From: "kddnewton (Kevin Newton) via ruby-core" <ruby-core@...>
Date: 2026-11-09T22:07:58+00:00
Subject: [ruby-core:127389] [Ruby Bug#22527] Implicit super with a reassigned keyword rest writes into the shared frozen empty hash

Issue #22527 has been reported by kddnewton (Kevin Newton).

----------------------------------------
Bug #22527: Implicit super with a reassigned keyword rest writes into the shared frozen empty hash
https://bugs.ruby-lang.org/issues/22527

* Author: kddnewton (Kevin Newton)
* Status: Open
* Backport: 3.3: UNKNOWN, 3.4: UNKNOWN, 4.0: UNKNOWN
----------------------------------------
`zsuper` passes `rest.dup` as the left operand of the keyword merge. If the method reassigns its keyword-rest local, that value can be anything. Both compilers reach this through `merge_bang_ptr`, where `dup` is false, so it inserts into the shared frozen hash.

```ruby
class A; def m(*a, **k) = k; end
class B < A
  def m(k: 1, **r)
    r = nil
    super
  end
end
p B.new.m
```

Under 4.0 this was a TypeError, now it is an assertion failure in `ar_force_convert_table`.



-- 
https://bugs.ruby-lang.org/
______________________________________________
 ruby-core mailing list -- ruby-core@ml.ruby-lang.org
 To unsubscribe send an email to ruby-core-leave@ml.ruby-lang.org
 ruby-core info -- https://ml.ruby-lang.org/mailman3/lists/ruby-core.ml.ruby-lang.org/