[ruby-core:121490] [Ruby Bug#21208] `Ractor#send(move: true)` allow moving objects that are on the stack, and used by C code.
From:
"byroot (Jean Boussier) via ruby-core" <ruby-core@...>
Date:
2025-03-31 18:49:51 UTC
List:
ruby-core #121490
Issue #21208 has been reported by byroot (Jean Boussier).
----------------------------------------
Bug #21208: `Ractor#send(move: true)` allow moving objects that are on the stack, and used by C code.
https://bugs.ruby-lang.org/issues/21208
* Author: byroot (Jean Boussier)
* Status: Open
* Assignee: ractor
* Backport: 3.1: UNKNOWN, 3.2: UNKNOWN, 3.3: UNKNOWN, 3.4: UNKNOWN
----------------------------------------
The following script causes a crash:
```ruby
rac = Ractor.new do
Ractor.receive
end
hash = Hash[*50.times]
hash.merge!(12 => 0, 14 => 0) do |key, old_val, new_val|
if key == 12
rac.send(hash, move: true)
end
new_val
end
p rac.take
```
Contrary to previous crashes related to `send(move: true)`, I'm afraid this one is with the design of the feature itself, not just the implementation.
If we allow objects to be moved, any C code that calls `rb_yield()` may cause memory corruption if one of the objects it uses is moved.
I personally can't see any realistic solution to this.
--
https://bugs.ruby-lang.org/
______________________________________________
ruby-core mailing list -- [email protected]
To unsubscribe send an email to [email protected]
ruby-core info -- https://ml.ruby-lang.org/mailman3/lists/ruby-core.ml.ruby-lang.org/