Bug #22409: ASan UAF and Assertion Failed: gc_validate_pc:CFP_PC(cfp) >= iseq_encoded: PC not set when allocating, breaking tracing

• Status: Open
• Assignee: -
• Target version: -
• Backport: 3.3: DONTNEED, 3.4: DONTNEED, 4.0: DONTNEED

[[e-mail] (Yuancheng Jiang)]

The following code:

pr = proc {|a=1,b=1,c=1,d=1,e=1,f=1,g=1,h=1,i=1,j=1| pr.call }
40.times do |k|
  eval((0...k).map { "v#{_1}=0;" }.join + "begin; pr.call; rescue SystemStackError => e; e.backtrace; end")
end
p :survived

Resulted in this output:

../gc.c:1135: Assertion Failed: gc_validate_pc:CFP_PC(cfp) >= iseq_encoded: PC not set when allocating, breaking tracing
ruby 4.1.0dev (2026-10-07) +PRISM [x86_64-linux]

-- Control frame information -----------------------------------------------
c:6555 p:-11149735210633 s:85178 e:005177 l:n b:---- r:(nil) BLOCK
c:6554 p:0035 s:85165 e:005164 l:n b:---- r:(nil) BLOCK  min.rb:1
c:6553 p:0035 s:85152 e:005151 l:n b:---- r:(nil) BLOCK  min.rb:1
...

and ASan:

==ERROR: AddressSanitizer: heap-use-after-free on address 0x503000029780
READ of size 8 at 0x503000029780 thread T0
    #0 succ_index_lookup iseq.c:4611:16
    #1 get_insn_info_succinct_bitvector iseq.c:2479:17
    #2 get_insn_info iseq.c:2487:12
    #3 rb_iseq_line_no iseq.c:2562:48
    #4 calc_pos vm_backtrace.c:80:31
    #5 calc_lineno vm_backtrace.c:92:9
    #6 location_to_str vm_backtrace.c:749:18
    #7 location_to_str_dmyarg vm_backtrace.c:1115:12
    #8 backtrace_collect vm_backtrace.c:1106:28
    #9 backtrace_to_str_ary vm_backtrace.c:1124:9
    #10 rb_backtrace_to_str_ary vm_backtrace.c:1136:9
    #11 vm_call_cfunc_with_frame_ vm_insnhelper.c:3904:11

This bug was found by fusion-fuzz

[peterzhu2118 (Peter Zhu)]

• Backport changed from 3.3: UNKNOWN, 3.4: UNKNOWN, 4.0: UNKNOWN to 3.3: DONTNEED, 3.4: DONTNEED, 4.0: DONTNEED

Thank you for the bug report. I have a fix here: https://github.com/ruby/ruby/pull/19250