Issue #22181 has been updated by k0kubun (Takashi Kokubun). ruby_4_0 backport draft PR: https://github.com/ruby/ruby/pull/17762 ---------------------------------------- Bug #22181: SEGV in branch peephole optimization due to label/insn struct aliasing https://bugs.ruby-lang.org/issues/22181#change-117982 * Author: viralpraxis (Iaroslav Kurbatov) * Status: Closed * Assignee: prism * ruby -v: ruby 4.1.0dev (2026-07-05T09:21:26Z master fd34f67b18) +PRISM [x86_64-linux] * Backport: 3.3: DONTNEED, 3.4: DONTNEED, 4.0: REQUIRED ---------------------------------------- Both `iseq_label_data` and `iseq_insn_data` share the same layout prefix; in some cases `iseq_label_data->label_no` might collide with `iseq_insn_data->insn_id` (e.g. when there are many (monotonically increasing) label IDs allocated and one of them collides with `branchif := 74`). An example (generated so that the collision actually happens): ```ruby cat test.rb $g&.call&.to_s [*d, [__dir__].each(&:each), C1.value(/ab/o, &b)].each {} begin ((-243 != qux) ? (1..2) : 8i&.value) => ^([1].select(&:to_s)) rescue ((-243 != qux) ? (1..2) : 8i&.value) => ^([1].select(&:to_s)) end ``` ```shell ~/.rubies/ruby-master/bin/ruby test.rb test.rb: [BUG] Segmentation fault at 0x0000000000000000 ruby 4.1.0dev (2026-07-05T09:21:26Z master fd34f67b18) +PRISM [x86_64-linux] -- Control frame information ----------------------------------------------- c:0001 p:0000 s:0003 E:0026c0 l:y b:---- r:(nil) DUMMY [FINISH] -- Threading information --------------------------------------------------- Total ractor count: 1 Ruby thread count for this ractor: 1 -- Machine register context ------------------------------------------------ RIP: 0x00005835a2c62129 RBP: 0x00005835de29bce0 RSP: 0x00007ffc8774f2e0 RAX: 0x00005835de3254d8 RBX: 0x000000000000004b RCX: 0x0000000000000001 RDX: 0x00005835de29bca0 RDI: 0x00005835de29b880 RSI: 0x0000000000000000 R8: 0x00005835de29b880 R9: 0x00005835a2de1501 R10: 0x0000000000000002 R11: 0x0000000000000000 R12: 0x0000000000000000 R13: 0x00005835a2e325f4 R14: 0x000071196d162b80 R15: 0x0000000000000001 EFL: 0x0000000000010246 -- C level backtrace information ------------------------------------------- ~/.rubies/ruby-master/bin/ruby(rb_print_backtrace+0x14) [0x5835a29e1a33] $RSRC/ruby/vm_dump.c:1111 ~/.rubies/ruby-master/bin/ruby(rb_vm_bugreport) $RSRC/ruby/vm_dump.c:1473 ~/.rubies/ruby-master/bin/ruby(rb_bug_for_fatal_signal+0x101) [0x5835a2cf1221] $RSRC/ruby/error.c:1140 ~/.rubies/ruby-master/bin/ruby(sigsegv+0x48) [0x5835a2911848] $RSRC/ruby/signal.c:948 /lib/x86_64-linux-gnu/libc.so.6(0x711988645330) [0x711988645330] ~/.rubies/ruby-master/bin/ruby(replace_destination+0x3) [0x5835a2c62129] $RSRC/ruby/compile.c:3127 ~/.rubies/ruby-master/bin/ruby(iseq_peephole_optimize) $RSRC/ruby/compile.c:3720 ~/.rubies/ruby-master/bin/ruby(iseq_optimize+0x1cb) [0x5835a2c63f83] $RSRC/ruby/compile.c:4495 ~/.rubies/ruby-master/bin/ruby(iseq_setup_insn) $RSRC/ruby/compile.c:1622 ~/.rubies/ruby-master/bin/ruby(iseq_setup_insn) $RSRC/ruby/compile.c:1611 ~/.rubies/ruby-master/bin/ruby(pm_iseq_compile_node+0x60) [0x5835a2cb1920] $RSRC/ruby/prism_compile.c:10623 ~/.rubies/ruby-master/bin/ruby(pm_iseq_build+0x184) [0x5835a2848d94] $RSRC/ruby/iseq.c:1133 ~/.rubies/ruby-master/bin/ruby(pm_iseq_new_with_opt_try+0x34) [0x5835a2848f14] $RSRC/ruby/iseq.c:1153 ~/.rubies/ruby-master/bin/ruby(rb_protect+0xfb) [0x5835a27d04db] $RSRC/ruby/eval.c:1135 ~/.rubies/ruby-master/bin/ruby(pm_iseq_new_with_opt+0x4d) [0x5835a28478f3] $RSRC/ruby/iseq.c:1181 ~/.rubies/ruby-master/bin/ruby(pm_iseq_new_main) $RSRC/ruby/iseq.c:1005 ~/.rubies/ruby-master/bin/ruby(process_options+0x1475) [0x5835a2902715] $RSRC/ruby/ruby.c:2700 ~/.rubies/ruby-master/bin/ruby(ruby_process_options+0x15d) [0x5835a290342d] $RSRC/ruby/ruby.c:3258 ~/.rubies/ruby-master/bin/ruby(ruby_options+0xc0) [0x5835a27cf1c0] $RSRC/ruby/eval.c:120 ~/.rubies/ruby-master/bin/ruby(rb_main+0x19) [0x5835a27c969e] $RSRC/ruby/jit.c:632 ~/.rubies/ruby-master/bin/ruby(main) ./main.c:62 /lib/x86_64-linux-gnu/libc.so.6(__libc_start_call_main+0x7a) [0x71198862a1ca] ../sysdeps/nptl/libc_start_call_main.h:58 /lib/x86_64-linux-gnu/libc.so.6(call_init+0x0) [0x71198862a28b] ../csu/libc-start.c:360 /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main_impl) ../csu/libc-start.c:347 /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main) (null):0 [0x5835a27c96f5] ``` -- https://bugs.ruby-lang.org/