segfault(`forge script`): repeated `vm.createSelectFork` with same RPC causes segfault, previously error

[zerosnacks]

Component

Forge

Have you ensured that all of these are up to date?

• Foundry
• Foundryup

What version of Foundry are you on?

nightly-99d3a4123eff947a0dbbfb7c3a27360db9e3a8c1

What version of Foundryup are you on?

foundryup: 1.3.0

What command(s) is the bug in?

forge script

Operating System

None

Describe the bug

We are experiencing a segfault in the proposed v1.3.1 release

This occurs when making a call to a contract that is not tracked

// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.13;

import {Script, console} from "forge-std/Script.sol";
import {Counter} from "../src/Counter.sol";

contract CounterScript is Script {
    Counter public counter;

    function setUp() public {}

    function run() public {
        vm.createSelectFork("https://eth.llamarpc.com");

        vm.startBroadcast();
        counter = new Counter();
        vm.stopBroadcast();

        vm.createSelectFork("https://eth.llamarpc.com");

        vm.startBroadcast();
        counter.increment();
        vm.stopBroadcast();
    }
}

In v1.3.0-rc4 yields (this @0xrusowsky and I perceive to be correct and intended):

Traces:
  [455349] → new CounterScript@0x9f7cF1d1F558E57ef88a59ac3D47214eF25B6A06
    └─ ← [Return] 2162 bytes of code

  [121] CounterScript::setUp()
    └─ ← [Stop]

  [141697] CounterScript::run()
    ├─ [0] VM::createSelectFork("<rpc url>")
    │   └─ ← [Return] 0
    ├─ [0] VM::startBroadcast()
    │   └─ ← [Return]
    ├─ [96345] → new Counter@0x7FA9385bE102ac3EAc297483Dd6233D62b3e1496
    │   └─ ← [Return] 481 bytes of code
    ├─ [0] VM::stopBroadcast()
    │   └─ ← [Return]
    ├─ [0] VM::createSelectFork("<rpc url>")
    │   └─ ← [Return] 1
    ├─ [0] VM::startBroadcast()
    │   └─ ← [Return]
    └─ ← [Revert] call to non-contract address 0x7FA9385bE102ac3EAc297483Dd6233D62b3e1496

Gas used: 162761
Error: script failed: call to non-contract address 0x7FA9385bE102ac3EAc297483Dd6233D62b3e1496

On nightly this now yields:

The application panicked (crashed).
Message:  null pointer dereference occurred
Location: /Users/zerosnacks/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/revm-interpreter-24.0.0/src/interpreter/ext_bytecode.rs:129

