ZJIT: Assertion Failed: VM_ENV_FLAGS:FIXNUM_P(flags)

[st0012]

Script to reproduce:

def test(*arr, &b)
  arr.first

  yield
end

test

Command:

./build/miniruby --zjit --zjit-dump-hir --zjit-call-threshold=1 --zjit-num-profiles=1 test.rb

Crash Report:

../vm_core.h:1439: Assertion Failed: VM_ENV_FLAGS:FIXNUM_P(flags)
ruby 3.5.0dev (2025-07-05T16:57:55Z zjit-test-against-.. 9ac0040139) +ZJIT dev +PRISM [arm64-darwin24]

-- Crash Report log information --------------------------------------------
   See Crash Report log file in one of the following locations:             
     * ~/Library/Logs/DiagnosticReports                                     
     * /Library/Logs/DiagnosticReports                                      
   for more details.                                                        
Don't forget to include the above Crash Report log file in bug reports.     

-- Control frame information -----------------------------------------------
../vm_core.h:1439: Assertion Failed: VM_ENV_FLAGS:FIXNUM_P(flags)
ruby 3.5.0dev (2025-07-05T16:57:55Z zjit-test-against-.. 9ac0040139) +ZJIT dev +PRISM [arm64-darwin24]

-- Crash Report log information --------------------------------------------
   See Crash Report log file in one of the following locations:             
     * ~/Library/Logs/DiagnosticReports                                     
     * /Library/Logs/DiagnosticReports                                      
   for more details.                                                        
Don't forget to include the above Crash Report log file in bug reports.     

Crashed while printing bug report
[IMPORTANT]
Don't forget to include the Crash Report log file under
DiagnosticReports directory in bug reports.

[1]    4834 abort      ./build/miniruby --zjit --zjit-dump-hir --zjit-call-threshold=1  test.rb

HIR:

HIR:
fn <main>:
bb0(v0:BasicObject):
  SideExit UnknownOpcode(definemethod)

HIR:
fn test:
bb0(v0:BasicObject, v1:ArrayExact, v2:BasicObject):
  PatchPoint MethodRedefined(Array@0x101bd0a90, first@0x16f1)
  v9:BasicObject = SendWithoutBlockDirect v1, :first (0x16f330ff8)
  SideExit UnknownOpcode(invokeblock)

HIR:
fn first:
bb0(v0:BasicObject):
  v3:BasicObject = InvokeBuiltin _bi132, v0
  Return v3

[st0012]

Backtrace (from lldb)

