[ruby-core:17439] Re: URGENT: Possible fixes for segfaults and vulnerabilities available for review in ruby-talk

Tanaka Akira wrote:
> In article <[e-mail]>,
>   Igal Koshevoy <[e-mail]> writes:
>
>   
>> I think these are bugs in Ruby, not in RubySpec. The code in these 
>> worked correctly without any guard conditions on my older interpreter, 
>> therefore if the new version is failing these, something has changed. 
>> Can you or someone else please review these specs to confirm this?
>>     
>
> ERB tests compare Ruby code generated internaly in ERB.
> It is internal of ERB.  RubySpec shouldn't specify library
> internals.
>   
Ah! Correct. I've reviewed that code more carefully and see what you 
mean. The ERB spec is comparing the Ruby code generated, which it really 
should be comparing just the output.

> Singleton#_dump should be public.  It is discussed recently
> in ruby-core.  This is a bug fix.  RubySpec shouldn't
> specify a bug.
>   
I see, thank you for the explanation.

>> Just to be clear, REXML has some errors due to the guard conditions 
>> explained in the "RubySpec bugs" section above. However, some of the 
>> REXML errors were in examples without guard conditions, therefore I 
>> think they're Ruby errors.
>>     
> Do you want to fix REXML problems in 1.8.6 line?
>   
I'd personally like to see the patch that Federico Builes reviewed, 
improved and applied if it seems reasonable. At the very least, Ruby 
shouldn't be shipping a library that fails due to a syntax error in it.

However, there are some unguarded REXML examples that are failing, which 
may indicate a new Ruby bug/incompatibility. I also think there's 
another Ruby problem exposed by "library/bigdecimal/divmod_spec.rb".  So 
if you or someone else can review these, I'd appreciate it.

So the list of things we think may be broken based on reviewing 
RubySpec's logs seem to be:
  Module#remove_method
  String#%
  Iconv
  ERB (?)
  BigDecimal (?)

Thank you again for the assistance.

-igal