Segmentation fault during GC

[vchuravy]

Fairly small reproducer at https://gist.github.com/vchuravy/b7ab95cf515168b2655be760117b6cab

It should be able to reduce further since HagerZhang just calls ϕdϕ a bunch.

Julia Version 1.11.9
Commit 53a02c0720c (2026-02-06 00:27 UTC)
Build Info:
  Official https://julialang.org/ release
Platform Info:
  OS: Linux (x86_64-linux-gnu)
  CPU: 32 × AMD Ryzen 9 5950X 16-Core Processor
  WORD_SIZE: 64
  LLVM: libLLVM-16.0.6 (ORCJIT, znver3)
Threads: 1 default, 0 interactive, 1 GC (on 32 virtual cores)

[vchuravy]

This might have been an actual Julia bug. JuliaLang/julia#61639 (or at least I found that one while looking into this one)

[vchuravy]

Sadly reproduces even with the patch, but it seems to be a missing store to an Array.mem field, so potentially something that got fixed by JuliaLang/julia#60924

[vchuravy]

@wsmoses turning the attributor off turns the reproducer from a 90% likelihood to a 0/316 runs.

My current root cause is that we allocate an Array (likely the shadow) and we do not initalize the Array.mem to zero.
GC then finds the Array, and is unhappy about the uninitialized memory.

I am trying to find the transformation that causes this, but so far I had no luck, but it might be a combination of the allocator kind flags and attributor.

[vchuravy]

Here is a Git repo that contains the history of all changes using --print-changed https://gist.github.com/vchuravy/aff6a80865e63d73079a0e6bc09100fb for all functions starting with fwddiffe