This is a bug. Consider reporting it at https://github.com/foundry-rs/foundry

  ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ BACKTRACE ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
                                ⋮ 10 frames hidden ⋮
  11: std::sys::backtrace::__rust_end_short_backtrace::haac0e906ed75717a
      at /rustc/6b00bc3880198600130e1cf62b8f8a93494488cc/library/std/src/sys/backtrace.rs:168
  12: __rustc[4794b31dd7191200]::rust_begin_unwind<unknown>
      at /rustc/6b00bc3880198600130e1cf62b8f8a93494488cc/library/std/src/panicking.rs:697
  13: core::panicking::panic_nounwind_fmt::runtime::ha95d19de7f158e7a
      at /rustc/6b00bc3880198600130e1cf62b8f8a93494488cc/library/core/src/panicking.rs:117
  14: core::panicking::panic_nounwind_fmt::h82bea23087e0bb7b
      at /rustc/6b00bc3880198600130e1cf62b8f8a93494488cc/library/core/src/intrinsics/mod.rs:3196
  15: core::panicking::panic_null_pointer_dereference::h1b29f4a8b556d161
      at /rustc/6b00bc3880198600130e1cf62b8f8a93494488cc/library/core/src/panicking.rs:312
  16: opcode<unknown>
      at /Users/zerosnacks/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/revm-interpreter-24.0.0/src/interpreter/ext_bytecode.rs:129
       127 │     fn opcode(&self) -> u8 {
       128 │         // SAFETY: `instruction_pointer` always point to bytecode.
       129 >         unsafe { *self.instruction_pointer }
       130 │     }
       131 │
  17: step<revm_context::context::Context<revm_context::block::BlockEnv, revm_context::tx::TxEnv, revm_context::cfg::CfgEnv<revm_primitives::hardfork::SpecId>, &mut dyn foundry_evm_core::backend::DatabaseExt<Error=foundry_fork_db::error::DatabaseError>, revm_context::journal::Journal<&mut dyn foundry_evm_core::backend::DatabaseExt<Error=foundry_fork_db::error::DatabaseError>, revm_context::journal::entry::JournalEntry>, (), revm_context::local::LocalContext>, &mut dyn foundry_evm_core::backend::DatabaseExt<Error=foundry_fork_db::error::DatabaseError>><unknown>
      at /Users/zerosnacks/Projects/work/foundry/crates/evm/evm/src/inspectors/script.rs:34
        32 │         // Check if both target and bytecode address are the same as script contract address
        33 │         // (allow calling external libraries when bytecode address is different).
        34 >         if interpreter.bytecode.opcode() == ADDRESS
        35 │             && interpreter.input.target_address == self.script_address
        36 │             && interpreter.input.bytecode_address == Some(self.script_address)
  18: step_inlined<unknown>
      at /Users/zerosnacks/Projects/work/foundry/crates/evm/evm/src/inspectors/stack.rs:820
       818 │                 &mut self.cheatcodes,
       819 │             ],
       820 >             |inspector| (**inspector).step(interpreter, ecx),
       821 │         );
       822 │     }
  19: step<unknown>
      at /Users/zerosnacks/Projects/work/foundry/crates/evm/evm/src/inspectors/stack.rs:1102
      1100 │         ecx: &mut EthEvmContext<&mut dyn DatabaseExt>,
      1101 │     ) {
      1102 >         self.as_mut().step_inlined(interpreter, ecx)
      1103 │     }
      1104 │
  20: step<revm_context::context::Context<revm_context::block::BlockEnv, revm_context::tx::TxEnv, revm_context::cfg::CfgEnv<revm_primitives::hardfork::SpecId>, &mut dyn foundry_evm_core::backend::DatabaseExt<Error=foundry_fork_db::error::DatabaseError>, revm_context::journal::Journal<&mut dyn foundry_evm_core::backend::DatabaseExt<Error=foundry_fork_db::error::DatabaseError>, revm_context::journal::entry::JournalEntry>, (), revm_context::local::LocalContext>, revm_interpreter::interpreter::EthInterpreter<(), revm_interpreter::interpreter::shared_memory::SharedMemory>, foundry_evm::inspectors::stack::InspectorStack><unknown>
      at /Users/zerosnacks/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/revm-inspector-8.1.0/src/inspector.rs:16
        14 │ /// Object that is implemented this trait is used in `InspectorHandler` to trace the EVM execution.
        15 │ /// And API that allow calling the inspector can be found in [`crate::InspectEvm`] and [`crate::InspectCommitEvm`].
