Memory corruption bug in rustc causes UI panics on nightly

[s0lst1ce]

Bevy version and features

Using Bevy 0.19 and rust nightly rustc 1.99.0-nightly (af3d95584 2026-07-09)
I'm using default features, dynamic_linking and debug.

What you did

I tried spawning a ui Node using bsn!. I tried to trim my code to something simple that still produces the error. Do note I still only tried it as part of my larger project. It is the only place with UI or bsn however.

impl Plugin for GameUiPlugin {
    fn build(&self, app: &mut App) {
        app
               .add_plugins(DefaultPlugins)
            .add_systems(OnEnter(AppState::InGame), summary.spawn());
    }
}

pub fn summary()    -> impl Scene {
    bsn! {
         Node {
            width: px(20), //same errors with `percent` instead
            height: px(80),
        }
    }
}

What went wrong

The program panics as soon as it's launched (I assume when the AppState::InGame state is entered). Specifically I get

thread 'Compute Task Pool (1)' (308695) panicked at /home/t/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/taffy-0.10.1/src/util/resolve.rs:68:18:
internal error: entered unreachable code
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
Encountered a panic in system `bevy_ui::layout::ui_layout_system`!
Encountered a panic in system `bevy_app::main_schedule::Main::run_main`!
free(): invalid size

The last line about the memory error changes to double free or corruption (out) and segmentation fault (core dumped) as well but I think that's unrelated to the problem and a side-effect of the panic from unreachable instead.

Additional information

Following a discussion with @tmstorey on discord they dug up the relevant taffy code

fn maybe_resolve(self, context: Option<f32>, calc: impl Fn(*const (), f32) -> f32) -> Option<f32> {
        match self.0.tag() {
            CompactLength::AUTO_TAG => None,
            CompactLength::LENGTH_TAG => Some(self.0.value()),
            CompactLength::PERCENT_TAG => context.map(|dim| dim * self.0.value()),
            #[cfg(feature = "calc")]
            _ if self.0.is_calc() => context.map(|dim| calc(self.0.calc_value(), dim)),
            _ => unreachable!(),
        }
}

I don't understand how that unreachable could be reached. Using percent should have gone to the PERCENT_TAG branch I think. I'll admit I don't know much though, only just touching UI and bsn for the first time.

[s0lst1ce]

Here is the start of the discussion on discord.

[s0lst1ce]

While I did not test someone reported on discord that this doesn't seem to happen on stable (rust 1.97)

[s0lst1ce]

This may be due to rust-lang/rust#159035.

[theemathas]

May I know how you came to that conclusion? Just making sure there isn't yet another miscompile. @s0lst1ce

rust-lang/rust#159035 shouldn't be able to cause going into an unreachable branch.

[s0lst1ce]

May I know how you came to that conclusion? Just making sure there isn't yet another miscompile. @s0lst1ce

rust-lang/rust#159035 shouldn't be able to cause going into an unreachable branch.

I'm not sure it is the cause, it could be something else. But using a nightly build predating that PR works. This is all way beyond my expertise. I'm simply trying to figure out a root cause and someone on discord suggested it may be the cause so I cross-posted here.

[RalfJung]

But using a nightly build predating that PR works

Which PR exactly? rust-lang/rust#155473 or rust-lang/rust#155850? Which nightlies did you try with which results?

[workingjubilee]

Please give the precise rustc --version for each one you tried so that we can identify the exact points in time in the compiler's repository that work (or don't).

[s0lst1ce]

But using a nightly build predating that PR works

Which PR exactly? rust-lang/rust#155473 or rust-lang/rust#155850? Which nightlies did you try with which results?

I only looked at github.com/rust-lang/rust/pull/155850 and took a nightly build from before April 29. I don't remember all the ones I tried, sorry. Currently on nightly-2026-03-30-x86_64-unknown-linux-gnu which works, but this is almost a month before either. I with other version if you want though. Do note it does take me around 20 minutes to download & compile for each rustc version though.

[workingjubilee]

I see.

Please use https://github.com/rust-lang/cargo-bisect-rustc to pinpoint the breakage.

[saethlin]

I am bisecting this. The reproducer is:

use bevy::prelude::*;

fn main() {
    App::new()
        .add_plugins(DefaultPlugins)
        .add_systems(Startup, summary.spawn())
        .run();
}

pub fn summary() -> impl Scene {
    bsn! {
         Node {
            width: px(20), //same errors with `percent` instead
            height: px(80),
        }
    }
}

which takes a considerable amount of time to compile.

[saethlin]

I believe this is the same bug as rust-lang/rust#159116, since it bisects to the same rollup and is fixed by the same patch. It is not related to rust-lang/rust#159035.

[workingjubilee]

Thank you, @saethlin!

[s0lst1ce]

Thanks everyone for the help ! I believe you no longer need me to bisect anything. Correct me if I'm wrong. I remain available to help where I can.