New subject: [ruby-core:125254] [Ruby Bug#21997] segfault in basicobject

13 Apr 2026

      Issue #21997 has been reported by danielchong (Daniel Chong).

----------------------------------------
Bug #21997: segfault in basicobject
https://bugs.ruby-lang.org/issues/21997

* Author: danielchong (Daniel Chong)
* Status: Open
* ruby -v: 4.1.0dev
* Backport: 3.3: UNKNOWN, 3.4: UNKNOWN, 4.0: UNKNOWN
----------------------------------------
./ruby script.rb

```
[0, 1, -1, 10000000000000000000000, -10000000000000000000000].each do |val|
  begin
    class BasicObject
      def initialize(v); @v = v; end
      def to_s; @v.to_s; end
    end
    obj = BasicObject.new(val)
    p [:required_after, TOPLEVEL_BINDING.local_variables]
    s = val.to_s.force_encoding(Encoding::UTF_8)
    s.codepoints if s.valid_encoding?
    binding.eval("v = #{val}; [:test, v, TOPLEVEL_BINDING.local_variables]")
  rescue => e
  end
end
```

`RubyGems' were not loaded.
`error_highlight' was not loaded.
`did_you_mean' was not loaded.
`syntax_suggest' was not loaded.
==575066==WARNING: ASan is ignoring requested __asan_handle_no_return: stack type: default top: 0x7ffd6e104000; bottom 0x55d86e96b000; size: 0x2a24ff799000 (46338393346048)
False positive error reports may follow
For details see https://github.com/google/sanitizers/issues/189
d1d8e75b87fbf5baa84c:6: [BUG] Segmentation fault at 0x0000000000000094
ruby 4.1.0dev (2026-04-11T12:02:54Z master f70c081b8f) +PRISM [x86_64-linux]

-- Control frame information -----------------------------------------------
c:0005 p:0003 s:0020 e:000019 l:y b:0001 r:(nil) CLASS  d1d8e75b87fbf5baa84c:6
c:0004 p:0007 s:0017 e:000016 l:n b:---- r:(nil) BLOCK  d1d8e75b87fbf5baa84c:5 [FINISH]
c:0003 p:---- s:0010 e:000009 l:y b:---- r:(nil) CFUNC  :each
c:0002 p:0005 s:0006 e:000005 l:n b:---- r:(nil) EVAL   d1d8e75b87fbf5baa84c:2 [FINISH]
c:0001 p:0000 s:0003 E:001730 l:y b:---- r:(nil) DUMMY  [FINISH]

-- Ruby level backtrace information ----------------------------------------
d1d8e75b87fbf5baa84c:2:in '<main>'
d1d8e75b87fbf5baa84c:2:in 'each'
d1d8e75b87fbf5baa84c:5:in 'block in <main>'
d1d8e75b87fbf5baa84c:6:in '<class:BasicObject>'

-- Threading information ---------------------------------------------------
Total ractor count: 1
Ruby thread count for this ractor: 1

-- Machine register context ------------------------------------------------
 RIP: 0x000055d86dbaee31 RBP: 0x00007ffd6e101cd0 RSP: 0x00007ffd6e101be0
 RAX: 0x0000000000000004 RBX: 0x0000147aa3133980 RCX: 0x0000000000000000
 RDX: 0x0000000000000000 RDI: 0x0000147aa31339b0 RSI: 0x0000502000001590
  R8: 0x0000000000000001  R9: 0x000051300000eef8 R10: 0x00007ffd6e101060
 R11: 0x0000028f54626750 R12: 0x0000147aa3133a20 R13: 0x0000000000000001
 R14: 0x0000028f54626730 R15: 0x0000000000000001 EFL: 0x0000000000010246