        16 > #[auto_impl(&mut, Box)]
        17 │ pub trait Inspector<CTX, INTR: InterpreterTypes = EthInterpreter> {
        18 │     /// Called before the interpreter is initialized.
  21: step<revm_context::context::Context<revm_context::block::BlockEnv, revm_context::tx::TxEnv, revm_context::cfg::CfgEnv<revm_primitives::hardfork::SpecId>, &mut dyn foundry_evm_core::backend::DatabaseExt<Error=foundry_fork_db::error::DatabaseError>, revm_context::journal::Journal<&mut dyn foundry_evm_core::backend::DatabaseExt<Error=foundry_fork_db::error::DatabaseError>, revm_context::journal::entry::JournalEntry>, (), revm_context::local::LocalContext>, revm_interpreter::interpreter::EthInterpreter<(), revm_interpreter::interpreter::shared_memory::SharedMemory>, &mut foundry_evm::inspectors::stack::InspectorStack><unknown>
      at /Users/zerosnacks/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/revm-inspector-8.1.0/src/inspector.rs:16
        14 │ /// Object that is implemented this trait is used in `InspectorHandler` to trace the EVM execution.
        15 │ /// And API that allow calling the inspector can be found in [`crate::InspectEvm`] and [`crate::InspectCommitEvm`].
        16 > #[auto_impl(&mut, Box)]
        17 │ pub trait Inspector<CTX, INTR: InterpreterTypes = EthInterpreter> {
        18 │     /// Called before the interpreter is initialized.
  22: inspect_instructions<revm_context::context::Context<revm_context::block::BlockEnv, revm_context::tx::TxEnv, revm_context::cfg::CfgEnv<revm_primitives::hardfork::SpecId>, &mut dyn foundry_evm_core::backend::DatabaseExt<Error=foundry_fork_db::error::DatabaseError>, revm_context::journal::Journal<&mut dyn foundry_evm_core::backend::DatabaseExt<Error=foundry_fork_db::error::DatabaseError>, revm_context::journal::entry::JournalEntry>, (), revm_context::local::LocalContext>, revm_interpreter::interpreter::EthInterpreter<(), revm_interpreter::interpreter::shared_memory::SharedMemory>, &mut &mut foundry_evm::inspectors::stack::InspectorStack><unknown>
      at /Users/zerosnacks/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/revm-inspector-8.1.0/src/handler.rs:192
       190 │
       191 │         // Call Inspector step.
       192 >         inspector.step(interpreter, context);
       193 │         if interpreter.bytecode.is_end() {
       194 │             break;
  23: inspect_frame_run<revm_context::evm::Evm<revm_context::context::Context<revm_context::block::BlockEnv, revm_context::tx::TxEnv, revm_context::cfg::CfgEnv<revm_primitives::hardfork::SpecId>, &mut dyn foundry_evm_core::backend::DatabaseExt<Error=foundry_fork_db::error::DatabaseError>, revm_context::journal::Journal<&mut dyn foundry_evm_core::backend::DatabaseExt<Error=foundry_fork_db::error::DatabaseError>, revm_context::journal::entry::JournalEntry>, (), revm_context::local::LocalContext>, &mut foundry_evm::inspectors::stack::InspectorStack, revm_handler::instructions::EthInstructions<revm_interpreter::interpreter::EthInterpreter<(), revm_interpreter::interpreter::shared_memory::SharedMemory>, revm_context::context::Context<revm_context::block::BlockEnv, revm_context::tx::TxEnv, revm_context::cfg::CfgEnv<revm_primitives::hardfork::SpecId>, &mut dyn foundry_evm_core::backend::DatabaseExt<Error=foundry_fork_db::error::DatabaseError>, revm_context::journal::Journal<&mut dyn foundry_evm_core::backend::DatabaseExt<Error=foundry_fork_db::error::DatabaseError>, revm_context::journal::entry::JournalEntry>, (), revm_context::local::LocalContext>>, alloy_evm::precompiles::PrecompilesMap, revm_handler::frame::EthFrame<revm_interpreter::interpreter::EthInterpreter<(), revm_interpreter::interpreter::shared_memory::SharedMemory>>>><unknown>
      at /Users/zerosnacks/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/revm-inspector-8.1.0/src/traits.rs:89
        87 │         let (ctx, inspector, frame, instructions) = self.ctx_inspector_frame_instructions();
        88 │
        89 >         let next_action = inspect_instructions(
        90 │             ctx,
        91 │             frame.interpreter(),
  24: inspect_run_exec_loop<&mut foundry_evm::inspectors::stack::InspectorStack><unknown>
