Closures assigned within an elif block in another closure cause segfault

[GunTurtle]

Nim Version

Nim Compiler Version 2.2.6 [Linux: amd64]
Compiled at 2025-10-31
Copyright (c) 2006-2025 by Andreas Rumpf

git hash: ab00c56
active boot switches: -d:release

Description

Here is a snippet closure_segfault_elif.nim demonstrating the problem:

var p1: proc() {.closure.}
var p2: proc() {.closure.}
var p3: proc() {.closure.}

proc makeClosure(): proc(i: int) =
    var arr = @[0,0,0]
    echo "arr defined: " & $arr
    var p = proc(i: int) =
        if i == 0:
            p1 = proc() =
                arr[0] = 1
                echo "p1; arr = " & $arr
        elif i == 1:
            p2 = proc() =
                arr[1] = 2
                echo "p2; arr = " & $arr
            p3 = proc() =
                arr[2] = 3
                echo "p3; arr = " & $arr
    return p

var dostuff = makeClosure()
dostuff(0) # define p1
dostuff(1) # define p2, p3
p1()
p2()
p3() # causes segfault if p3 is assigned in 'elif' block

The closure p3 will not capture arr and will segfault when it is called. The same error occurs if an else block is used instead of elif.

Current Output

arr defined: @[0, 0, 0]
p1; arr = @[1, 0, 0]
p2; arr = @[1, 2, 0]
Traceback (most recent call last)
closure_segfault_elif.nim(27) closure_segfault_elif
closure_segfault_elif.nim(18) :anonymous
SIGSEGV: Illegal storage access. (Attempt to read from nil?)
Segmentation fault (core dumped)

Expected Output

arr defined: @[0, 0, 0]
p1; arr = @[1, 0, 0]
p2; arr = @[1, 2, 0]
p3; arr = @[1, 2, 3]

Known Workarounds

Using if for all branches instead of if...elif resolves the problem:

var p1: proc() {.closure.}
var p2: proc() {.closure.}
var p3: proc() {.closure.}

proc makeClosure(): proc(i: int) =
    var arr = @[0,0,0]
    echo "arr defined: " & $arr
    var p = proc(i: int) =
        if i == 0:
            p1 = proc() =
                arr[0] = 1
                echo "p1; arr = " & $arr
        if i == 1:
            p2 = proc() =
                arr[1] = 2
                echo "p2; arr = " & $arr
            p3 = proc() =
                arr[2] = 3
                echo "p3; arr = " & $arr
    return p

var dostuff = makeClosure()
dostuff(0) # define p1
dostuff(1) # define p2, p3
p1()
p2()
p3()

The problem does not occur if a greater or equal number of closures are assigned in the if block as the elif block:

var p1: proc() {.closure.}
var p2: proc() {.closure.}
var p3: proc() {.closure.}
var p4: proc() {.closure.}

proc makeClosure(): proc(i: int) =
    var arr = @[0,0,0]
    echo "arr defined: " & $arr
    var p = proc(i: int) =
        if i == 0:
            p1 = proc() =
                arr[0] = 1
                echo "p1; arr = " & $arr
            p4 = proc() =
                arr[0] = 9
                echo "p4; arr = " & $arr
        elif i == 1:
            p2 = proc() =
                arr[1] = 2
                echo "p2; arr = " & $arr
            p3 = proc() =
                arr[2] = 3
                echo "p3; arr = " & $arr
    return p

var dostuff = makeClosure()
dostuff(0) # define p1, p4
dostuff(1) # define p2, p3
p1()
p2()
p3()
p4()

The problem does not occur if closures are only assigned in one branch of the if...elif statement:

var p2: proc() {.closure.}
var p3: proc() {.closure.}

proc makeClosure(): proc(i: int) =
    var arr = @[0,0,0]
    echo "arr defined: " & $arr
    var p = proc(i: int) =
        if i == 0:
            discard
        elif i == 1:
            p2 = proc() =
                arr[1] = 2
                echo "p2; arr = " & $arr
            p3 = proc() =
                arr[2] = 3
                echo "p3; arr = " & $arr
    return p

var dostuff = makeClosure()
dostuff(0) # do nothing
dostuff(1) # define p2, p3
p2()
p3()

Additional Information

No response

[ringabout]

!nim c

var p1: proc() {.closure.}
var p2: proc() {.closure.}
var p3: proc() {.closure.}

proc makeClosure(): proc(i: int) =
    var arr = @[0,0,0]
    echo "arr defined: " & $arr
    var p = proc(i: int) =
        if i == 0:
            p1 = proc() =
                arr[0] = 1
                echo "p1; arr = " & $arr
        elif i == 1:
            p2 = proc() =
                arr[1] = 2
                echo "p2; arr = " & $arr
            p3 = proc() =
                arr[2] = 3
                echo "p3; arr = " & $arr
    return p

var dostuff = makeClosure()
dostuff(0) # define p1
dostuff(1) # define p2, p3
p1()
p2()
p3() # causes segfault if p3 is assigned in 'elif' block

