Merge branch 'master' into jit-ci-crash-report

Author: XrXr

.github/actions/capiext/action.yml

@@ -50,24 +50,34 @@ runs:
         touch spec/ruby/optional/capi/ext/*.$DLEXT
         [ ! -f spec/ruby/optional/capi/ext/\*.$DLEXT ]
         ${{ inputs.make }} SPECOPTS=optional/capi test-spec
-        rm -f spec/ruby/optional/capi/ext/*.c
       env:
         DLEXT: ${{ steps.config.outputs.DLEXT }}
       working-directory: ${{ inputs.builddir }}
       if: ${{ steps.cache.outputs.cache-hit }}
 
-    - name: Save CAPI extensions
-      uses: actions/cache/save@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
-      with:
-        path: ${{ inputs.builddir }}/spec/ruby/optional/capi/ext/
-        key: ${{ steps.config.outputs.key }}
+    - name: Strip CAPI extensions
+      id: strip
+      shell: bash
+      run: |
+        rm -f spec/ruby/optional/capi/ext/*.c
+        [ "$DLEXT" = bundle ] || # separated to .dSYM directories
+        strip spec/ruby/optional/capi/ext/*.$DLEXT
+      env:
+        DLEXT: ${{ steps.config.outputs.DLEXT }}
+      working-directory: ${{ inputs.builddir }}
       if: >-
         ${{true
-        && steps.cache.outcome == 'success'
         && ! steps.cache.outputs.cache-hit
         && github.ref_name == 'master'
         }}
 
+    - name: Save CAPI extensions
+      uses: actions/cache/save@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
+      with:
+        path: ${{ inputs.builddir }}/spec/ruby/optional/capi/ext/
+        key: ${{ steps.config.outputs.key }}
+      if: ${{ steps.strip.outcome == 'success' }}
+
     - shell: bash
       run: |
         echo "::error::Change from ${prev} detected; bump up ABI version"

.github/workflows/ubuntu.yml

@@ -40,9 +40,9 @@ jobs:
           - test_task: check
             os: ubuntu-24.04
             extra_checks: [capi]
-          # ubuntu-24.04-arm jobs don't start on ruby/ruby as of 2025-09-04
-          #- test_task: check
-          #  os: ubuntu-24.04-arm
+          - test_task: check
+            os: ubuntu-24.04-arm
+            extra_checks: [capi]
       fail-fast: false
 
     env:

array.c

@@ -695,6 +695,11 @@ ary_alloc_heap(VALUE klass)
     NEWOBJ_OF(ary, struct RArray, klass,
                      T_ARRAY | (RGENGC_WB_PROTECTED_ARRAY ? FL_WB_PROTECTED : 0),
                      sizeof(struct RArray), 0);
+
+    ary->as.heap.len = 0;
+    ary->as.heap.aux.capa = 0;
+    ary->as.heap.ptr = NULL;
+
     return (VALUE)ary;
 }
 
@@ -808,6 +813,11 @@ ec_ary_alloc_heap(rb_execution_context_t *ec, VALUE klass)
     NEWOBJ_OF(ary, struct RArray, klass,
             T_ARRAY | (RGENGC_WB_PROTECTED_ARRAY ? FL_WB_PROTECTED : 0),
             sizeof(struct RArray), ec);
+
+    ary->as.heap.len = 0;
+    ary->as.heap.aux.capa = 0;
+    ary->as.heap.ptr = NULL;
+
     return (VALUE)ary;
 }
 

bignum.c

@@ -3055,7 +3055,9 @@ bignew_1(VALUE klass, size_t len, int sign)
 VALUE
 rb_big_new(size_t len, int sign)
 {
-    return bignew(len, sign != 0);
+    VALUE obj = bignew(len, sign != 0);
+    memset(BIGNUM_DIGITS(obj), 0, len * sizeof(BDIGIT));
+    return obj;
 }
 
 VALUE

class.c

@@ -682,6 +682,8 @@ class_alloc0(enum ruby_value_type type, VALUE klass, bool namespaceable)
 
     NEWOBJ_OF(obj, struct RClass, klass, flags, alloc_size, 0);
 
+    obj->object_id = 0;
+
     memset(RCLASS_EXT_PRIME(obj), 0, sizeof(rb_classext_t));
 
     /* ZALLOC

common.mk

@@ -44,6 +44,10 @@ RUBYLIB       = $(PATH_SEPARATOR)
 RUBYOPT       = -
 RUN_OPTS      = --disable-gems
 
+GIT_IN_SRC    = $(GIT) -C $(srcdir)
+GIT_LOG       = $(GIT_IN_SRC) log --no-show-signature
+GIT_LOG_FORMAT = $(GIT_LOG) --pretty=format:
+
 # GITPULLOPTIONS = --no-tags
 
