From 07a4b755fb5b0c7e0e0cc33ddfe08c4a15bc3a72 Mon Sep 17 00:00:00 2001 From: "Yukihiro \"Matz\" Matsumoto" Date: Fri, 27 Feb 2026 11:06:04 +0900 Subject: [PATCH] object.h: fix MRB_OBJ_SHAPED_P false positive on 32-bit Hash MRB_FL_OBJ_SHAPED uses bit 5 of flags, which on 32-bit conflicts with Hash's ea_n_used field (bits 5-9). A Hash with entries would falsely match MRB_OBJ_SHAPED_P, causing SEGV when its iv pointer was misinterpreted as mrb_shaped_iv. Add tt == MRB_TT_OBJECT check to the predicate. Co-authored-by: Claude --- include/mruby/object.h | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/include/mruby/object.h b/include/mruby/object.h index 096651b19..054064414 100644 --- a/include/mruby/object.h +++ b/include/mruby/object.h @@ -25,9 +25,11 @@ struct RBasic { #define mrb_frozen_p(o) ((o)->frozen) /* Object shape flag -- when set, obj->iv is shaped, not iv_tbl* */ -/* Bit 5: avoids conflict with MRB_INSTANCE_TT_MASK (bits 0-4) */ +/* Bit 5: avoids conflict with MRB_INSTANCE_TT_MASK (bits 0-4); + but conflicts with MRB_HASH_AR_EA_N_USED on 32-bit, so the + predicate must also check tt to avoid false positives */ #define MRB_FL_OBJ_SHAPED (1 << 5) -#define MRB_OBJ_SHAPED_P(o) ((o)->flags & MRB_FL_OBJ_SHAPED) +#define MRB_OBJ_SHAPED_P(o) ((o)->tt == MRB_TT_OBJECT && ((o)->flags & MRB_FL_OBJ_SHAPED)) struct RObject { MRB_OBJECT_HEADER;