[github-actions]

🐧 Linux bisect by @ringabout (member)

devel 👎 FAIL

Output

Filesize 111.34 Kb (114,008 bytes)
Duration

stable 👎 FAIL

Output

Filesize 106.54 Kb (109,096 bytes)
Duration

2.2.4 👎 FAIL

Output

Filesize 110.80 Kb (113,464 bytes)
Duration

2.0.0 👎 FAIL

Output

Filesize 106.50 Kb (109,056 bytes)
Duration

1.6.20 👍 OK

Output

Filesize 111.24 Kb (113,912 bytes)
Duration

1.4.8 👍 OK

Output

Filesize 107.45 Kb (110,032 bytes)
Duration

1.2.18 👍 OK

Output

Filesize 107.16 Kb (109,736 bytes)
Duration

1.0.10 👍 OK

Output

Filesize 106.90 Kb (109,464 bytes)
Duration

??? ➡️ 🐛

Diagnostics

The commit that introduced the bug can not be found, but the bug is in the commits:

• #0769b160c
• #1737bb9f9
• #567c3f055
• #0b1650576
• #cbd9fee22
• #8d47bf182

(Can not find the commit because Nim can not be re-built commit-by-commit to bisect).

Stats

• GCC 13.3.0
• Clang 18.1.3
• NodeJS 19.6
• Created 2025-12-04T14:46:09Z
• Comments 1
• Commands nim c --run -d:nimDebug -d:nimDebugDlOpen -d:ssl -d:nimDisableCertificateValidation --forceBuild:on --colors:off --verbosity:0 --hints:off --lineTrace:off --nimcache:/home/runner/work/Nim/Nim --out:/home/runner/work/Nim/Nim/temp /home/runner/work/Nim/Nim/temp.nim

🤖 Bug found in 8 mins bisecting 3059 commits at 347 commits per second

[ringabout]

!nim c --gc:arc

var p1: proc() {.closure.}
var p2: proc() {.closure.}
var p3: proc() {.closure.}

proc makeClosure(): proc(i: int) =
    var arr = @[0,0,0]
    echo "arr defined: " & $arr
    var p = proc(i: int) =
        if i == 0:
            p1 = proc() =
                arr[0] = 1
                echo "p1; arr = " & $arr
        elif i == 1:
            p2 = proc() =
                arr[1] = 2
                echo "p2; arr = " & $arr
            p3 = proc() =
                arr[2] = 3
                echo "p3; arr = " & $arr
    return p

var dostuff = makeClosure()
dostuff(0) # define p1
dostuff(1) # define p2, p3
p1()
p2()
p3() # causes segfault if p3 is assigned in 'elif' block

[github-actions]

🐧 Linux bisect by @ringabout (member)

devel 👎 FAIL

Output

Filesize 102.49 Kb (104,952 bytes)
Duration 1 mins

stable 👎 FAIL

Output

Filesize 97.70 Kb (100,040 bytes)
Duration

2.2.4 👎 FAIL

Output

Filesize 98.12 Kb (100,472 bytes)
Duration

2.0.0 👎 FAIL

Output

Filesize 97.72 Kb (100,064 bytes)
Duration

1.6.20 👍 OK

Output

Filesize 91.92 Kb (94,128 bytes)
Duration

1.4.8 👎 FAIL

Output

Filesize 91.92 Kb (94,128 bytes)
Duration

1.2.18 👎 FAIL

Output

Filesize 88.42 Kb (90,544 bytes)
Duration

1.0.10 👎 FAIL

Output

Filesize 88.42 Kb (90,544 bytes)
Duration

#8d47bf182 ➡️ 🐛

Diagnostics

andreas rumpf introduced a bug at 2022-10-01 16:46:51 +0200 on commit #8d47bf182 with message:

The bug is in the files:

The bug can be in the commits:

• #8d47bf182
• #cfff454cf
• #24b81e9df
• #96c5586d0
• #ae050b05e
• #3e43ea338

(Diagnostics sometimes off-by-one).

Stats

• GCC 13.3.0
• Clang 18.1.3
• NodeJS 19.6
• Created 2025-12-05T05:13:33Z
• Comments 3
• Commands nim c --gc:arc -d:nimArcDebug -d:nimArcIds --run -d:nimDebug -d:nimDebugDlOpen -d:ssl -d:nimDisableCertificateValidation --forceBuild:on --colors:off --verbosity:0 --hints:off --lineTrace:off --nimcache:/home/runner/work/Nim/Nim --out:/home/runner/work/Nim/Nim/temp /home/runner/work/Nim/Nim/temp.nim

🤖 Bug found in 20 mins bisecting 3060 commits at 150 commits per second