Memory corruption bug in rustc causes UI panics on nightly

@tmstorey

Bevy version and features

Using Bevy 0.19 and rust nightly rustc 1.99.0-nightly (af3d95584 2026-07-09)
I'm using default features, dynamic_linking and debug.

What you did

I tried spawning a ui Node using bsn!. I tried to trim my code to something simple that still produces the error. Do note I still only tried it as part of my larger project. It is the only place with UI or bsn however.

impl Plugin for GameUiPlugin {
    fn build(&self, app: &mut App) {
        app
               .add_plugins(DefaultPlugins)
            .add_systems(OnEnter(AppState::InGame), summary.spawn());
    }
}

pub fn summary()    -> impl Scene {
    bsn! {
         Node {
            width: px(20), //same errors with `percent` instead
            height: px(80),
        }
    }
}

What went wrong

The program panics as soon as it's launched (I assume when the AppState::InGame state is entered). Specifically I get

thread 'Compute Task Pool (1)' (308695) panicked at /home/t/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/taffy-0.10.1/src/util/resolve.rs:68:18:
internal error: entered unreachable code
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
Encountered a panic in system `bevy_ui::layout::ui_layout_system`!
Encountered a panic in system `bevy_app::main_schedule::Main::run_main`!
free(): invalid size

The last line about the memory error changes to double free or corruption (out) and segmentation fault (core dumped) as well but I think that's unrelated to the problem and a side-effect of the panic from unreachable instead.

Additional information

Following a discussion with @tmstorey on discord they dug up the relevant taffy code

fn maybe_resolve(self, context: Option<f32>, calc: impl Fn(*const (), f32) -> f32) -> Option<f32> {
        match self.0.tag() {
            CompactLength::AUTO_TAG => None,
            CompactLength::LENGTH_TAG => Some(self.0.value()),
            CompactLength::PERCENT_TAG => context.map(|dim| dim * self.0.value()),
            #[cfg(feature = "calc")]
            _ if self.0.is_calc() => context.map(|dim| calc(self.0.calc_value(), dim)),
            _ => unreachable!(),
        }
}

I don't understand how that unreachable could be reached. Using percent should have gone to the PERCENT_TAG branch I think. I'll admit I don't know much though, only just touching UI and bsn for the first time.

Here is the start of the discussion on discord.

While I did not test someone reported on discord that this doesn't seem to happen on stable (rust 1.97)

This may be due to rust-lang/rust#159035.

@s0lst1ce

May I know how you came to that conclusion? Just making sure there isn't yet another miscompile. @s0lst1ce

rust-lang/rust#159035 shouldn't be able to cause going into an unreachable branch.

May I know how you came to that conclusion? Just making sure there isn't yet another miscompile. @s0lst1ce

rust-lang/rust#159035 shouldn't be able to cause going into an unreachable branch.

I'm not sure it is the cause, it could be something else. But using a nightly build predating that PR works. This is all way beyond my expertise. I'm simply trying to figure out a root cause and someone on discord suggested it may be the cause so I cross-posted here.

But using a nightly build predating that PR works

Which PR exactly? rust-lang/rust#155473 or rust-lang/rust#155850? Which nightlies did you try with which results?

Please give the precise rustc --version for each one you tried so that we can identify the exact points in time in the compiler's repository that work (or don't).

But using a nightly build predating that PR works

Which PR exactly? rust-lang/rust#155473 or rust-lang/rust#155850? Which nightlies did you try with which results?

I only looked at github.com/rust-lang/rust/pull/155850 and took a nightly build from before April 29. I don't remember all the ones I tried, sorry. Currently on nightly-2026-03-30-x86_64-unknown-linux-gnu which works, but this is almost a month before either. I with other version if you want though. Do note it does take me around 20 minutes to download & compile for each rustc version though.

I see.

Please use https://github.com/rust-lang/cargo-bisect-rustc to pinpoint the breakage.

I am bisecting this. The reproducer is:

use bevy::prelude::*;

fn main() {
    App::new()
        .add_plugins(DefaultPlugins)
        .add_systems(Startup, summary.spawn())
        .run();
}

pub fn summary() -> impl Scene {
    bsn! {
         Node {
            width: px(20), //same errors with `percent` instead
            height: px(80),
        }
    }
}

which takes a considerable amount of time to compile.

I believe this is the same bug as rust-lang/rust#159116, since it bisects to the same rollup and is fixed by the same patch. It is not related to rust-lang/rust#159035.

@saethlin

Thank you, @saethlin!

Thanks everyone for the help ! I believe you no longer need me to bisect anything. Correct me if I'm wrong. I remain available to help where I can.

Correct. We just needed a reproducer, which is why I asked for one on the Discord :)

Thanks y'all <3 ILY rustc team. Closing as fixed upstream.

Just tried today's nightly build and I can confirm the bug is fixed. Thanks everyone for your work.

Navigation Menu

Repository navigation

Memory corruption bug in rustc causes UI panics on nightly #24952

Bevy version and features

What you did

What went wrong

Additional information

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Memory corruption bug in rustc causes UI panics on nightly #24952

Description

Bevy version and features

What you did

What went wrong

Additional information

Activity

s0lst1ce commented on Jul 11, 2026

s0lst1ce commented on Jul 11, 2026

s0lst1ce commented on Jul 11, 2026

theemathas commented on Jul 11, 2026

s0lst1ce commented on Jul 11, 2026

RalfJung commented on Jul 11, 2026

workingjubilee commented on Jul 11, 2026

s0lst1ce commented on Jul 11, 2026

workingjubilee commented on Jul 11, 2026

saethlin commented on Jul 11, 2026

saethlin commented on Jul 11, 2026

workingjubilee commented on Jul 11, 2026

s0lst1ce commented on Jul 11, 2026

saethlin commented on Jul 11, 2026

alice-i-cecile commented on Jul 12, 2026

s0lst1ce commented on Jul 13, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions