From: "tekknolagi (Maxwell Bernstein) via ruby-core" <ruby-core@...>
Date: 2026-09-22T14:20:43+00:00
Subject: [ruby-core:126826] [Ruby Bug#22341] Class#superclass can crash the interpreter in debug build

Issue #22341 has been reported by tekknolagi (Maxwell Bernstein).

----------------------------------------
Bug #22341: Class#superclass can crash the interpreter in debug build
https://bugs.ruby-lang.org/issues/22341

* Author: tekknolagi (Maxwell Bernstein)
* Status: Open
* Backport: 3.3: UNKNOWN, 3.4: UNKNOWN, 4.0: UNKNOWN
----------------------------------------
While implementing this in ZJIT, @nirvdrum reported, and I investigated, a potential interpreter crash:

    module M; end
    C = Class.allocate
    C.include M
    C.superclass

In a debug build, this crashes:

    plum% ./build-dev/miniruby crash.rb
    ../object.c:2398: Assertion Failed: rb_class_superclass:!RCLASS_SUPER(klass)
    ruby 4.1.0dev (2026-09-22T14:09:58Z mb-class-superclass 05c0248e3a) +PRISM [arm64-darwin25]
    
    -- Crash Report log information --------------------------------------------
       See Crash Report log file in one of the following locations:
         * ~/Library/Logs/DiagnosticReports
         * /Library/Logs/DiagnosticReports
       for more details.
    Don't forget to include the above Crash Report log file in bug reports.
    
    -- Control frame information -----------------------------------------------
    c:0003 p:---- s:0010 e:000009 l:y b:0001 r:0x0 CFUNC  :superclass
    c:0002 p:0027 s:0006 e:000005 l:n b:---- r:0x0 EVAL   crash.rb:4 [FINISH]
    c:0001 p:0000 s:0003 E:001fc8 l:y b:---- r:0x0 DUMMY  [FINISH]
    
    -- Ruby level backtrace information ----------------------------------------
    crash.rb:4:in '<main>'
    crash.rb:4:in 'superclass'
    
    -- Threading information ---------------------------------------------------
    Total ractor count: 1
    Ruby thread count for this ractor: 1
    
    -- C level backtrace information -------------------------------------------
    /Users/emacs/Documents/code/ruby/build-dev/miniruby(rb_print_backtrace+0x24) [0x100b210c4] /Users/emacs/Documents/code/ruby/build-dev/../vm_dump.c:1113
    /Users/emacs/Documents/code/ruby/build-dev/miniruby(rb_print_backtrace) (null):0
    /Users/emacs/Documents/code/ruby/build-dev/miniruby(rb_vm_bugreport+0x3ac) [0x100b21490] /Users/emacs/Documents/code/ruby/build-dev/../vm_dump.c:1479
    /Users/emacs/Documents/code/ruby/build-dev/miniruby(rb_assert_failure_detail+0x138) [0x10079c6b4] /Users/emacs/Documents/code/ruby/build-dev/../error.c:1258
    /Users/emacs/Documents/code/ruby/build-dev/miniruby(rb_assert_failure_detail+0x0) [0x10079c57c] /Users/emacs/Documents/code/ruby/build-dev/../error.c:1234
    /Users/emacs/Documents/code/ruby/build-dev/miniruby(rb_assert_failure) (null):0
    /Users/emacs/Documents/code/ruby/build-dev/miniruby(rb_class_superclass+0x254) [0x1008b1d18] /Users/emacs/Documents/code/ruby/build-dev/../object.c:2398
    /Users/emacs/Documents/code/ruby/build-dev/miniruby(ractor_safe_call_cfunc_0+0x30) [0x100b0a8bc] ../vm_insnhelper.c:3720
    /Users/emacs/Documents/code/ruby/build-dev/miniruby(vm_call_cfunc_with_frame_+0x290) [0x100af8900] ../vm_insnhelper.c:3904
    /Users/emacs/Documents/code/ruby/build-dev/miniruby(vm_call_cfunc_with_frame+0x6c) [0x100af8bfc] ../vm_insnhelper.c:3950
    /Users/emacs/Documents/code/ruby/build-dev/miniruby(vm_call_cfunc_other+0x38c) [0x100af84d0] ../vm_insnhelper.c:3976
    /Users/emacs/Documents/code/ruby/build-dev/miniruby(vm_call_cfunc+0x128) [0x100aede50] ../vm_insnhelper.c:4058
    /Users/emacs/Documents/code/ruby/build-dev/miniruby(vm_call_method_each_type+0x200) [0x100aecf90] ../vm_insnhelper.c:4896
    /Users/emacs/Documents/code/ruby/build-dev/miniruby(vm_call_method+0xe8) [0x100aecba4] ../vm_insnhelper.c:5022
    /Users/emacs/Documents/code/ruby/build-dev/miniruby(vm_call_general+0x28) [0x100a9b1f8] ../vm_insnhelper.c:5066
    /Users/emacs/Documents/code/ruby/build-dev/miniruby(vm_sendish+0x708) [0x100ab4424] ../vm_insnhelper.c:6283
    /Users/emacs/Documents/code/ruby/build-dev/miniruby(vm_exec_core) ../insns.def:911
    /Users/emacs/Documents/code/ruby/build-dev/miniruby(rb_vm_exec+0x118) [0x100a9c92c] /Users/emacs/Documents/code/ruby/build-dev/../vm.c:2901
    /Users/emacs/Documents/code/ruby/build-dev/miniruby(rb_iseq_eval_main+0x34) [0x100adef20] /Users/emacs/Documents/code/ruby/build-dev/../vm.c:3254
    /Users/emacs/Documents/code/ruby/build-dev/miniruby(rb_ec_exec_node+0x100) [0x1007ac1f8] /Users/emacs/Documents/code/ruby/build-dev/../eval.c:300
    /Users/emacs/Documents/code/ruby/build-dev/miniruby(ruby_run_node+0x94) [0x1007ac0ac] /Users/emacs/Documents/code/ruby/build-dev/../eval.c:338
    /Users/emacs/Documents/code/ruby/build-dev/miniruby(rb_main+0x40) [0x10067ca2c] /Users/emacs/Documents/code/ruby/build-dev/../main.c:42
    /Users/emacs/Documents/code/ruby/build-dev/miniruby(main+0x70) [0x10067c9b8] /Users/emacs/Documents/code/ruby/build-dev/../main.c:62



-- 
https://bugs.ruby-lang.org/
______________________________________________
 ruby-core mailing list -- ruby-core@ml.ruby-lang.org
 To unsubscribe send an email to ruby-core-leave@ml.ruby-lang.org
 ruby-core info -- https://ml.ruby-lang.org/mailman3/lists/ruby-core.ml.ruby-lang.org/