* thread #1, queue = 'com.apple.main-thread', stop reason = signal SIGABRT
  * frame #0: 0x0000000192d8d388 libsystem_kernel.dylib`__pthread_kill + 8
    frame #1: 0x0000000192dc688c libsystem_pthread.dylib`pthread_kill + 296
    frame #2: 0x0000000192ccfc60 libsystem_c.dylib`abort + 124
    frame #3: 0x00000001000b6e24 ruby`die at error.c:1083:5
    frame #4: 0x000000010061c6c4 ruby`rb_assert_failure_detail(file=<unavailable>, line=<unavailable>, name="VM_ENV_FLAGS", expr="FIXNUM_P(flags)", fmt=0x0000000000000000) at error.c:1219:5
    frame #5: 0x000000010061c5e0 ruby`rb_assert_failure(file=<unavailable>, line=<unavailable>, name=<unavailable>, expr=<unavailable>) at error.c:1191:5
    frame #6: 0x0000000100620e44 ruby`rb_imemo_mark_and_move.cold.9 [inlined] VM_ENV_FLAGS(ep=<unavailable>, flag=<unavailable>) at vm_core.h:1439:5
    frame #7: 0x0000000100620e28 ruby`rb_imemo_mark_and_move.cold.9 [inlined] VM_ENV_ESCAPED_P(ep=<unavailable>) at vm_core.h:1537:5
    frame #8: 0x0000000100620e28 ruby`rb_imemo_mark_and_move.cold.9 at imemo.c:457:13
    frame #9: 0x0000000100271490 ruby`rb_vm_frame_method_entry [inlined] VM_ENV_FLAGS(ep=<unavailable>, flag=<unavailable>) at vm_core.h:1439:5
    frame #10: 0x000000010027148c ruby`rb_vm_frame_method_entry [inlined] VM_ENV_LOCAL_P(ep=<unavailable>) at vm_core.h:1513:12
    frame #11: 0x000000010027148c ruby`rb_vm_frame_method_entry(cfp=<unavailable>) at vm_insnhelper.c:770:13
    frame #12: 0x00000001002a8c44 ruby`rb_vmdebug_stack_dump_raw [inlined] control_frame_dump(ec=0x000000013fa048a0, cfp=0x0000000130107f58, errout=0x0000000200edd3f0) at vm_dump.c:64:44
    frame #13: 0x00000001002a8c30 ruby`rb_vmdebug_stack_dump_raw(ec=0x000000013fa048a0, cfp=0x0000000130107f58, errout=0x0000000200edd3f0) at vm_dump.c:236:9
    frame #14: 0x00000001002a9da0 ruby`rb_vm_bugreport(ctx=0x0000000000000000, errout=0x0000000200edd3f0) at vm_dump.c:1154:9
    frame #15: 0x000000010061c6b4 ruby`rb_assert_failure_detail(file=<unavailable>, line=<unavailable>, name="VM_ENV_FLAGS", expr="FIXNUM_P(flags)", fmt=0x0000000000000000) at error.c:1215:9
    frame #16: 0x000000010061c5e0 ruby`rb_assert_failure(file=<unavailable>, line=<unavailable>, name=<unavailable>, expr=<unavailable>) at error.c:1191:5
    frame #17: 0x0000000100620e44 ruby`rb_imemo_mark_and_move.cold.9 [inlined] VM_ENV_FLAGS(ep=<unavailable>, flag=<unavailable>) at vm_core.h:1439:5
    frame #18: 0x0000000100620e28 ruby`rb_imemo_mark_and_move.cold.9 [inlined] VM_ENV_ESCAPED_P(ep=<unavailable>) at vm_core.h:1537:5
    frame #19: 0x0000000100620e28 ruby`rb_imemo_mark_and_move.cold.9 at imemo.c:457:13
    frame #20: 0x0000000100274794 ruby`vm_sendish [inlined] VM_ENV_FLAGS(ep=<unavailable>, flag=<unavailable>) at vm_core.h:1439:5
    frame #21: 0x000000010027478c ruby`vm_sendish [inlined] VM_ENV_LOCAL_P(ep=<unavailable>) at vm_core.h:1513:12
    frame #22: 0x000000010027478c ruby`vm_sendish [inlined] VM_EP_LEP(ep=<unavailable>) at vm.c:72:13
    frame #23: 0x0000000100274774 ruby`vm_sendish [inlined] VM_CF_LEP(cfp=<unavailable>) at vm.c:108:12
    frame #24: 0x0000000100274774 ruby`vm_sendish [inlined] VM_CF_BLOCK_HANDLER(cfp=<unavailable>) at vm.c:121:23
    frame #25: 0x0000000100274774 ruby`vm_sendish [inlined] vm_invokeblock_i(ec=0x000000013fa048a0, reg_cfp=0x0000000130107f58, calling=0x000000016fdfe348) at vm_insnhelper.c:5951:27
    frame #26: 0x0000000100274770 ruby`vm_sendish(ec=0x000000013fa048a0, reg_cfp=0x0000000130107f58, cd=0x000000013e612e90, block_handler=<unavailable>, method_explorer=<unavailable>) at vm_insnhelper.c:5998:15
    frame #27: 0x000000010027c764 ruby`vm_exec_core(ec=0x000000013fa048a0) at vm.inc:0
    frame #28: 0x000000010027534c ruby`rb_vm_exec(ec=0x000000013fa048a0) at vm.c:2621:22
    frame #29: 0x000000010028c798 ruby`rb_iseq_eval_main(iseq=<unavailable>) at vm.c:2901:11 [artificial]
    frame #30: 0x00000001000c26a4 ruby`rb_ec_exec_node(ec=0x000000013fa048a0, n=0x000000011bb45000) at eval.c:282:9
    frame #31: 0x00000001000c25ac ruby`ruby_run_node(n=0x000000011bb45000) at eval.c:320:30
    frame #32: 0x0000000100000980 ruby`main [inlined] rb_main(argc=4, argv=0x000000016fdfee68) at main.c:42:12
    frame #33: 0x0000000100000964 ruby`main(argc=4, argv=0x000000016fdfee68) at main.c:62:12
    frame #34: 0x0000000192a26b98 dyld`start + 6076

