Bug #22334: Assertion Failed: VM_ENV_FLAGS:FIXNUM_P(flags)

• Status: Closed
• Assignee: -
• Target version: -
• Backport: 3.3: WONTFIX, 3.4: DONE, 4.0: REQUIRED

[[e-mail] (Yuancheng Jiang)]

The following code:

def r; return **[nil]; end; r()

Resulted in this output:

../vm_core.h:1554: Assertion Failed: VM_ENV_FLAGS:FIXNUM_P(flags)
ruby 4.1.0dev (2026-09-15T05:36:12Z master 3296d5c99c) +PRISM [x86_64-linux]

-- Control frame information -----------------------------------------------
../vm_core.h:1554: Assertion Failed: VM_ENV_FLAGS:FIXNUM_P(flags)
ruby 4.1.0dev (2026-09-15T05:36:12Z master 3296d5c99c) +PRISM [x86_64-linux]

Crashed while printing bug report
Aborted (core dumped)

This bug was found by fusion-fuzz

[peterzhu2118 (Peter Zhu)]

• Backport changed from 3.3: UNKNOWN, 3.4: UNKNOWN, 4.0: UNKNOWN to 3.3: WONTFIX, 3.4: REQUIRED, 4.0: REQUIRED

Thank you for the bug report, I have a fix here.

[peterzhu2118 (Peter Zhu)]

• Status changed from Open to Closed

Applied in changeset git|d7fe390c85d1a0aeda104026134d19b86199f9b7.

---

Fix crash when returning splat

[Bug #22334]

If we return a with a keyword splat, then each element does not necessarily
push two values onto the stack, so we cannot compile this as a simple sequence
of key-value pairs combined with newhash. The following script reproduces
the issue and crashes:

def r
  return **{foo: 1}
end
puts r()

[nagachika (Tomoyuki Chikanaga)]

• Backport changed from 3.3: WONTFIX, 3.4: REQUIRED, 4.0: REQUIRED to 3.3: WONTFIX, 3.4: DONE, 4.0: REQUIRED

ruby_3_4 350ef312531ac79eb2771f6d5cd242d720657d0b merged revision(s) d7fe390c85d1a0aeda104026134d19b86199f9b7.