From: "rkh (Konstantin Haase) via ruby-core" <ruby-core@...>
Date: 2026-09-27T12:05:21+00:00
Subject: [ruby-core:126866] [Ruby Bug#22386]  Segfault when a Ractor helper thread reports an exception during teardown

Issue #22386 has been reported by rkh (Konstantin Haase).

----------------------------------------
Bug #22386:  Segfault when a Ractor helper thread reports an exception during teardown
https://bugs.ruby-lang.org/issues/22386

* Author: rkh (Konstantin Haase)
* Status: Open
* ruby -v: ruby 4.1.0dev (2026-09-27T05:30:49Z master f6ff9e7d02) +PRISM [arm64-darwin25]
* Backport: 3.3: UNKNOWN, 3.4: UNKNOWN, 4.0: UNKNOWN
----------------------------------------
Ruby 4.1-dev can segfault when a thread inside a terminating Ractor raises an exception in an `ensure` block. Automatic thread exception reporting tries to load error-formatting code through `require`. The require path creates an internal Ractor port after the Ractor's port table has been freed. Creating a `Ractor::Port` directly in the same teardown context also segfaults, even with automatic exception reporting disabled.

Script to reproduce the issue:

```ruby
worker = Ractor.new do
  ready = Thread::Queue.new
  Thread.new do
    begin
      ready << true
      sleep
    ensure
      Object.new.missing_method_during_teardown
    end
  end
  ready.pop
  :done
end

worker.value
```

Running the script on Ruby 4.1-dev gives a segmentation fault output and then hangs.

```
#<Thread:0x0000000122aa0190 issue.rb:3 aborting> terminated with exception (report_on_exception is true):
[BUG] Segmentation fault at 0x0000000000000018
ruby 4.1.0dev (2026-09-27T05:30:49Z master f6ff9e7d02) +PRISM [arm64-darwin25]

-- Crash Report log information --------------------------------------------
   See Crash Report log file in one of the following locations:
     * ~/Library/Logs/DiagnosticReports
     * /Library/Logs/DiagnosticReports
   for more details.
Don't forget to include the above Crash Report log file in bug reports.

-- Control frame information -----------------------------------------------
c:0002 p:---- s:0006 e:000005 l:y b:0001 r:0x0 CFUNC  :detailed_message
c:0001 p:---- s:0003 e:000002 l:y b:---- r:0x0 DUMMY  [FINISH]

-- Ruby level backtrace information ----------------------------------------
issue.rb:0:in 'detailed_message'

-- Threading information ---------------------------------------------------
Total ractor count: 2
Ruby thread count for this ractor: 2

-- Machine register context ------------------------------------------------
  x0: 0x0000000000000000  x1: 0x0000000000000001  x2: 0x000000083b2cf0e0
  x3: 0x0000000000000000  x4: 0x0000000000000001  x5: 0x0000000000000000
  x6: 0xffffffffbfc007ff  x7: 0xfffff0003ffff800 x18: 0x0000000000000000
 x19: 0x0000000122ac09c0 x20: 0x000000083adced00 x21: 0x0000000000000000
 x22: 0x0000000000000001 x23: 0x000000083b2cf0e0 x24: 0x0000000122ab00a0
 x25: 0x00000000ffffffff x26: 0x000000012d90bfc8 x27: 0x000000083b03a940
 x28: 0x0000000055550483  lr: 0x0000000103b8e020  fp: 0x000000012da0f760
  sp: 0x000000012da0f720

-- C level backtrace information -------------------------------------------
```



-- 
https://bugs.ruby-lang.org/
______________________________________________
 ruby-core mailing list -- ruby-core@ml.ruby-lang.org
 To unsubscribe send an email to ruby-core-leave@ml.ruby-lang.org
 ruby-core info -- https://ml.ruby-lang.org/mailman3/lists/ruby-core.ml.ruby-lang.org/