-- C level backtrace information -------------------------------------------
/lib/x86_64-linux-gnu/libasan.so.8(___interceptor_backtrace+0x60) [0x147aa54c91e0] ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:4358
/home/w023dtc/ruby/build/ruby(rb_print_backtrace+0x8) [0x55d86dfbc812] ../vm_dump.c:1108
/home/w023dtc/ruby/build/ruby(rb_vm_bugreport) ../vm_dump.c:1456
/home/w023dtc/ruby/build/ruby(rb_bug_for_fatal_signal+0x20d) [0x55d86e399ffd] ../error.c:1140
/home/w023dtc/ruby/build/ruby(sigsegv+0x88) [0x55d86dd994b8] ../signal.c:948
/lib/x86_64-linux-gnu/libc.so.6(0x147aa5086330) [0x147aa5086330]
/home/w023dtc/ruby/build/ruby(rb_estimate_iv_count+0x211) [0x55d86dbaee31] ../iseq.c:3032
/home/w023dtc/ruby/build/ruby(RCLASS_SET_MAX_IV_COUNT+0x0) [0x55d86df7c06e] ../vm_insnhelper.c:6054
/home/w023dtc/ruby/build/ruby(vm_define_method) ../vm_insnhelper.c:6054
/home/w023dtc/ruby/build/ruby(vm_exec_core+0xac0) [0x55d86df89270] ../insns.def:837
/home/w023dtc/ruby/build/ruby(rb_vm_exec+0x2ee) [0x55d86df58c6e] ../vm.c:2810
/home/w023dtc/ruby/build/ruby(invoke_block_from_c_bh+0x6c6) [0x55d86df65b26] ../vm.c:1832
/home/w023dtc/ruby/build/ruby(rb_yield+0x1d1) [0x55d86df69451] ../vm.c:1883
/home/w023dtc/ruby/build/ruby(RB_FL_TEST_RAW+0x0) [0x55d86e1368ac] ../array.c:2766
/home/w023dtc/ruby/build/ruby(RB_FL_ANY_RAW) ../include/ruby/internal/fl_type.h:455
/home/w023dtc/ruby/build/ruby(rb_array_len) ../include/ruby/internal/core/rarray.h:259
/home/w023dtc/ruby/build/ruby(rb_ary_each) ../array.c:2765
/home/w023dtc/ruby/build/ruby(vm_cfp_consistent_p+0x0) [0x55d86df1cf96] ../vm_insnhelper.c:3914
/home/w023dtc/ruby/build/ruby(vm_call_cfunc_with_frame_) ../vm_insnhelper.c:3916
/home/w023dtc/ruby/build/ruby(vm_call_method_each_type+0x221) [0x55d86df5c101] ../vm_insnhelper.c:4900
/home/w023dtc/ruby/build/ruby(vm_call_method+0x2b4) [0x55d86df5f2d4] ../vm_insnhelper.c:5052
/home/w023dtc/ruby/build/ruby(vm_sendish+0x312) [0x55d86df3ba62] ../vm_insnhelper.c:6138
/home/w023dtc/ruby/build/ruby(vm_exec_core+0x8e6) [0x55d86df89096] ../insns.def:864
/home/w023dtc/ruby/build/ruby(rb_vm_exec+0x2ee) [0x55d86df58c6e] ../vm.c:2810
/home/w023dtc/ruby/build/ruby(rb_iseq_eval_main+0x18a) [0x55d86df9dcfa] ../vm.c:3106
/home/w023dtc/ruby/build/ruby(rb_ec_exec_node+0x2ab) [0x55d86da4ef0b] ../eval.c:284
/home/w023dtc/ruby/build/ruby(ruby_run_node+0xfe) [0x55d86da564ce] ../eval.c:322
/home/w023dtc/ruby/build/ruby(rb_main+0x21) [0x55d86da458f2] ../main.c:42
/home/w023dtc/ruby/build/ruby(main) ../main.c:62
/lib/x86_64-linux-gnu/libc.so.6(0x147aa506b1ca) [0x147aa506b1ca]
/lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0x8b) [0x147aa506b28b]
[0x55d86da46f25]

-- Other runtime information -----------------------------------------------

* Loaded script: d1d8e75b87fbf5baa84c

* Ruby Box: disabled
* Loaded features:

    0 enumerator.so
    1 monitor.so
    2 thread.rb
    3 fiber.so
    4 rational.so
    5 complex.so
    6 pathname.so
    7 ruby2_keywords.rb
    8 set.rb

AddressSanitizer:DEADLYSIGNAL
Segmentation fault (core dumped)

-- 
https://bugs.ruby-lang.org/

[ruby-core:125253] [Ruby Bug#21997] segfault in basicobject

danielchong (Daniel Chong)

danielchong (Daniel Chong)

tags

participants (1)