 PRISM_SRCDIR = $(srcdir)/prism
@@ -1514,8 +1518,8 @@ update-bundled_gems: PHONY
 	     $(tooldir)/update-bundled_gems.rb \
 	     "$(srcdir)/gems/bundled_gems" | \
 	$(IFCHANGE) "$(srcdir)/gems/bundled_gems" -
-	$(GIT) -C "$(srcdir)" diff --no-ext-diff --ignore-submodules --exit-code || \
-	$(GIT) -C "$(srcdir)" commit -m "Update bundled_gems" gems/bundled_gems
+	$(GIT_IN_SRC) diff --no-ext-diff --ignore-submodules --exit-code || \
+	$(GIT_IN_SRC) commit -m "Update bundled_gems" gems/bundled_gems
 
 PRECHECK_BUNDLED_GEMS = yes
 test-bundled-gems-precheck: $(TEST_RUNNABLE)-test-bundled-gems-precheck
@@ -1899,8 +1903,8 @@ nightly: yesterday $(DOT_WAIT) install
 yesterday: rewindable
 
 rewindable:
-	$(GIT) -C $(srcdir) status --porcelain
-	$(GIT) -C $(srcdir) diff --quiet
+	$(GIT_IN_SRC) status --porcelain
+	$(GIT_IN_SRC) diff --quiet
 
 HELP_EXTRA_TASKS = ""
 

configure.ac

@@ -107,10 +107,18 @@ HAVE_GIT=yes
 AC_ARG_WITH(git,
 	AS_HELP_STRING([--without-git], [never use git]),
 	[AS_CASE([$withval],
-	    [no],  [GIT=never-use HAVE_GIT=no],
+	    [no],  [HAVE_GIT=no],
 	    [yes], [],
 	    [GIT=$withval])])
-AS_IF([test x"$HAVE_GIT" = xyes], [command -v "$GIT" > /dev/null || HAVE_GIT=no])
+{
+    test x"$HAVE_GIT" = xyes &&
+    command -v "$GIT" > /dev/null &&
+    # `git -C`: 1.8.5
+    # `git log --no-show-signature`: 2.10.0
+    AS_CASE([`$GIT -C . --version 2> /dev/null | sed 's/.* //'`],
+    [0.*|1.*|2.@<:@0-9@:>@.*], [false],
+    [true])
+} || HAVE_GIT=no GIT=never-use
 AC_SUBST(GIT)
 AC_SUBST(HAVE_GIT)
 
@@ -3966,7 +3974,7 @@ AS_CASE(["${ZJIT_SUPPORT}"],
     [yes], [
     ],
     [dev], [
-        rb_cargo_features="$rb_cargo_features,disasm"
+        rb_cargo_features="$rb_cargo_features,disasm,runtime_checks"
         JIT_CARGO_SUPPORT=dev
         AC_DEFINE(RUBY_DEBUG, 1)
     ],

defs/gmake.mk

@@ -220,8 +220,8 @@ post-commit: $(if $(DOT_WAIT),,do-commit)
 GITHUB_RUBY_URL = https://github.com/ruby/ruby
 PR =
 
-COMMIT_GPG_SIGN = $(shell $(GIT) -C "$(srcdir)" config commit.gpgsign)
-REMOTE_GITHUB_URL = $(shell $(GIT) -C "$(srcdir)" config remote.github.url)
+COMMIT_GPG_SIGN = $(shell $(GIT_IN_SRC) config commit.gpgsign)
+REMOTE_GITHUB_URL = $(shell $(GIT_IN_SRC) config remote.github.url)
 COMMITS_NOTES = commits
 
 .PHONY: fetch-github
@@ -236,19 +236,19 @@ define fetch-github
 	$(eval REMOTE_GITHUB_URL := $(REMOTE_GITHUB_URL))
 	$(if $(REMOTE_GITHUB_URL),,
 	  echo adding $(GITHUB_RUBY_URL) as remote github
-	  $(GIT) -C "$(srcdir)" remote add github $(GITHUB_RUBY_URL)
-	  $(GIT) -C "$(srcdir)" config --add remote.github.fetch +refs/notes/$(COMMITS_NOTES):refs/notes/$(COMMITS_NOTES)
+	  $(GIT_IN_SRC) remote add github $(GITHUB_RUBY_URL)
+	  $(GIT_IN_SRC) config --add remote.github.fetch +refs/notes/$(COMMITS_NOTES):refs/notes/$(COMMITS_NOTES)
 	  $(eval REMOTE_GITHUB_URL := $(GITHUB_RUBY_URL))
 	)
-	$(if $(shell $(GIT) -C "$(srcdir)" rev-parse "github/pull/$(1)/head" -- 2> /dev/null),
-	    $(GIT) -C "$(srcdir)" branch -f "gh-$(1)" "github/pull/$(1)/head",
-	    $(GIT) -C "$(srcdir)" fetch -f github "pull/$(1)/head:gh-$(1)"
+	$(if $(shell $(GIT_IN_SRC) rev-parse "github/pull/$(1)/head" -- 2> /dev/null),
+	    $(GIT_IN_SRC) branch -f "gh-$(1)" "github/pull/$(1)/head",
+	    $(GIT_IN_SRC) fetch -f github "pull/$(1)/head:gh-$(1)"
 	)
 endef
 