      at /Users/zerosnacks/Projects/work/foundry/crates/evm/core/src/evm.rs:400
       398 │
       399 │         loop {
       400 >             let call_or_result = evm.inspect_frame_run()?;
       401 │
       402 │             let result = match call_or_result {
  25: inspect_execution<foundry_evm_core::evm::FoundryHandler<&mut foundry_evm::inspectors::stack::InspectorStack>><unknown>
      at /Users/zerosnacks/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/revm-inspector-8.1.0/src/handler.rs:74
        72 │
        73 │         // Run execution loop
        74 >         let mut frame_result = self.inspect_run_exec_loop(evm, first_frame_input)?;
        75 │
        76 │         // Handle last frame result
  26: inspect_run_without_catch_error<foundry_evm_core::evm::FoundryHandler<&mut foundry_evm::inspectors::stack::InspectorStack>><unknown>
      at /Users/zerosnacks/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/revm-inspector-8.1.0/src/handler.rs:56
        54 │         let init_and_floor_gas = self.validate(evm)?;
        55 │         let eip7702_refund = self.pre_execution(evm)? as i64;
        56 >         let mut frame_result = self.inspect_execution(evm, &init_and_floor_gas)?;
        57 │         self.post_execution(evm, &mut frame_result, init_and_floor_gas, eip7702_refund)?;
        58 │         self.execution_result(evm, frame_result)
  27: inspect_run<foundry_evm_core::evm::FoundryHandler<&mut foundry_evm::inspectors::stack::InspectorStack>><unknown>
      at /Users/zerosnacks/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/revm-inspector-8.1.0/src/handler.rs:41
        39 │         evm: &mut Self::Evm,
        40 │     ) -> Result<ExecutionResult<Self::HaltReason>, Self::Error> {
        41 >         match self.inspect_run_without_catch_error(evm) {
        42 │             Ok(output) => Ok(output),
        43 │             Err(e) => self.catch_error(evm, e),
  28: transact_raw<&mut foundry_evm::inspectors::stack::InspectorStack><unknown>
      at /Users/zerosnacks/Projects/work/foundry/crates/evm/core/src/evm.rs:232
       230 │
       231 │         let mut handler = FoundryHandler::<I>::default();
       232 >         let result = handler.inspect_run(&mut self.inner)?;
       233 │
       234 │         Ok(ResultAndState::new(result, self.inner.ctx.journaled_state.inner.state.clone()))
  29: transact<foundry_evm_core::evm::FoundryEvm<&mut foundry_evm::inspectors::stack::InspectorStack>, revm_context::tx::TxEnv><unknown>
      at /Users/zerosnacks/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/alloy-evm-0.16.2/src/evm.rs:88
        86 │         tx: impl IntoTxEnv<Self::Tx>,
        87 │     ) -> Result<ResultAndState<Self::HaltReason>, Self::Error> {
        88 >         self.transact_raw(tx.into_tx_env())
        89 │     }
        90 │
  30: inspect<&mut foundry_evm::inspectors::stack::InspectorStack><unknown>
      at /Users/zerosnacks/Projects/work/foundry/crates/evm/core/src/backend/cow.rs:79
        77 │         let mut evm = crate::evm::new_evm_with_inspector(self, env.to_owned(), inspector);
        78 │
        79 >         let res = evm.transact(env.tx.clone()).wrap_err("EVM error")?;
        80 │
        81 │         *env = evm.as_env_mut().to_owned();
  31: call_with_env<unknown>
      at /Users/zerosnacks/Projects/work/foundry/crates/evm/evm/src/executors/mod.rs:494
       492 │         let mut stack = self.inspector().clone();
       493 │         let mut backend = CowBackend::new_borrowed(self.backend());
       494 >         let result = backend.inspect(&mut env, stack.as_inspector())?;
       495 │         convert_executed_result(env, stack, result, backend.has_state_snapshot_failure())
       496 │     }
  32: call_raw<unknown>
      at /Users/zerosnacks/Projects/work/foundry/crates/evm/evm/src/executors/mod.rs:456
       454 │     ) -> eyre::Result<RawCallResult> {
       455 │         let env = self.build_test_env(from, TxKind::Call(to), calldata, value);
       456 >         self.call_with_env(env)
       457 │     }
       458 │
  33: call<unknown>