[tekknolagi]

Nice small repro--great stuff

[st0012]

I did some investigation with Claude and this seem to be what happened:

1. Method Entry: ZJIT compiles method containing yield
2. Frame Creation: gen_push_frame() creates frame with:
   • ep[-2]: CME (method entry)
   • ep[-1]: VM_BLOCK_HANDLER_NONE (always)
   • ep[0]: Flags (raw u32, not FIXNUM)
3. Execution: ZJIT executes until invokeblock
4. Side-Exit: HIR generates side-exit (unknown opcode)
5. Interpreter Takeover: Interpreter continues with ZJIT frame active
6. Error Detection: invokeblock reads ep[-1], finds VM_BLOCK_HANDLER_NONE
7. Exception Raised: Ruby raises LocalJumpError
8. Stack Walking: Error handler walks stack to create backtrace
9. Frame Inspection: When examining ZJIT frame:
   • Calls VM_ENV_FLAGS(ep, flag)
   • Assertion fails because flags are not FIXNUM-encoded
   • Even if they were, other frame invariants are violated

We can fix this by having proper block yielding support, which I can't do by myself but will happy to learn.

[st0012]

Some stuff from the debugging session:

Another script that also fails:

def test(*arr, &b)
  p # for debugger breakpoint
  arr.class

  yield
end

test

Insn dump:

== disasm: #<ISeq:<main>@test.rb:1 (1,0)-(8,4)>
0000 definemethod                           :test, test               (   1)[Li]
0003 putself                                                          (   8)[Li]
0004 opt_send_without_block                 <calldata!mid:test, argc:0, FCALL|VCALL|ARGS_SIMPLE>
0006 leave

== disasm: #<ISeq:test@test.rb:1 (1,0)-(6,3)>
local table (size: 2, argc: 0 [opts: 0, rest: 0, post: 0, block: 1, kw: -1@-1, kwrest: -1])
[ 2] arr@0<Rest>[ 1] b@1<Block>
0000 putself                                                          (   2)[LiCa]
0001 opt_send_without_block                 <calldata!mid:p, argc:0, FCALL|VCALL|ARGS_SIMPLE>
0003 pop
0004 getlocal_WC_0                          arr@0                     (   3)[Li]
0006 opt_send_without_block                 <calldata!mid:class, argc:0, ARGS_SIMPLE>
0008 pop
0009 invokeblock                            <calldata!argc:0, ARGS_SIMPLE>(   5)[Li]
0011 leave                                                            (   6)[Re]

LLDB debugging output:

Process 82133 launched: '/Users/hung-wulo/src/github.com/Shopify/ruby/build/miniruby' (arm64)
  # ZJIT exit trampoline
  0x11bd60000: mov sp, x29
  0x11bd60004: ldp x29, x30, [sp], #0x10
  0x11bd60008: ret 

  # Block: bb0(v0)
  0x11bd6000c: stp x29, x30, [sp, #-0x10]!
  0x11bd60010: mov x29, sp
  # Insn: v3 SideExit UnknownOpcode(definemethod)
  0x11bd60014: b #0x11bd60018
  # Exit: UnknownOpcode(definemethod)
  # write stack slots: []
  # write locals: []
  # save cfp->pc
  0x11bd60018: mov x16, #0xba50
  0x11bd6001c: movk x16, #0x5760, lsl #16
  0x11bd60020: movk x16, #1, lsl #32
  0x11bd60024: stur x16, [x19]
  # save cfp->sp
  0x11bd60028: add x16, x21, #0
  0x11bd6002c: stur x16, [x19, #8]
  # exit to the interpreter
  0x11bd60030: mov sp, x29
  0x11bd60034: ldp x29, x30, [sp], #0x10
  0x11bd60038: mov x0, #0x24
  0x11bd6003c: ret 