 .PHONY: checkout-github
 checkout-github: fetch-github
-	$(GIT) -C "$(srcdir)" checkout "gh-$(PR)"
+	$(GIT_IN_SRC) checkout "gh-$(PR)"
 
 .PHONY: update-github
 update-github: fetch-github
@@ -261,25 +261,25 @@ update-github: fetch-github
 	$(eval PR_BRANCH := $(word 2,$(PULL_REQUEST_FORK_BRANCH)))
 
 	$(eval GITHUB_UPDATE_WORKTREE := $(shell mktemp -d "$(srcdir)/gh-$(PR)-XXXXXX"))
-	$(GIT) -C "$(srcdir)" worktree add $(notdir $(GITHUB_UPDATE_WORKTREE)) "gh-$(PR)"
+	$(GIT_IN_SRC) worktree add $(notdir $(GITHUB_UPDATE_WORKTREE)) "gh-$(PR)"
 	$(GIT) -C "$(GITHUB_UPDATE_WORKTREE)" merge master --no-edit
 	@$(BASERUBY) -e 'print "Are you sure to push this to PR=$(PR)? [Y/n]: "; exit(gets.chomp != "n")'
-	$(GIT) -C "$(srcdir)" remote add fork-$(PR) git@github.com:$(FORK_REPO).git
+	$(GIT_IN_SRC) remote add fork-$(PR) git@github.com:$(FORK_REPO).git
 	$(GIT) -C "$(GITHUB_UPDATE_WORKTREE)" push fork-$(PR) gh-$(PR):$(PR_BRANCH)
-	$(GIT) -C "$(srcdir)" remote rm fork-$(PR)
-	$(GIT) -C "$(srcdir)" worktree remove $(notdir $(GITHUB_UPDATE_WORKTREE))
-	$(GIT) -C "$(srcdir)" branch -D gh-$(PR)
+	$(GIT_IN_SRC) remote rm fork-$(PR)
+	$(GIT_IN_SRC) worktree remove $(notdir $(GITHUB_UPDATE_WORKTREE))
+	$(GIT_IN_SRC) branch -D gh-$(PR)
 
 .PHONY: pull-github
 pull-github: fetch-github
 	$(call pull-github,$(PR))
 
 define pull-github
-	$(eval GITHUB_MERGE_BASE := $(shell $(GIT) -C "$(srcdir)" log -1 --format=format:%H))
-	$(eval GITHUB_MERGE_BRANCH := $(shell $(GIT) -C "$(srcdir)" symbolic-ref --short HEAD))
+	$(eval GITHUB_MERGE_BASE := $(shell $(GIT_LOG_FORMAT):%H -1)
+	$(eval GITHUB_MERGE_BRANCH := $(shell $(GIT_IN_SRC) symbolic-ref --short HEAD))
 	$(eval GITHUB_MERGE_WORKTREE := $(shell mktemp -d "$(srcdir)/gh-$(1)-XXXXXX"))
-	$(GIT) -C "$(srcdir)" worktree prune
-	$(GIT) -C "$(srcdir)" worktree add $(notdir $(GITHUB_MERGE_WORKTREE)) "gh-$(1)"
+	$(GIT_IN_SRC) worktree prune
+	$(GIT_IN_SRC) worktree add $(notdir $(GITHUB_MERGE_WORKTREE)) "gh-$(1)"
 	$(GIT) -C "$(GITHUB_MERGE_WORKTREE)" rebase $(GITHUB_MERGE_BRANCH)
 	$(eval COMMIT_GPG_SIGN := $(COMMIT_GPG_SIGN))
 	$(if $(filter true,$(COMMIT_GPG_SIGN)), \
@@ -294,7 +294,7 @@ fetch-github-%:
 
 .PHONY: checkout-github-%
 checkout-github-%: fetch-github-%
-	$(GIT) -C "$(srcdir)" checkout "gh-$*"
+	$(GIT_IN_SRC) checkout "gh-$*"
 