      at /Users/zerosnacks/Projects/work/foundry/crates/script/src/runner.rs:311
       309 │             )?
       310 │         } else {
       311 >             self.executor.call_raw(from, to, calldata.clone(), value)?
       312 │         };
       313 │         let mut gas_used = res.gas_used;
  34: script<unknown>
      at /Users/zerosnacks/Projects/work/foundry/crates/script/src/runner.rs:232
       230 │     /// Executes the method that will collect all broadcastable transactions.
       231 │     pub fn script(&mut self, address: Address, calldata: Bytes) -> Result<ScriptResult> {
       232 >         self.call(self.evm_opts.sender, address, calldata, U256::ZERO, None, false)
       233 │     }
       234 │
  35: {async_fn#0}<unknown>
      at /Users/zerosnacks/Projects/work/foundry/crates/script/src/execute.rs:152
       150 │
       151 │         if setup_result.success {
       152 >             let script_result = runner.script(address, self.execution_data.calldata.clone())?;
       153 │
       154 │             setup_result.success &= script_result.success;
  36: {async_fn#0}<unknown>
      at /Users/zerosnacks/Projects/work/foundry/crates/script/src/execute.rs:113
       111 │             )
       112 │             .await?;
       113 >         let result = self.execute_with_runner(&mut runner).await?;
       114 │
       115 │         // If we have a new sender from execution, we need to use it to deploy libraries and relink
  37: {async_fn#0}<unknown>
      at /Users/zerosnacks/Projects/work/foundry/crates/script/src/lib.rs:265
       263 │                 .await?
       264 │                 .execute()
       265 >                 .await?
       266 │                 .prepare_simulation()
       267 │                 .await?;
  38: poll<alloc::boxed::Box<forge_script::{impl#0}::run_script::{async_fn_env#0}, alloc::alloc::Global>><unknown>
      at /Users/zerosnacks/.rustup/toolchains/stable-x86_64-apple-darwin/lib/rustlib/src/rust/library/core/src/future/future.rs:124
       122 │
       123 │     fn poll(self: Pin<&mut Self>, cx: &mut Context<'_>) -> Poll<Self::Output> {
       124 >         <P::Target as Future>::poll(self.as_deref_mut(), cx)
       125 │     }
       126 │ }
  39: {closure#0}<core::pin::Pin<alloc::boxed::Box<forge_script::{impl#0}::run_script::{async_fn_env#0}, alloc::alloc::Global>>><unknown>
      at /Users/zerosnacks/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.47.1/src/runtime/park.rs:285
       283 │
       284 │         loop {
       285 >             if let Ready(v) = crate::task::coop::budget(|| f.as_mut().poll(&mut cx)) {
       286 │                 return Ok(v);
       287 │             }
  40: with_budget<core::task::poll::Poll<core::result::Result<(), eyre::Report>>, tokio::runtime::park::{impl#4}::block_on::{closure_env#0}<core::pin::Pin<alloc::boxed::Box<forge_script::{impl#0}::run_script::{async_fn_env#0}, alloc::alloc::Global>>>><unknown>
      at /Users/zerosnacks/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.47.1/src/task/coop/mod.rs:167
       165 │     // The function is called regardless even if the budget is not successfully
       166 │     // set due to the thread-local being destroyed.
       167 >     f()
       168 │ }
       169 │
  41: budget<core::task::poll::Poll<core::result::Result<(), eyre::Report>>, tokio::runtime::park::{impl#4}::block_on::{closure_env#0}<core::pin::Pin<alloc::boxed::Box<forge_script::{impl#0}::run_script::{async_fn_env#0}, alloc::alloc::Global>>>><unknown>
      at /Users/zerosnacks/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.47.1/src/task/coop/mod.rs:133
       131 │ #[inline(always)]
       132 │ pub(crate) fn budget<R>(f: impl FnOnce() -> R) -> R {
       133 >     with_budget(Budget::initial(), f)
       134 │ }
       135 │
  42: block_on<core::pin::Pin<alloc::boxed::Box<forge_script::{impl#0}::run_script::{async_fn_env#0}, alloc::alloc::Global>>><unknown>
      at /Users/zerosnacks/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.47.1/src/runtime/park.rs:285
       283 │
       284 │         loop {
       285 >             if let Ready(v) = crate::task::coop::budget(|| f.as_mut().poll(&mut cx)) {
