Bug #22242: SEGV in method dispatch (`vm_call_iseq_setup_kwparm_nokwarg` / `def_iseq_ptr`) on Ruby 4.0.6 — Rails CI

• Status: Open
• Assignee: -
• Target version: -
• ruby -v: ruby 4.0.6 (2026-07-14 revision 03b6d3f889) +PRISM [x86_64-linux]
• Backport: 3.3: UNKNOWN, 3.4: UNKNOWN, 4.0: UNKNOWN

[yahonda (Yasuo Honda)]

Recently Rails CI sometimes got SEGV.

Steps to reproduce

Run the Rails (rails/rails main branch) ActiveRecord test suite on Ruby 4.0.6, as Rails CI
does. For example:

$ git clone https://github.com/rails/rails.git
$ cd rails && bundle install
$ cd activerecord
$ bundle exec rake sqlite3_mem:test   # also reproduced with trilogy:test and mysql2:test

The crash is intermittent (a small percentage of Rails CI runs) and the crashing test is
different every time, so it may take many runs to reproduce.

Rails CI log files for the five occurrences observed so far are attached, with Buildkite
permalinks to the segfault in each job:

• rails_build_132123_activerecord-sqlite3-mem-4-dot-0.log — https://buildkite.com/rails/rails/builds/132123#019fd767-de5d-4a26-8bd0-aa3778729237/L10156
• rails_build_132137_activerecord-trilogy-4-dot-0-mysql-5-7.log — https://buildkite.com/rails/rails/builds/132137#019fd855-0650-42f5-8771-a683619fc603/L5849
• rails_build_132289_activerecord-mysql2-4-dot-0-mariadb.log — https://buildkite.com/rails/rails/builds/132289#019fe7b7-0c81-43bf-8661-7a3f9fe01cc1/L4496
• rails_build_132357_activerecord-sqlite3-mem-4-dot-0.log — https://buildkite.com/rails/rails/builds/132357#019fefa9-5187-425b-9967-c10cabd5f4f2/L7898
• rails_build_132357_activerecord-trilogy-4-dot-0-mysql-5-7.log — https://buildkite.com/rails/rails/builds/132357#019fefa9-5188-4728-b712-b226999e30e6/L4778

Expected behavior

It should always pass.

Actual behavior

The test process intermittently dies with [BUG] Segmentation fault. Every crash has the
same signature: SEGV inside the interpreter's method dispatch while reading the iseq out of
the callable method entry taken from an inline call cache — def_iseq_ptr(vm_cc_cme(cc)->def)
— in either vm_call_iseq_setup_kwparm_nokwarg (vm_insnhelper.c:3116-3117) or
vm_call_iseq_setup_normal (vm_insnhelper.c:3496):

Rails CI build	Job	Crashing test	Fault address	Crash frame
132123	activerecord sqlite3_mem (4.0)	NestedRelationScopingTest#test_nested_scoped_create	0x17	vm_call_iseq_setup_kwparm_nokwarg vm_insnhelper.c:3116
132137	activerecord trilogy (4.0) [mysql_5_7]	CompatibilityTest5_1#test_datetime_doesnt_set_precision_on_change_column	0x08	vm_call_iseq_setup_normal vm_insnhelper.c:3496
132289	activerecord mysql2 (4.0) [mariadb]	OptimisticLockingTest#test_polymorphic_destroy_with_dependencies_and_lock_version	0x17b9	vm_call_iseq_setup_kwparm_nokwarg vm_insnhelper.c:3117
132357	activerecord sqlite3_mem (4.0)	IntegrationTest#test_cache_version_format_is_not_too_precise	0x1109	vm_call_iseq_setup_kwparm_nokwarg vm_insnhelper.c:3117
132357	activerecord trilogy (4.0) [mysql_5_7]	ActiveRecord::ConnectionAdapters::ConnectionHandlersShardingDbTest#test_establish_connection_using_3_levels_config_with_shards_and_replica	0x18	vm_call_iseq_setup_kwparm_nokwarg vm_insnhelper.c:3116

The crash-site frames of the C-level backtraces, showing that all five crashes are
duplicates of the same bug (full crash dumps are in the attached log files):