 .PHONY: pr-% pull-github-%
 pr-% pull-github-%: fetch-github-%
@@ -433,7 +433,7 @@ ifneq ($(DOT_WAIT),)
 endif
 
 ifeq ($(HAVE_GIT),yes)
-REVISION_LATEST := $(shell $(CHDIR) $(srcdir) && $(GIT) log -1 --format=%H 2>/dev/null)
+REVISION_LATEST := $(shell $(GIT_LOG_FORMAT)%H -1 2>/dev/null)
 else
 REVISION_LATEST := update
 endif
@@ -495,7 +495,7 @@ endif
 update-deps:
 	$(eval update_deps := $(shell date +update-deps-%Y%m%d))
 	$(eval deps_dir := $(shell mktemp -d)/$(update_deps))
-	$(eval GIT_DIR := $(shell $(GIT) -C $(srcdir) rev-parse --absolute-git-dir))
+	$(eval GIT_DIR := $(shell $(GIT_IN_SRC) rev-parse --absolute-git-dir))
 	$(GIT) --git-dir=$(GIT_DIR) worktree add $(deps_dir)
 	cp $(tooldir)/config.guess $(tooldir)/config.sub $(deps_dir)/tool
 	[ -f config.status ] && cp config.status $(deps_dir)
@@ -543,13 +543,13 @@ matz: up
 	$(eval NEW := $(MAJOR).$(MINOR).0)
 	$(eval message := Development of $(NEW) started.)
 	$(eval files := include/ruby/version.h include/ruby/internal/abi.h)
-	$(GIT) -C $(srcdir) mv -f NEWS.md doc/NEWS/NEWS-$(OLD).md
-	$(GIT) -C $(srcdir) commit -m "[DOC] Flush NEWS.md"
+	$(GIT_IN_SRC) mv -f NEWS.md doc/NEWS/NEWS-$(OLD).md
+	$(GIT_IN_SRC) commit -m "[DOC] Flush NEWS.md"
 	sed -i~ \
 	-e "s/^\(#define RUBY_API_VERSION_MINOR\) .*/\1 $(MINOR)/" \
 	-e "s/^\(#define RUBY_ABI_VERSION\) .*/\1 0/" \
 	 $(files:%=$(srcdir)/%)
-	$(GIT) -C $(srcdir) add $(files)
+	$(GIT_IN_SRC) add $(files)
 	$(BASERUBY) -C $(srcdir) -p -00 \
 	-e 'BEGIN {old, new = ARGV.shift(2); STDOUT.reopen("NEWS.md")}' \
 	-e 'case $$.' \
@@ -559,8 +559,8 @@ matz: up
 	-e 'next if /^[\[ *]/ =~ $$_' \
 	-e '$$_.sub!(/\n{2,}\z/, "\n\n")' \
 	$(OLD) $(NEW) doc/NEWS/NEWS-$(OLD).md
-	$(GIT) -C $(srcdir) add NEWS.md
-	$(GIT) -C $(srcdir) commit -m "$(message)"
+	$(GIT_IN_SRC) add NEWS.md
+	$(GIT_IN_SRC) commit -m "$(message)"
 
 tags:
 	$(MAKE) GIT="$(GIT)" -C "$(srcdir)" -f defs/tags.mk

ext/openssl/ossl_cipher.c

@@ -32,6 +32,7 @@
  */
 static VALUE cCipher;
 static VALUE eCipherError;
+static VALUE eAuthTagError;
 static ID id_auth_tag_len, id_key_set;
 
 static VALUE ossl_cipher_alloc(VALUE klass);
@@ -415,8 +416,17 @@ ossl_cipher_final(VALUE self)
 
     GetCipher(self, ctx);
     str = rb_str_new(0, EVP_CIPHER_CTX_block_size(ctx));
-    if (!EVP_CipherFinal_ex(ctx, (unsigned char *)RSTRING_PTR(str), &out_len))
-	ossl_raise(eCipherError, NULL);
+    if (!EVP_CipherFinal_ex(ctx, (unsigned char *)RSTRING_PTR(str), &out_len)) {
+        /* For AEAD ciphers, this is likely an authentication failure */
+        if (EVP_CIPHER_flags(EVP_CIPHER_CTX_cipher(ctx)) & EVP_CIPH_FLAG_AEAD_CIPHER) {
+            /* For AEAD ciphers, EVP_CipherFinal_ex failures are authentication tag verification failures */
+            ossl_raise(eAuthTagError, "AEAD authentication tag verification failed");
+        }
+        else {
+            /* For non-AEAD ciphers */
+            ossl_raise(eCipherError, "cipher final failed");
+        }
+    }
     assert(out_len <= RSTRING_LEN(str));
     rb_str_set_len(str, out_len);
 
@@ -1027,6 +1037,7 @@ Init_ossl_cipher(void)
      */
     cCipher = rb_define_class_under(mOSSL, "Cipher", rb_cObject);
     eCipherError = rb_define_class_under(cCipher, "CipherError", eOSSLError);
+    eAuthTagError = rb_define_class_under(cCipher, "AuthTagError", eCipherError);
 
     rb_define_alloc_func(cCipher, ossl_cipher_alloc);
     rb_define_method(cCipher, "initialize_copy", ossl_cipher_copy, 1);