       286 │                 return Ok(v);
       287 │             }
  43: block_on<core::pin::Pin<alloc::boxed::Box<forge_script::{impl#0}::run_script::{async_fn_env#0}, alloc::alloc::Global>>><unknown>
      at /Users/zerosnacks/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.47.1/src/runtime/context/blocking.rs:66
        64 │
        65 │         let mut park = CachedParkThread::new();
        66 >         park.block_on(f)
        67 │     }
        68 │
  44: {closure#0}<core::pin::Pin<alloc::boxed::Box<forge_script::{impl#0}::run_script::{async_fn_env#0}, alloc::alloc::Global>>><unknown>
      at /Users/zerosnacks/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.47.1/src/runtime/scheduler/multi_thread/mod.rs:87
        85 │     {
        86 │         crate::runtime::context::enter_runtime(handle, true, |blocking| {
        87 >             blocking.block_on(future).expect("failed to park thread")
        88 │         })
        89 │     }
  45: enter_runtime<tokio::runtime::scheduler::multi_thread::{impl#0}::block_on::{closure_env#0}<core::pin::Pin<alloc::boxed::Box<forge_script::{impl#0}::run_script::{async_fn_env#0}, alloc::alloc::Global>>>, core::result::Result<(), eyre::Report>><unknown>
      at /Users/zerosnacks/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.47.1/src/runtime/context/runtime.rs:65
        63 │
        64 │     if let Some(mut guard) = maybe_guard {
        65 >         return f(&mut guard.blocking);
        66 │     }
        67 │
  46: block_on<core::pin::Pin<alloc::boxed::Box<forge_script::{impl#0}::run_script::{async_fn_env#0}, alloc::alloc::Global>>><unknown>
      at /Users/zerosnacks/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.47.1/src/runtime/scheduler/multi_thread/mod.rs:86
        84 │         F: Future,
        85 │     {
        86 >         crate::runtime::context::enter_runtime(handle, true, |blocking| {
        87 │             blocking.block_on(future).expect("failed to park thread")
        88 │         })
  47: block_on_inner<core::pin::Pin<alloc::boxed::Box<forge_script::{impl#0}::run_script::{async_fn_env#0}, alloc::alloc::Global>>><unknown>
      at /Users/zerosnacks/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.47.1/src/runtime/runtime.rs:358
       356 │             Scheduler::CurrentThread(exec) => exec.block_on(&self.handle.inner, future),
       357 │             #[cfg(feature = "rt-multi-thread")]
       358 >             Scheduler::MultiThread(exec) => exec.block_on(&self.handle.inner, future),
       359 │         }
       360 │     }
  48: block_on<forge_script::{impl#0}::run_script::{async_fn_env#0}><unknown>
      at /Users/zerosnacks/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.47.1/src/runtime/runtime.rs:328
       326 │         let fut_size = mem::size_of::<F>();
       327 │         if fut_size > BOX_FUTURE_THRESHOLD {
       328 >             self.block_on_inner(Box::pin(future), SpawnMeta::new_unnamed(fut_size))
       329 │         } else {
       330 │             self.block_on_inner(future, SpawnMeta::new_unnamed(fut_size))
  49: block_on<forge_script::{impl#0}::run_script::{async_fn_env#0}><unknown>
      at /Users/zerosnacks/Projects/work/foundry/crates/cli/src/opts/global.rs:99
        97 │     #[track_caller]
        98 │     pub fn block_on<F: std::future::Future>(&self, future: F) -> F::Output {
        99 >         self.tokio_runtime().block_on(future)
       100 │     }
       101 │ }
  50: run_command<unknown>
      at /Users/zerosnacks/Projects/work/foundry/crates/forge/src/args.rs:66
        64 │             }
        65 │         }
        66 >         ForgeSubcommand::Script(cmd) => global.block_on(cmd.run_script()),
        67 │         ForgeSubcommand::Coverage(cmd) => {
        68 │             if cmd.is_watch() {
  51: run<unknown>
      at /Users/zerosnacks/Projects/work/foundry/crates/forge/src/args.rs:19
        17 │     args.global.init()?;
        18 │
        19 >     run_command(args)
        20 │ }
        21 │
  52: main<unknown>
      at /Users/zerosnacks/Projects/work/foundry/crates/forge/bin/main.rs:10
