Bug #22386: Segfault when a Ractor helper thread reports an exception during teardown

• Status: Open
• Assignee: -
• Target version: -
• ruby -v: ruby 4.1.0dev (2026-09-27T05:30:49Z master f6ff9e7d02) +PRISM [arm64-darwin25]
• Backport: 3.3: UNKNOWN, 3.4: UNKNOWN, 4.0: UNKNOWN

[rkh (Konstantin Haase)]

Ruby 4.1-dev can segfault when a thread inside a terminating Ractor raises an exception in an ensure block. Automatic thread exception reporting tries to load error-formatting code through require. The require path creates an internal Ractor port after the Ractor's port table has been freed. Creating a Ractor::Port directly in the same teardown context also segfaults, even with automatic exception reporting disabled.

Script to reproduce the issue:

worker = Ractor.new do
  ready = Thread::Queue.new
  Thread.new do
    begin
      ready << true
      sleep
    ensure
      Object.new.missing_method_during_teardown
    end
  end
  ready.pop
  :done
end

worker.value

Running the script on Ruby 4.1-dev gives a segmentation fault output and then hangs.

#<Thread:0x0000000122aa0190 issue.rb:3 aborting> terminated with exception (report_on_exception is true):
[BUG] Segmentation fault at 0x0000000000000018
ruby 4.1.0dev (2026-09-27T05:30:49Z master f6ff9e7d02) +PRISM [arm64-darwin25]

-- Crash Report log information --------------------------------------------
   See Crash Report log file in one of the following locations:
     * ~/Library/Logs/DiagnosticReports
     * /Library/Logs/DiagnosticReports
   for more details.
Don't forget to include the above Crash Report log file in bug reports.

-- Control frame information -----------------------------------------------
c:0002 p:---- s:0006 e:000005 l:y b:0001 r:0x0 CFUNC  :detailed_message
c:0001 p:---- s:0003 e:000002 l:y b:---- r:0x0 DUMMY  [FINISH]

-- Ruby level backtrace information ----------------------------------------
issue.rb:0:in 'detailed_message'

-- Threading information ---------------------------------------------------
Total ractor count: 2
Ruby thread count for this ractor: 2

-- Machine register context ------------------------------------------------
  x0: 0x0000000000000000  x1: 0x0000000000000001  x2: 0x000000083b2cf0e0
  x3: 0x0000000000000000  x4: 0x0000000000000001  x5: 0x0000000000000000
  x6: 0xffffffffbfc007ff  x7: 0xfffff0003ffff800 x18: 0x0000000000000000
 x19: 0x0000000122ac09c0 x20: 0x000000083adced00 x21: 0x0000000000000000
 x22: 0x0000000000000001 x23: 0x000000083b2cf0e0 x24: 0x0000000122ab00a0
 x25: 0x00000000ffffffff x26: 0x000000012d90bfc8 x27: 0x000000083b03a940
 x28: 0x0000000055550483  lr: 0x0000000103b8e020  fp: 0x000000012da0f760
  sp: 0x000000012da0f720

-- C level backtrace information -------------------------------------------