Reading a freed IO::Buffer silently returns empty data instead of raising IO::Buffer::InvalidatedError

[himura467]

Observed behavior

Reading a freed IO::Buffer does not raise; it silently returns empty data. Verified on current master: ruby 4.1.0dev (2026-07-02T09:24:35Z master 7c69f93d53) +PRISM [arm64-darwin25].

b = IO::Buffer.new(16)
b.free
b.get_string  # => "" (no exception)

b2 = IO::Buffer.for("frozen str")
b2.free
b2.get_string # => "" (no exception)

The same holds for buffers created from C via rb_io_buffer_new(ptr, len, RB_IO_BUFFER_EXTERNAL | RB_IO_BUFFER_READONLY) and freed via rb_io_buffer_free, as verified end-to-end through this bridge's stash test (host/fixture.rb, /stash then /stash-read).

Root cause in CRuby

IO::Buffer::InvalidatedError already exists for exactly this concept, but it is never raised for freed buffers (io_buffer.c, master 7c69f93d53):

• io_buffer_validate (io_buffer.c:990) performs real validation only for slices (buffer->source != Qnil); any non-slice buffer, including a freed one with base == NULL, unconditionally passes.
• io_buffer_get_bytes_for_reading (io_buffer.c:1074) then maps the NULL base to (NULL, 0).
• io_buffer_get_string (io_buffer.c:2840) happily builds a string from 0 bytes, so the caller sees "".

Why it matters for NSGI

Buffer invalidation is the bridge's core safety mechanism: request fields are zero-copy views over host-borrowed memory, and the bridge frees every handed-out buffer when the request completes. Memory safety holds today (freeing nulls the base pointer, so no dangling read is possible), but the failure mode for a misbehaving app is wrong:

• An app that stashes a request buffer and reads it later gets "" back, a silent data bug that can go unnoticed indefinitely.
• Raising IO::Buffer::InvalidatedError would turn the lifetime violation into an immediately debuggable exception, which is what our SPEC wants to promise app authors ("holding a buffer past the request raises on access").

Proposed upstream improvement

Make io_buffer_validate (or io_buffer_validate_for_reading/_for_writing) treat a freed buffer as invalid, so access raises the existing IO::Buffer::InvalidatedError. A buffer legitimately created with zero length should keep returning empty data; only buffers whose memory was freed/detached after allocation would raise. Since IO::Buffer is explicitly experimental, this behavioral tightening seems fair game.

References

• Bridge invalidation logic: ext/nsgi/src/lib.rs (protected_invalidate)
• End-to-end proof: host/src/main.rs (exercise_stash) + host/fixture.rb

[himura467]

Drafted the CRuby patch on the fork: branch io-buffer-freed-invalidated-error (commit 266c0bcf0c, based on master 7c69f93d53), touching include/ruby/io/buffer.h, io_buffer.c, tests, specs, and NEWS.md (171 insertions, 21 deletions).

Design

A new RB_IO_BUFFER_FREED flag tracks the released state, since a freed buffer (base == NULL, size == 0, flags == 0) was previously indistinguishable from a never-allocated empty one. It is set by the user-facing lifecycle events: IO::Buffer#free, rb_io_buffer_free_locked (used by the block form of IO::Buffer.for and by the scheduler internals), and IO::Buffer#transfer on the source buffer. io_buffer_validate treats freed buffers as invalid, so:

• every read/write/slice/dup path raises IO::Buffer::InvalidatedError with a dedicated "Buffer has been freed!" message
• valid? returns false (previously true, which ruby/spec even asserted)
• to_s/inspect show a FREED marker

Deliberately preserved behavior:

• IO::Buffer.new(0) and resize(0) remain valid, empty-reading buffers (the internal io_buffer_free does not set the flag; only user-facing events do)
• resize still re-allocates a freed buffer, as ruby/spec's resize_spec explicitly requires ("allows resizing after a free"); it clears the flag
• repeated free stays idempotent

Interesting find along the way: the rdoc of IO::Buffer#free already promised that access after free raises (it showed IO::Buffer::AllocationError examples), so the implementation never matched its own documentation. The patch updates those examples to the actual InvalidatedError.

Verification

• make test-all TESTS=test/ruby/test_io_buffer.rb: 101 tests, 810 assertions, 0 failures (includes 7 new tests)
• make test-spec MSPECOPT=spec/ruby/core/io/buffer/: 188 examples, 360 expectations, 0 failures (freed cases in valid_spec.rb version-guarded with ruby_version_is "4.1")
• make test-all TESTS="test/fiber/test_io_buffer.rb test/fiber/test_io.rb": 16 tests, 0 failures (covers the rb_io_buffer_free_locked scheduler path)

Next: open a Feature ticket on bugs.ruby-lang.org and submit the PR to ruby/ruby referencing it (the NEWS entry still needs the ticket number).