core mailing list -- ruby-core@ml.ruby-lang.org
 To unsubscribe send an email to ruby-core-leave@ml.ruby-lang.org
 ruby-core info -- https://ml.ruby-lang.org/mailman3/lists/ruby-core.ml.ruby-lang.org/