Movatterモバイル変換


[0]ホーム

URL:


Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Sign up
Appearance settings

JIT error stubs don't account for peeks #126222

Closed
Assignees
markshannon
Labels
3.13bugs and security fixes3.14bugs and security fixesinterpreter-core(Objects, Python, Grammar, and Parser dirs)topic-JITtype-crashA hard crash of the interpreter, possibly with a core dump
@brandtbucher

Description

@brandtbucher

Crash report

When deciding how many stack items to pop in an_ERROR_POP_N stub, we use_PyUop_num_popped. However, for opcodes with "peeked" items that never get popped, this is incorrect.

For example, considerSET_ADD(2). It has three inputs and two outputs. However, both of the bottom inputs are the same as the outputs, and are never really popped. When compiling an error stub for the JIT, using_PyUop_num_popped will create_ERROR_POP_N(3), which leaks both references and shrinks the stack too far:

# 17 Nones to warm up, then a list to raise TypeError:items=17* [None]+ [[]]{itemforiteminitems}# Assertion failed: (STACK_LEVEL() >= level), function _PyEval_EvalFrameDefault, file ceval.c, line 966.

The compiled trace for the comprehension is:

   0 OPTIMIZED: _START_EXECUTOR (0, target=20, operand=0x101644de0)   1 OPTIMIZED: _MAKE_WARM (0, target=0, operand=0)   2 OPTIMIZED: _SET_IP (0, target=20, operand=0x1017b85f8)   3 OPTIMIZED: _CHECK_PERIODIC (0, jump_target=0, operand=0, error_target=13)   4 OPTIMIZED: _CHECK_VALIDITY (0, jump_target=14, operand=0x1017b85f0)   5 OPTIMIZED: _ITER_CHECK_LIST (4, jump_target=15, operand=0)   6 OPTIMIZED: _GUARD_NOT_EXHAUSTED_LIST (4, jump_target=16, operand=0)   7 OPTIMIZED: _ITER_NEXT_LIST (4, target=16, operand=0)   8 OPTIMIZED: _STORE_FAST_0 (0, target=18, operand=0)   9 OPTIMIZED: _LOAD_FAST_0 (0, target=18, operand=0)  10 OPTIMIZED: _SET_IP (0, target=19, operand=0x1017b85f6)  11 OPTIMIZED: _SET_ADD (2, jump_target=0, operand=0, error_target=17)  12 OPTIMIZED: _JUMP_TO_TOP (0, jump_target=1, operand=0)  13 OPTIMIZED: _ERROR_POP_N (0, target=0, operand=0x14)  14 OPTIMIZED: _DEOPT (0, target=16, operand=0)  15 OPTIMIZED: _EXIT_TRACE (0, target=16, operand=0x101644e60)  16 OPTIMIZED: _EXIT_TRACE (0, target=23, operand=0x101644e70)  17 OPTIMIZED: _ERROR_POP_N (3, target=0, operand=0x13)

@markshannon, does this make sense to generate new tables for in the cases generator? Not sure what the best option is.

Linked PRs

Metadata

Metadata

Assignees

Labels

3.13bugs and security fixes3.14bugs and security fixesinterpreter-core(Objects, Python, Grammar, and Parser dirs)topic-JITtype-crashA hard crash of the interpreter, possibly with a core dump

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions


    [8]ページ先頭

    ©2009-2025 Movatter.jp