  # ZJIT entry point: <main>@test.rb:1
  0x11bd60040: stp x29, x30, [sp, #-0x10]!
  0x11bd60044: mov x29, sp
  0x11bd60048: str x19, [sp, #-0x10]!
  0x11bd6004c: str x20, [sp, #-0x10]!
  0x11bd60050: str x21, [sp, #-0x10]!
  0x11bd60054: mov x20, x0
  0x11bd60058: mov x19, x1
  0x11bd6005c: ldur x21, [x19, #8]
  0x11bd60060: ldur x0, [x19, #0x18]
  0x11bd60064: bl #0x11bd6000c
  # exit to the interpreter
  0x11bd60068: ldr x21, [sp], #0x10
  0x11bd6006c: ldr x20, [sp], #0x10
  0x11bd60070: ldr x19, [sp], #0x10
  0x11bd60074: mov sp, x29
  0x11bd60078: ldp x29, x30, [sp], #0x10
  0x11bd6007c: ret 

  # Block: bb0(v0, v1, v2)
  0x11bd60080: stp x29, x30, [sp, #-0x10]!
  0x11bd60084: mov x29, sp
  # Insn: v5 SendWithoutBlock v0, :p
  # spill locals
  0x11bd60088: stur x1, [x21, #-0x28]
  0x11bd6008c: stur x2, [x21, #-0x20]
  # spill receiver and arguments
  0x11bd60090: stur x0, [x21]
  # save PC to CFP
  0x11bd60094: mov x0, #0x508
  0x11bd60098: movk x0, #0x5761, lsl #16
  0x11bd6009c: movk x0, #1, lsl #32
  0x11bd600a0: stur x0, [x19]
  # save SP to CFP: 1
  0x11bd600a4: add x0, x21, #8
  0x11bd600a8: stur x0, [x19, #8]
  # call #p with dynamic dispatch
  0x11bd600ac: str x1, [sp, #-0x10]!
  0x11bd600b0: str x2, [sp, #-0x10]!
  0x11bd600b4: mov x2, #0x5b0
  0x11bd600b8: movk x2, #0x5761, lsl #16
  0x11bd600bc: movk x2, #1, lsl #32
  0x11bd600c0: mov x1, x19
  0x11bd600c4: mov x0, x20
  0x11bd600c8: mov x16, #0x4730
  0x11bd600cc: movk x16, #0x3c, lsl #16
  0x11bd600d0: movk x16, #1, lsl #32
  0x11bd600d4: blr x16
  0x11bd600d8: ldr x2, [sp], #0x10
  0x11bd600dc: ldr x1, [sp], #0x10
  # Insn: v10 PatchPoint MethodRedefined(Array@0x101350aa0, class@0x7ad1)
  # Insn: v11 SendWithoutBlockDirect v1, :class (0x16fdf7bd0)
  # save PC to CFP
  0x11bd600e0: mov x0, #0x530
  0x11bd600e4: movk x0, #0x5761, lsl #16
  0x11bd600e8: movk x0, #1, lsl #32
  0x11bd600ec: stur x0, [x19]
  # save SP to CFP: 0
  0x11bd600f0: add x0, x21, #0
  0x11bd600f4: stur x0, [x19, #8]
  # spill locals and stack
  0x11bd600f8: stur x1, [x21, #-0x28]
  0x11bd600fc: stur x2, [x21, #-0x20]
  0x11bd60100: stur x1, [x21]
  # push cme, specval, frame type
  0x11bd60104: ldr x0, #0x11bd6010c
  0x11bd60108: b #0x11bd60114
  0x11bd6010c: .byte 0x70, 0x8e, 0xd5, 0x1b
  0x11bd60110: .byte 0x01, 0x00, 0x00, 0x00
  0x11bd60114: stur x0, [x21, #8]
  0x11bd60118: stur xzr, [x21, #0x10]
  0x11bd6011c: mov x0, #3
