Bug #22090: Enabling Ruby::Box breaks Marshal.load

• Status: Closed
• Assignee: tagomoris (Satoshi Tagomori)
• Target version: -
• ruby -v: ruby 4.1.0dev (2026-05-31T10:35:05Z master 12c8599ffa) +PRISM [x86_64-linux]
• Backport: 3.3: UNKNOWN, 3.4: UNKNOWN, 4.0: UNKNOWN

[joker1007 (Tomohiro Hashidate)]

This is very simple.

class Foo
end

f = Marshal.dump(Foo.new)
Marshal.load(f)

No Ruby::Box

This code returns #<Foo:0x00007fdb9c744da0>.

---

Ruby::Box enabled

This code returns "undefined class/module Foo".

marshal_main.rb:5:in 'Marshal.load': undefined class/module Foo (ArgumentError)

p Marshal.load(f)
               ^
        from marshal_main.rb:5:in '<main>'

[joker1007 (Tomohiro Hashidate)]

• Subject changed from Enabling Ruby::Box breaks Marshal.load. to Enabling Ruby::Box breaks Marshal.load

[mame (Yusuke Endoh)]

• Status changed from Open to Assigned
• Assignee set to tagomoris (Satoshi Tagomori)

[hsbt (Hiroshi SHIBATA)]

The root cause is that Marshal.load is a builtin method written in Ruby (marshal.rb), so it is defined in the master box. The box resolution stops at that frame and looks up the dumped class names there, where user-defined classes are invisible. Marshal.dump is a plain C function and already operates on the caller's box, which is why only loading fails.

I proposed a fix in https://github.com/ruby/ruby/pull/18544: it adds Primitive.attr! :caller_box, which makes a builtin Ruby method operate on its caller's box like C functions do, and applies it to Marshal.load.

[hsbt (Hiroshi SHIBATA)]

• Related to Misc #22275: Ruby::Box support plan for RubyGems and Bundler added

[hsbt (Hiroshi SHIBATA)]

• Status changed from Assigned to Closed

Applied in changeset git|60d29cd2d39f10b02e8cc73e0e767e6c55a05ece.

---

[Bug #22090] Resolve classes in the caller's box in Marshal.load

Marshal.load is a builtin Ruby method, so with Ruby::Box enabled it
looked up dumped class names in the master box and failed even for a
same-process round-trip. Mark it :caller_box to resolve the class
names in the caller's box, which Marshal.dump (a C function) already
does.

Co-Authored-By: Claude Fable 5 [e-mail]