Bug #22181: SEGV in branch peephole optimization due to label/insn struct aliasing

• Status: Closed
• Assignee: prism
• Target version: -
• ruby -v: ruby 4.1.0dev (2026-07-05T09:21:26Z master fd34f67b18) +PRISM [x86_64-linux]
• Backport: 3.3: DONTNEED, 3.4: DONTNEED, 4.0: REQUIRED

[viralpraxis (Iaroslav Kurbatov)]

Both iseq_label_data and iseq_insn_data share the same layout prefix; in some cases iseq_label_data->label_no might collide with iseq_insn_data->insn_id (e.g. when there are many (monotonically increasing) label IDs allocated and one of them collides with branchif := 74).

An example (generated so that the collision actually happens):

cat test.rb 
$g&.call&.to_s
[*d, [__dir__].each(&:each), C1.value(/ab/o, &b)].each {}
begin
  ((-243 != qux) ? (1..2) : 8i&.value) => ^([1].select(&:to_s))
rescue
  ((-243 != qux) ? (1..2) : 8i&.value) => ^([1].select(&:to_s))
end

~/.rubies/ruby-master/bin/ruby test.rb
test.rb: [BUG] Segmentation fault at 0x0000000000000000
ruby 4.1.0dev (2026-07-05T09:21:26Z master fd34f67b18) +PRISM [x86_64-linux]

-- Control frame information -----------------------------------------------
c:0001 p:0000 s:0003 E:0026c0 l:y b:---- r:(nil) DUMMY  [FINISH]


-- Threading information ---------------------------------------------------
Total ractor count: 1
Ruby thread count for this ractor: 1

-- Machine register context ------------------------------------------------
 RIP: 0x00005835a2c62129 RBP: 0x00005835de29bce0 RSP: 0x00007ffc8774f2e0
 RAX: 0x00005835de3254d8 RBX: 0x000000000000004b RCX: 0x0000000000000001
 RDX: 0x00005835de29bca0 RDI: 0x00005835de29b880 RSI: 0x0000000000000000
  R8: 0x00005835de29b880  R9: 0x00005835a2de1501 R10: 0x0000000000000002
 R11: 0x0000000000000000 R12: 0x0000000000000000 R13: 0x00005835a2e325f4
 R14: 0x000071196d162b80 R15: 0x0000000000000001 EFL: 0x0000000000010246

-- C level backtrace information -------------------------------------------
~/.rubies/ruby-master/bin/ruby(rb_print_backtrace+0x14) [0x5835a29e1a33] $RSRC/ruby/vm_dump.c:1111
~/.rubies/ruby-master/bin/ruby(rb_vm_bugreport) $RSRC/ruby/vm_dump.c:1473
~/.rubies/ruby-master/bin/ruby(rb_bug_for_fatal_signal+0x101) [0x5835a2cf1221] $RSRC/ruby/error.c:1140
~/.rubies/ruby-master/bin/ruby(sigsegv+0x48) [0x5835a2911848] $RSRC/ruby/signal.c:948
/lib/x86_64-linux-gnu/libc.so.6(0x711988645330) [0x711988645330]
~/.rubies/ruby-master/bin/ruby(replace_destination+0x3) [0x5835a2c62129] $RSRC/ruby/compile.c:3127
~/.rubies/ruby-master/bin/ruby(iseq_peephole_optimize) $RSRC/ruby/compile.c:3720
~/.rubies/ruby-master/bin/ruby(iseq_optimize+0x1cb) [0x5835a2c63f83] $RSRC/ruby/compile.c:4495
~/.rubies/ruby-master/bin/ruby(iseq_setup_insn) $RSRC/ruby/compile.c:1622
~/.rubies/ruby-master/bin/ruby(iseq_setup_insn) $RSRC/ruby/compile.c:1611
~/.rubies/ruby-master/bin/ruby(pm_iseq_compile_node+0x60) [0x5835a2cb1920] $RSRC/ruby/prism_compile.c:10623
~/.rubies/ruby-master/bin/ruby(pm_iseq_build+0x184) [0x5835a2848d94] $RSRC/ruby/iseq.c:1133
~/.rubies/ruby-master/bin/ruby(pm_iseq_new_with_opt_try+0x34) [0x5835a2848f14] $RSRC/ruby/iseq.c:1153
~/.rubies/ruby-master/bin/ruby(rb_protect+0xfb) [0x5835a27d04db] $RSRC/ruby/eval.c:1135
~/.rubies/ruby-master/bin/ruby(pm_iseq_new_with_opt+0x4d) [0x5835a28478f3] $RSRC/ruby/iseq.c:1181
~/.rubies/ruby-master/bin/ruby(pm_iseq_new_main) $RSRC/ruby/iseq.c:1005
~/.rubies/ruby-master/bin/ruby(process_options+0x1475) [0x5835a2902715] $RSRC/ruby/ruby.c:2700
~/.rubies/ruby-master/bin/ruby(ruby_process_options+0x15d) [0x5835a290342d] $RSRC/ruby/ruby.c:3258
~/.rubies/ruby-master/bin/ruby(ruby_options+0xc0) [0x5835a27cf1c0] $RSRC/ruby/eval.c:120
~/.rubies/ruby-master/bin/ruby(rb_main+0x19) [0x5835a27c969e] $RSRC/ruby/jit.c:632
~/.rubies/ruby-master/bin/ruby(main) ./main.c:62
/lib/x86_64-linux-gnu/libc.so.6(__libc_start_call_main+0x7a) [0x71198862a1ca] ../sysdeps/nptl/libc_start_call_main.h:58
/lib/x86_64-linux-gnu/libc.so.6(call_init+0x0) [0x71198862a28b] ../csu/libc-start.c:360
/lib/x86_64-linux-gnu/libc.so.6(__libc_start_main_impl) ../csu/libc-start.c:347
/lib/x86_64-linux-gnu/libc.so.6(__libc_start_main) (null):0
[0x5835a27c96f5]

[viralpraxis (Iaroslav Kurbatov)]

• Status changed from Open to Closed

Applied in changeset git|6aedc31694f020ee37cd0668779351a714115ad0.

---

[Bug #22181] Fix branch-peephole-optimization label & insn ID collisions

[nobu (Nobuyoshi Nakada)]

• Backport changed from 3.3: UNKNOWN, 3.4: UNKNOWN, 4.0: UNKNOWN to 3.3: DONTNEED, 3.4: DONTNEED, 4.0: REQUIRED

Seems something incompatible in compile_prism, it segfaults while not compile_parsey.
Anyway, the patch seems like a good safety net.

[Earlopain (Earlopain _)]

• Assignee set to prism