  0x11bd60120: movk x0, #0x1111, lsl #16
  0x11bd60124: stur x0, [x21, #0x18]
  # push callee control frame
  0x11bd60128: ldr x0, #0x11bd60130
  0x11bd6012c: b #0x11bd60138
  0x11bd60130: .byte 0xe0, 0x68, 0xd3, 0x1b
  0x11bd60134: .byte 0x01, 0x00, 0x00, 0x00
  0x11bd60138: stur x0, [x19, #-0x28]
  0x11bd6013c: stur x1, [x19, #-0x20]
  0x11bd60140: add x0, x21, #0x18
  0x11bd60144: stur x0, [x19, #-0x18]
  0x11bd60148: stur xzr, [x19, #-0x10]
  # switch to new SP register
  0x11bd6014c: adds x0, x21, #0x20
  0x11bd60150: mov x21, x0
  # switch to new CFP
  0x11bd60154: subs x0, x19, #0x38
  0x11bd60158: mov x19, x0
  0x11bd6015c: stur x19, [x20, #0x10]
  0x11bd60160: str x1, [sp, #-0x10]!
  0x11bd60164: str x2, [sp, #-0x10]!
  0x11bd60168: mov x0, x1
  0x11bd6016c: bl #0x11bd60080
  0x11bd60170: ldr x2, [sp], #0x10
  0x11bd60174: ldr x1, [sp], #0x10
  0x11bd60178: cmp x0, #0x24
  0x11bd6017c: b.eq #0x11bd60000
  0x11bd60180: nop 
  0x11bd60184: nop 
  0x11bd60188: nop 
  0x11bd6018c: nop 
  0x11bd60190: nop 
  # Insn: v9 SideExit UnknownOpcode(invokeblock)
  0x11bd60194: b #0x11bd601cc
  # Exit: PatchPoint(MethodRedefined(Array@0x101350aa0, class@0x7ad1))
  # write stack slots: [A64Reg { num_bits: 64, reg_no: 1 }]
  0x11bd60198: stur x1, [x21]
  # write locals: [A64Reg { num_bits: 64, reg_no: 1 }, A64Reg { num_bits: 64, reg_no: 2 }]
  0x11bd6019c: stur x1, [x21, #-0x28]
  0x11bd601a0: stur x2, [x21, #-0x20]
  # save cfp->pc
  0x11bd601a4: mov x16, #0x520
  0x11bd601a8: movk x16, #0x5761, lsl #16
  0x11bd601ac: movk x16, #1, lsl #32
  0x11bd601b0: stur x16, [x19]
  # save cfp->sp
  0x11bd601b4: add x16, x21, #8
  0x11bd601b8: stur x16, [x19, #8]
  # exit to the interpreter
  0x11bd601bc: mov sp, x29
  0x11bd601c0: ldp x29, x30, [sp], #0x10
  0x11bd601c4: mov x0, #0x24
  0x11bd601c8: ret 
  # Exit: UnknownOpcode(invokeblock)
  # write stack slots: []
  # write locals: [A64Reg { num_bits: 64, reg_no: 1 }, A64Reg { num_bits: 64, reg_no: 2 }]
  0x11bd601cc: stur x1, [x21, #-0x28]
  0x11bd601d0: stur x2, [x21, #-0x20]
  # save cfp->pc
  0x11bd601d4: mov x16, #0x538
  0x11bd601d8: movk x16, #0x5761, lsl #16
  0x11bd601dc: movk x16, #1, lsl #32
  0x11bd601e0: stur x16, [x19]
  # save cfp->sp
  0x11bd601e4: add x16, x21, #0
  0x11bd601e8: stur x16, [x19, #8]
  # exit to the interpreter
  0x11bd601ec: mov sp, x29
  0x11bd601f0: ldp x29, x30, [sp], #0x10
  0x11bd601f4: mov x0, #0x24
  0x11bd601f8: ret 

