Issue #21565 has been updated by alanwu (Alan Wu). Thanks for trying the patch and for helping us debug! Unfortunately, we still need more information to understand the crash. Follow the steps to gather more information: Apply the following on top of 3.4.5: ```patch diff --git a/yjit/src/codegen.rs b/yjit/src/codegen.rs index a74480a204..a5a3598c04 100644 --- a/yjit/src/codegen.rs +++ b/yjit/src/codegen.rs @@ -1296,7 +1296,6 @@ pub fn gen_single_block( let mut asm = Assembler::new(jit.num_locals()); asm.ctx = ctx; - #[cfg(feature = "disasm")] if get_option_ref!(dump_disasm).is_some() { let blockid_idx = blockid.idx; let chain_depth = if asm.ctx.get_chain_depth() > 0 { format!("(chain_depth: {})", asm.ctx.get_chain_depth()) } else { "".to_string() }; @@ -9048,7 +9047,6 @@ fn gen_send_general( let recv_opnd: YARVOpnd = recv.into(); // Log the name of the method we're calling to - #[cfg(feature = "disasm")] asm_comment!(asm, "call to {}", get_method_name(Some(comptime_recv_klass), mid)); // Gather some statistics about sends ``` Run your app with `--yjit-dump-disasm=/tmp`. Use `RUBYOPT` if necessary to make sure the crashing process gets the option. Once it crashes, find the `yjit_*.log` file in `/tmp` based on PID. It will contain the machine code YJIT generated, along with comments. Dumps are separated by a header comment that looks like `Block: method_name@file/path/code.rb`. I would like to see all chunks of the dump for `actionpack-8.0.2.1/lib/action_dispatch/request/session.rb`, or minimally, just for all `[]` methods in that file. If it doesn't crash anymore, the dumps might still contain hints about what could be happening. By the way, it looks like you have a `to_s` method in your app that returns a symbol, and an instance it being passed to [`ActionDispatch::Request::Session#[]`](https://github.com/rails/rails/blob/v8.0.2.1/actionpack/lib/action_dispatch/...). Fixing that `to_s` method could be a workaround for this YJIT bug, though that won't help us fix the underlying issue. ---------------------------------------- Bug #21565: YJIT has panicked in rails https://bugs.ruby-lang.org/issues/21565#change-114540 * Author: eiskrenkov (Egor Iskrenkov) * Status: Assigned * Assignee: jit * ruby -v: ruby 3.4.5 (2025-07-16 revision 20cda200d3) +PRISM [arm64-darwin24] * Backport: 3.2: UNKNOWN, 3.3: UNKNOWN, 3.4: UNKNOWN ---------------------------------------- I've got YJIT has panicked crash in rails app locally on my M1 Pro Mac Book pro for 2 times for last 2 weeks ``` Started GET "/api/admin/environments/13/edit" for ::1 at 2025-09-08 18:32:17 +0200 Processing by Api::Admin::EnvironmentsController#edit as JSON Parameters: {"id" => "13", "environment" => {}} ruby: YJIT has panicked. More info to follow... thread '<unnamed>' panicked at ./yjit/src/codegen.rs:5031:9: assertion failed: !val_type.is_imm() stack backtrace: 0: _rust_begin_unwind 1: core::panicking::panic_fmt 2: core::panicking::panic 3: yjit::codegen::jit_guard_known_klass 4: yjit::codegen::gen_equality_specialized 5: yjit::codegen::gen_opt_eq 6: yjit::codegen::gen_single_block 7: yjit::core::gen_block_series 8: yjit::core::branch_stub_hit_body 9: yjit::stats::with_compile_time 10: yjit::cruby::with_vm_lock 11: yjit::core::branch_stub_hit note: Some details are omitted, run with `RUST_BACKTRACE=full` for a verbose backtrace. /Users/eiskrenkov/.local/share/mise/installs/ruby/3.4.5/lib/ruby/gems/3.4.0/gems/actionpack-8.0.2.1/lib/action_dispatch/request/session.rb:118: [BUG] YJIT: panicked at ./yjit/src/codegen.rs:5031:9: assertion failed: !val_type.is_imm() ruby 3.4.5 (2025-07-16 revision 20cda200d3) +YJIT +PRISM [arm64-darwin24] ``` It happens randomly, I couldn't find reproduction steps sadly ---Files-------------------------------- ruby-2025-09-08-183231.ips (45.3 KB) ruby-2025-09-09-184849.ips (71.7 KB) -- https://bugs.ruby-lang.org/