         8 │
         9 │ fn main() {
        10 >     if let Err(err) = run() {
        11 │         let _ = foundry_common::sh_err!("{err:?}");
        12 │         std::process::exit(1);
  53: call_once<fn(), ()><unknown>
      at /Users/zerosnacks/.rustup/toolchains/stable-x86_64-apple-darwin/lib/rustlib/src/rust/library/core/src/ops/function.rs:250
       248 │     /// Performs the call operation.
       249 │     #[unstable(feature = "fn_traits", issue = "29625")]
       250 >     extern "rust-call" fn call_once(self, args: Args) -> Self::Output;
       251 │ }
       252 │
  54: __rust_begin_short_backtrace<fn(), ()><unknown>
      at /Users/zerosnacks/.rustup/toolchains/stable-x86_64-apple-darwin/lib/rustlib/src/rust/library/std/src/sys/backtrace.rs:152
       150 │     F: FnOnce() -> T,
       151 │ {
       152 >     let result = f();
       153 │
       154 │     // prevent this frame from being tail-call optimised away
  55: {closure#0}<()><unknown>
      at /Users/zerosnacks/.rustup/toolchains/stable-x86_64-apple-darwin/lib/rustlib/src/rust/library/std/src/rt.rs:199
       197 │ ) -> isize {
       198 │     lang_start_internal(
       199 >         &move || crate::sys::backtrace::__rust_begin_short_backtrace(main).report().to_i32(),
       200 │         argc,
       201 │         argv,
  56: core::ops::function::impls::<impl core::ops::function::FnOnce<A> for &F>::call_once::ha55a0ab309b334cf
      at /rustc/6b00bc3880198600130e1cf62b8f8a93494488cc/library/core/src/ops/function.rs:284
  57: std::panicking::try::do_call::h96a651454383b77e
      at /rustc/6b00bc3880198600130e1cf62b8f8a93494488cc/library/std/src/panicking.rs:589
  58: std::panicking::try::hbf3bdd887cce5625
      at /rustc/6b00bc3880198600130e1cf62b8f8a93494488cc/library/std/src/panicking.rs:552
  59: std::panic::catch_unwind::h03d328d69a45f835
      at /rustc/6b00bc3880198600130e1cf62b8f8a93494488cc/library/std/src/panic.rs:359
  60: std::rt::lang_start_internal::{{closure}}::h0a5b56aa78daf5eb
      at /rustc/6b00bc3880198600130e1cf62b8f8a93494488cc/library/std/src/rt.rs:168
  61: std::panicking::try::do_call::h0e893e4e0866d6a8
      at /rustc/6b00bc3880198600130e1cf62b8f8a93494488cc/library/std/src/panicking.rs:589
  62: std::panicking::try::h54599c1dea73fdfe
      at /rustc/6b00bc3880198600130e1cf62b8f8a93494488cc/library/std/src/panicking.rs:552
  63: std::panic::catch_unwind::h24f5c5189a2fae11
      at /rustc/6b00bc3880198600130e1cf62b8f8a93494488cc/library/std/src/panic.rs:359
  64: std::rt::lang_start_internal::ha8dd1a9b824efcda
      at /rustc/6b00bc3880198600130e1cf62b8f8a93494488cc/library/std/src/rt.rs:164
  65: lang_start<()><unknown>
      at /Users/zerosnacks/.rustup/toolchains/stable-x86_64-apple-darwin/lib/rustlib/src/rust/library/std/src/rt.rs:198
       196 │     sigpipe: u8,
       197 │ ) -> isize {
       198 >     lang_start_internal(
       199 │         &move || crate::sys::backtrace::__rust_begin_short_backtrace(main).report().to_i32(),
       200 │         argc,
  66: _main<unknown>
      at <unknown source file>:<unknown line>

Run with COLORBT_SHOW_HIDDEN=1 environment variable to disable frame filtering.
thread caused non-unwinding panic. aborting.
[1]    81729 abort      RUST_BACKTRACE=full ../foundry/target/debug/forge script script/Counter.s.sol

[frontier159]

Using nightly:

forge Version: 1.3.1-nightly
Commit SHA: 409745944204d6e0fa12474238a76618c3899ba7
Build Timestamp: 2025-08-05T06:03:18.759110000Z (1754373798)
Build Profile: maxperf

I've noticed a segfault (no panic) when running forked foundry tests too, not just forge script.

I couldn't create a simple repro, but will wait for this to be closed then re-test. If still an issue I can have another go at a repro (or just give the more complex case)

[grandizzy]

started to manifest with #11100 revm bump should fix

[DaniPopes]

it's due to the order change of inspectors: the revert diagnostic will set the action, which clears the instruction pointer in the currently released revm version, causing the same null pointer dereference we worked around with #11216 downstream in other inspectors.