  # ZJIT entry point: test@test.rb:2
  0x11bd601fc: stp x29, x30, [sp, #-0x10]!
  0x11bd60200: mov x29, sp
  0x11bd60204: str x19, [sp, #-0x10]!
  0x11bd60208: str x20, [sp, #-0x10]!
  0x11bd6020c: str x21, [sp, #-0x10]!
  0x11bd60210: mov x20, x0
  0x11bd60214: mov x19, x1
  0x11bd60218: ldur x21, [x19, #8]
  0x11bd6021c: ldur x0, [x19, #0x18]
  # set method params: 2
  0x11bd60220: ldur x1, [x21, #-0x28]
  0x11bd60224: ldur x2, [x21, #-0x20]
  0x11bd60228: bl #0x11bd60080
  # exit to the interpreter
  0x11bd6022c: ldr x21, [sp], #0x10
  0x11bd60230: ldr x20, [sp], #0x10
  0x11bd60234: ldr x19, [sp], #0x10
  0x11bd60238: mov sp, x29
  0x11bd6023c: ldp x29, x30, [sp], #0x10
  0x11bd60240: ret 

  # Block: bb0(v0)
  0x11bd60244: stp x29, x30, [sp, #-0x10]!
  0x11bd60248: mov x29, sp
  # Insn: v3 InvokeBuiltin _bi20, v0
  # save PC to CFP
  0x11bd6024c: mov x1, #0x81d8
  0x11bd60250: movk x1, #0x58b6, lsl #16
  0x11bd60254: movk x1, #1, lsl #32
  0x11bd60258: stur x1, [x19]
  0x11bd6025c: mov x1, x0
  0x11bd60260: mov x0, x20
  0x11bd60264: mov x16, #0xecec
  0x11bd60268: movk x16, #0x20, lsl #16
  0x11bd6026c: movk x16, #1, lsl #32
  0x11bd60270: blr x16
  # Insn: v8 Return v3
  # pop stack frame
  0x11bd60274: adds x1, x19, #0x38
  0x11bd60278: mov x19, x1
  0x11bd6027c: stur x19, [x20, #0x10]
  0x11bd60280: mov sp, x29
  0x11bd60284: ldp x29, x30, [sp], #0x10
  0x11bd60288: mov x0, x0
  0x11bd6028c: ret 

  0x11bd6016c: bl #0x11bd60244

Process 82133 stopped
* thread #1, queue = 'com.apple.main-thread', stop reason = breakpoint 1.1
    frame #0: 0x00000001001815a0 miniruby`rb_f_p(argc=0, argv=0x0000000148028068, self=4315136784) at io.c:9126:11
   9123 rb_f_p(int argc, VALUE *argv, VALUE self)
   9124 {
   9125     int i;
-> 9126     for (i=0; i<argc; i++) {
   9127         VALUE inspected = rb_obj_as_string(rb_inspect(argv[i]));
   9128         rb_uninterruptible(rb_p_write, inspected);
   9129     }
Target 0: (miniruby) stopped.
(lldb) f 10
frame #10: 0x00000001003c476c miniruby`rb_vm_opt_send_without_block(ec=0x0000000157704f00, reg_cfp=0x0000000148127f58, cd=0x00000001576105b0) at vm_insnhelper.c:6038:17
   6035 {
   6036     stack_check(ec);
   6037     VALUE bh = VM_BLOCK_HANDLER_NONE;
-> 6038     VALUE val = vm_sendish(ec, GET_CFP(), cd, bh, mexp_search_method);
   6039     VM_EXEC(ec, val);
   6040     return val;
   6041 }
(lldb) finish
Process 82133 stopped
* thread #1, queue = 'com.apple.main-thread', stop reason = step out
Return value: (VALUE) $2 = 4

    frame #0: 0x000000011bd600d8
->  0x11bd600d8: ldr    x2, [sp], #0x10
    0x11bd600dc: ldr    x1, [sp], #0x10
    0x11bd600e0: mov    x0, #0x530 ; =1328 
    0x11bd600e4: movk   x0, #0x5761, lsl #16
Target 0: (miniruby) stopped.
(lldb) watch set   expression &rb_current_ec()->cfp->ep[0]
Watchpoint created: Watchpoint 2: addr = 0x148028058 size = 8 state = enabled type = m
    watchpoint spec = '&rb_current_ec()->cfp->ep[0]'
    watchpoint resources:
       #0: addr = 0x148028058 size = 8
Watchpoint 2 hit:
    
new value: 0x0000000011110003
(lldb) p/x  &rb_current_ec()->cfp->ep
(const VALUE **) 0x0000000148127f78
(lldb) p/x  rb_current_ec()->cfp->ep
(const VALUE *) 0x0000000148028058
(lldb) c
Process 82133 resuming

Watchpoint 2 hit:
old value: 0x0000000011110003
new value: 0x000000011bd58ea0
Process 82133 stopped
* thread #1, queue = 'com.apple.main-thread', stop reason = watchpoint 2
    frame #0: 0x000000011bd601d0
->  0x11bd601d0: stur   x2, [x21, #-0x20]
    0x11bd601d4: mov    x16, #0x538 ; =1336 
    0x11bd601d8: movk   x16, #0x5761, lsl #16
    0x11bd601dc: movk   x16, #0x1, lsl #32
Target 0: (miniruby) stopped.
(lldb) 

[tekknolagi]

Any insight from the meeting into why this is happening?

[k0kubun]

As per Alan's finding after pairing, here's a PR that fixes the repro ruby#13882.