Movatterモバイル変換


[0]ホーム

URL:


Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Sign up
Appearance settings

JIT global-to-constant promotion doesn't properly validate the globals dictionary at runtime #136154

Open
Labels
3.13bugs and security fixes3.14bugs and security fixes3.15new features, bugs and security fixesinterpreter-core(Objects, Python, Grammar, and Parser dirs)topic-JITtype-bugAn unexpected behavior, bug, or error
@brandtbucher

Description

@brandtbucher

Bug report

This code raises aNameError with the JIT disabled, and succeeds with the JIT enabled:

importtypesGLOBAL=42defmake_f():deff():returnGLOBALreturnfmake_f_with_bad_globals=types.FunctionType(make_f.__code__, {})defjitted(funcs):forfuncinfuncs:func()defmain():# Make a "good" f:f=make_f()# Compile jitted for the "good" f:jitted([f]*4096)# This "bad" f has different globals, but the *same* code/function versions:f_with_bad_globals=make_f_with_bad_globals()# A "good" f to enter the JIT code, and a "bad" f to trigger the bug:jitted([f,f_with_bad_globals])main()

We're relying on the function version to guarantee the correct globals. Functions that are created from the same code object share the same function version, butdon't necessarily share the same globals.

The fix is probably to insert runtime checks for the identity of the globals dictionary (instead of the function version) inremove_globals. An identity check is safe, since if the original globals dict is deallocated then the trace will be invalidated anyways.

Metadata

Metadata

Assignees

No one assigned

    Labels

    3.13bugs and security fixes3.14bugs and security fixes3.15new features, bugs and security fixesinterpreter-core(Objects, Python, Grammar, and Parser dirs)topic-JITtype-bugAn unexpected behavior, bug, or error

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions


      [8]ページ先頭

      ©2009-2025 Movatter.jp