Skip to content

Miscompilation causing segfault with dyn Future on recent nightly versions #152735

@bgw

Description

@bgw

This is the smallest possible reproduction I was able to come up with:

use std::{any::Any, future::Future, pin::Pin};

trait TaskFn {
    fn call_task(&self) -> Pin<Box<dyn Future<Output = ()> + Send>>;
}

type Node = dyn Any;

impl<F: Fn() -> Fut, Fut: Future<Output = ()> + Send + 'static> TaskFn for F {
    fn call_task(&self) -> Pin<Box<dyn Future<Output = ()> + Send>> {
        Box::pin((self)())
    }
}

trait Visit {
    type EdgesFuture: Send;
}

impl<VisitFn: Fn(&Node) -> EdgesFuture, EdgesFuture: Send> Visit for VisitFn {
    type EdgesFuture = EdgesFuture;
}

fn visit<V: Visit>(_: V) -> impl Future<Output = Option<V::EdgesFuture>> + Send {
    futures::future::ready(None::<V::EdgesFuture>)
}

fn main() {
    futures::executor::block_on(
        (Box::new(|| async {
            visit(|_: &Node| async {}).await;
        }) as Box<dyn TaskFn>)
            .call_task(),
    )
}

I expected to see this happen: Exit code zero

Instead, this happened: SIGSEGV (or SIGILL if compiled in release mode)

This can be reproduced in the rust playground by selecting the nightly compiler: https://play.rust-lang.org/?version=nightly&mode=debug&edition=2024&gist=aaf6f4c5584fe181293b5f6cfbcd56de

This example uses the futures crate, but this is a simply a minimal reduction of a bug I encountered with tokio.

Meta

This happens with any rust-toolchain.toml with a value equal to or newer than:

[toolchain]
channel = "nightly-2026-02-10"

That translates to:

rustc --version --verbose:

rustc 1.95.0-nightly (18d13b533 2026-02-09)
binary: rustc
commit-hash: 18d13b5332916ffca8eadb9106d54b5b434e9978
commit-date: 2026-02-09
host: aarch64-unknown-linux-gnu
release: 1.95.0-nightly
LLVM version: 22.1.0

This also reproduces on the latest nightly:

rustc 1.95.0-nightly (873b4beb0 2026-02-15)
binary: rustc
commit-hash: 873b4beb0cc726493b94c8ef21f68795c04fbbc1
commit-date: 2026-02-15
host: aarch64-unknown-linux-gnu
release: 1.95.0-nightly
LLVM version: 22.1.0

This does not reproduce on any nightly releases older than what's shown here.

Metadata

Metadata

Assignees

No one assigned

    Labels

    A-async-awaitArea: Async & AwaitA-auto-traitsArea: auto traits (e.g., `auto trait Send {}`)A-dyn-traitArea: trait objects, vtable layoutA-higher-rankedArea: Higher-ranked things (e.g., lifetimes, types, trait bounds aka HRTBs)A-impl-traitArea: `impl Trait`. Universally / existentially quantified anonymous types with static dispatch.C-bugCategory: This is a bug.E-needs-testCall for participation: An issue has been fixed and does not reproduce, but no test has been added.I-miscompileIssue: Correct Rust code lowers to incorrect machine codeI-types-nominatedNominated for discussion during a types team meeting.I-unsoundIssue: A soundness hole (worst kind of bug), see: https://en.wikipedia.org/wiki/SoundnessS-has-mcveStatus: A Minimal Complete and Verifiable Example has been found for this issueT-compilerRelevant to the compiler team, which will review and decide on the PR/issue.T-typesRelevant to the types team, which will review and decide on the PR/issue.

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions