From: "0599jiangyc@... (Yuancheng Jiang) via ruby-core" <ruby-core@...>
Date: 2026-10-07T11:32:22+00:00
Subject: [ruby-core:126974] [Ruby Bug#22409] ASan UAF and Assertion Failed: gc_validate_pc:CFP_PC(cfp) >= iseq_encoded: PC not set when allocating, breaking tracing

Issue #22409 has been reported by 0599jiangyc@gmail.com (Yuancheng Jiang).

----------------------------------------
Bug #22409: ASan UAF and Assertion Failed: gc_validate_pc:CFP_PC(cfp) >= iseq_encoded: PC not set when allocating, breaking tracing
https://bugs.ruby-lang.org/issues/22409

* Author: 0599jiangyc@gmail.com (Yuancheng Jiang)
* Status: Open
* Backport: 3.3: UNKNOWN, 3.4: UNKNOWN, 4.0: UNKNOWN
----------------------------------------
The following code:

```ruby
pr = proc {|a=1,b=1,c=1,d=1,e=1,f=1,g=1,h=1,i=1,j=1| pr.call }
40.times do |k|
  eval((0...k).map { "v#{_1}=0;" }.join + "begin; pr.call; rescue SystemStackError => e; e.backtrace; end")
end
p :survived
```

Resulted in this output:
```
../gc.c:1135: Assertion Failed: gc_validate_pc:CFP_PC(cfp) >= iseq_encoded: PC not set when allocating, breaking tracing
ruby 4.1.0dev (2026-10-07) +PRISM [x86_64-linux]

-- Control frame information -----------------------------------------------
c:6555 p:-11149735210633 s:85178 e:005177 l:n b:---- r:(nil) BLOCK
c:6554 p:0035 s:85165 e:005164 l:n b:---- r:(nil) BLOCK  min.rb:1
c:6553 p:0035 s:85152 e:005151 l:n b:---- r:(nil) BLOCK  min.rb:1
...
```

and ASan:
```
==ERROR: AddressSanitizer: heap-use-after-free on address 0x503000029780
READ of size 8 at 0x503000029780 thread T0
    #0 succ_index_lookup iseq.c:4611:16
    #1 get_insn_info_succinct_bitvector iseq.c:2479:17
    #2 get_insn_info iseq.c:2487:12
    #3 rb_iseq_line_no iseq.c:2562:48
    #4 calc_pos vm_backtrace.c:80:31
    #5 calc_lineno vm_backtrace.c:92:9
    #6 location_to_str vm_backtrace.c:749:18
    #7 location_to_str_dmyarg vm_backtrace.c:1115:12
    #8 backtrace_collect vm_backtrace.c:1106:28
    #9 backtrace_to_str_ary vm_backtrace.c:1124:9
    #10 rb_backtrace_to_str_ary vm_backtrace.c:1136:9
    #11 vm_call_cfunc_with_frame_ vm_insnhelper.c:3904:11
```

*This bug was found by [fusion-fuzz](https://github.com/fusion-fuzz/fusion-fuzz)*



-- 
https://bugs.ruby-lang.org/
______________________________________________
 ruby-core mailing list -- ruby-core@ml.ruby-lang.org
 To unsubscribe send an email to ruby-core-leave@ml.ruby-lang.org
 ruby-core info -- https://ml.ruby-lang.org/mailman3/lists/ruby-core.ml.ruby-lang.org/