Build 132123, activerecord sqlite3_mem (4.0):

/usr/local/lib/libruby.so.4.0(def_iseq_ptr+0x0) [0x7fa976246636] /usr/src/ruby/vm_insnhelper.c:3116
/usr/local/lib/libruby.so.4.0(vm_call_iseq_setup_kwparm_nokwarg) /usr/src/ruby/vm_insnhelper.c:3116
/usr/local/lib/libruby.so.4.0(vm_sendish+0xb0) [0x7fa97625ecb5] /usr/src/ruby/vm_insnhelper.c:6134
/usr/local/lib/libruby.so.4.0(vm_exec_core) /usr/src/ruby/insns.def:904

Build 132137, activerecord trilogy (4.0) [mysql_5_7]:

/usr/local/lib/libruby.so.4.0(def_iseq_ptr+0xd) [0x7ff68de8a350] /usr/src/ruby/vm_core.h:626
/usr/local/lib/libruby.so.4.0(vm_call_iseq_setup_normal) /usr/src/ruby/vm_insnhelper.c:3496
/usr/local/lib/libruby.so.4.0(vm_call_iseq_setup_normal_0start_0params_0locals) /usr/src/ruby/vm_call_iseq_optimized.inc:14
/usr/local/lib/libruby.so.4.0(vm_sendish+0xce) [0x7ff68de9692e] /usr/src/ruby/vm_insnhelper.c:6134

Build 132289, activerecord mysql2 (4.0) [mariadb]:

/usr/local/lib/libruby.so.4.0(vm_call_iseq_setup_kwparm_nokwarg+0x2e) [0x7fb4fd53763e] /usr/src/ruby/vm_insnhelper.c:3117
/usr/local/lib/libruby.so.4.0(vm_sendish+0xb0) [0x7fb4fd54fcb5] /usr/src/ruby/vm_insnhelper.c:6134
/usr/local/lib/libruby.so.4.0(vm_exec_core) /usr/src/ruby/insns.def:904
/usr/local/lib/libruby.so.4.0(vm_exec_loop+0xa) [0x7fb4fd5565ca] /usr/src/ruby/vm.c:2825

Build 132357, activerecord sqlite3_mem (4.0):

/usr/local/lib/libruby.so.4.0(vm_call_iseq_setup_kwparm_nokwarg+0x2e) [0x7ff26cc2163e] /usr/src/ruby/vm_insnhelper.c:3117
/usr/local/lib/libruby.so.4.0(vm_sendish+0xb0) [0x7ff26cc39cb5] /usr/src/ruby/vm_insnhelper.c:6134
/usr/local/lib/libruby.so.4.0(vm_exec_core) /usr/src/ruby/insns.def:904
/usr/local/lib/libruby.so.4.0(vm_exec_loop+0xa) [0x7ff26cc405ca] /usr/src/ruby/vm.c:2825

Build 132357, activerecord trilogy (4.0) [mysql_5_7]:

/usr/local/lib/libruby.so.4.0(def_iseq_ptr+0x0) [0x7fa242c65636] /usr/src/ruby/vm_insnhelper.c:3116
/usr/local/lib/libruby.so.4.0(vm_call_iseq_setup_kwparm_nokwarg) /usr/src/ruby/vm_insnhelper.c:3116
/usr/local/lib/libruby.so.4.0(vm_sendish+0xb0) [0x7fa242c7dcb5] /usr/src/ruby/vm_insnhelper.c:6134
/usr/local/lib/libruby.so.4.0(vm_exec_core) /usr/src/ruby/insns.def:904

[luke-gru (Luke Gruber)]

• Subject changed from laky SEGV in method dispatch (`vm_call_iseq_setup_kwparm_nokwarg` / `def_iseq_ptr`) on Ruby 4.0.6 — Rails CI to SEGV in method dispatch (`vm_call_iseq_setup_kwparm_nokwarg` / `def_iseq_ptr`) on Ruby 4.0.6 — Rails CI

[luke-gru (Luke Gruber)]

Thank you for the report. Has rails ran CI with other 4.0 releases? If so, did you notice any similar crashes for 4.0 releases preceding 4.0.6?