Bug #22510: YJIT on arm64 crashes when the code region is larger than 128MiB

• Status: Closed
• Assignee: -
• Target version: -
• ruby -v: ruby 4.0.9 (2026-11-05 revision 1636a3cb0c) +PRISM [aarch64-linux]
• Backport: 3.3: UNKNOWN, 3.4: REQUIRED, 4.0: REQUIRED

[hsbt (Hiroshi SHIBATA)]

On arm64, YJIT jumps to a small address such as 0x2064 and crashes once the code region exceeds 128MiB. With --yjit-mem-size=512, 30k_variables from ruby-bench crashes this way on the current ruby_3_4 and ruby_4_0 built for aarch64-linux. The default size is not affected.

Since a1c61f0ae5 made CodePtr an offset into the code region, the fallback in emit_jmp_ptr for targets out of the range of b loads that offset instead of the address before br.

This is fixed on master by 7f451f6c00 (https://github.com/ruby/ruby/pull/19718), which cherry-picks cleanly to ruby_3_4 and ruby_4_0.

[byroot (Jean Boussier)]

• Status changed from Open to Closed