Issue #22409 has been updated by peterzhu2118 (Peter Zhu). Backport changed from 3.3: UNKNOWN, 3.4: UNKNOWN, 4.0: UNKNOWN to 3.3: DONTNEED, 3.4: DONTNEED, 4.0: DONTNEED Thank you for the bug report. I have a fix here: https://github.com/ruby/ruby/pull/19250 ---------------------------------------- Bug #22409: ASan UAF and Assertion Failed: gc_validate_pc:CFP_PC(cfp) >= iseq_encoded: PC not set when allocating, breaking tracing https://bugs.ruby-lang.org/issues/22409#change-119373 * Author: 0599jiangyc@gmail.com (Yuancheng Jiang) * Status: Open * Backport: 3.3: DONTNEED, 3.4: DONTNEED, 4.0: DONTNEED ---------------------------------------- The following code: ```ruby pr = proc {|a=1,b=1,c=1,d=1,e=1,f=1,g=1,h=1,i=1,j=1| pr.call } 40.times do |k| eval((0...k).map { "v#{_1}=0;" }.join + "begin; pr.call; rescue SystemStackError => e; e.backtrace; end") end p :survived ``` Resulted in this output: ``` ../gc.c:1135: Assertion Failed: gc_validate_pc:CFP_PC(cfp) >= iseq_encoded: PC not set when allocating, breaking tracing ruby 4.1.0dev (2026-10-07) +PRISM [x86_64-linux] -- Control frame information ----------------------------------------------- c:6555 p:-11149735210633 s:85178 e:005177 l:n b:---- r:(nil) BLOCK c:6554 p:0035 s:85165 e:005164 l:n b:---- r:(nil) BLOCK min.rb:1 c:6553 p:0035 s:85152 e:005151 l:n b:---- r:(nil) BLOCK min.rb:1 ... ``` and ASan: ``` ==ERROR: AddressSanitizer: heap-use-after-free on address 0x503000029780 READ of size 8 at 0x503000029780 thread T0 #0 succ_index_lookup iseq.c:4611:16 #1 get_insn_info_succinct_bitvector iseq.c:2479:17 #2 get_insn_info iseq.c:2487:12 #3 rb_iseq_line_no iseq.c:2562:48 #4 calc_pos vm_backtrace.c:80:31 #5 calc_lineno vm_backtrace.c:92:9 #6 location_to_str vm_backtrace.c:749:18 #7 location_to_str_dmyarg vm_backtrace.c:1115:12 #8 backtrace_collect vm_backtrace.c:1106:28 #9 backtrace_to_str_ary vm_backtrace.c:1124:9 #10 rb_backtrace_to_str_ary vm_backtrace.c:1136:9 #11 vm_call_cfunc_with_frame_ vm_insnhelper.c:3904:11 ``` *This bug was found by [fusion-fuzz](https://github.com/fusion-fuzz/fusion-fuzz)* -- https://bugs.ruby-lang.org/