Movatterモバイル変換


[0]ホーム

URL:


Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Sign up
Appearance settings

JIT: Segfault from invalid memory read in_PyTier2Interpreter #143092

Closed
Labels
interpreter-core(Objects, Python, Grammar, and Parser dirs)topic-JITtype-crashA hard crash of the interpreter, possibly with a core dump
@devdanzin

Description

@devdanzin

Crash report

What happened?

It's possible to segfault a JIT build by running the code below:

deff1():a="a"foriinrange(50):x=a[i%len(a)]s=""for_inrange(10):s+=""classA: ...classB: ...matchs:caseint(): ...casestr(): ...casedict(): ...    (u0,*u1,u2,u4,u5,u6,u7,u8,u9,u10,u11,u12,u13,u14,u15,u16,u17,u18,u19,u20,u21,u22,u23,u24,u25,u26,u27,u28,u29,    )= [None,None,None,None,None,None,None,None,None,None,None,None,None,None,None,None,None,None,None,None,None,None,None,None,None,None,None,None,None,None,None,None,None,None,None,None,None,None,None,None,None,None,None,None,None,None,None,None,None,None,None,None,None,]s=""for_inrange(10):s+=""s+=""foriinrange(11000):f1()

Backtrace:

Program received signal SIGSEGV, Segmentation fault._PyTier2Interpreter (current_executor=<optimized out>, frame=<optimized out>, stack_pointer=<optimized out>, tstate=<optimized out>) at Python/executor_cases.c.h:1054910549               if (Py_TYPE(r) != &PyRangeIter_Type) {#0  _PyTier2Interpreter (current_executor=<optimized out>, frame=<optimized out>, stack_pointer=<optimized out>, tstate=<optimized out>) at Python/executor_cases.c.h:10549#1  0x000055555584c1b2 in _PyEval_EvalFrameDefault (tstate=tstate@entry=0x555555d5c9b0 <_PyRuntime+358864>, frame=<optimized out>, frame@entry=0x7ffff7fa7020, throwflag=throwflag@entry=0)    at Python/generated_cases.c.h:5348#2  0x0000555555830e4b in _PyEval_EvalFrame (tstate=0x555555d5c9b0 <_PyRuntime+358864>, frame=0x7ffff7fa7020, throwflag=0) at ./Include/internal/pycore_ceval.h:119#3  _PyEval_Vector (tstate=tstate@entry=0x555555d5c9b0 <_PyRuntime+358864>, func=func@entry=0x7ffff6bf2390, locals=locals@entry=0x7ffff6c00ad0, args=args@entry=0x0,    argcount=argcount@entry=0, kwnames=kwnames@entry=0x0) at Python/ceval.c:2483#4  0x0000555555830bde in PyEval_EvalCode (co=co@entry=0x7ffff6c0c3a0, globals=globals@entry=0x7ffff6c00ad0, locals=locals@entry=0x7ffff6c00ad0) at Python/ceval.c:1008#5  0x000055555599b13a in run_eval_code_obj (tstate=0x555555d5c9b0 <_PyRuntime+358864>, co=co@entry=0x7ffff6c0c3a0, globals=globals@entry=0x7ffff6c00ad0, locals=locals@entry=0x7ffff6c00ad0)    at Python/pythonrun.c:1366#6  0x000055555599ac8b in run_mod (mod=mod@entry=0x555555f17e10, filename=filename@entry=0x7ffff6c4e7a0, globals=globals@entry=0x7ffff6c00ad0, locals=locals@entry=0x7ffff6c00ad0,    flags=0x7fffffffd740, arena=arena@entry=0x7ffff6c711e0, interactive_src=0x0, generate_new_source=0) at Python/pythonrun.c:1469#7  0x00005555559985ad in pyrun_file (fp=fp@entry=0x555555dd0360, filename=filename@entry=0x7ffff6c4e7a0, start=start@entry=257, globals=globals@entry=0x7ffff6c00ad0,    locals=locals@entry=0x7ffff6c00ad0, closeit=closeit@entry=1, flags=0x7fffffffd740) at Python/pythonrun.c:1294

ASan output:

AddressSanitizer:DEADLYSIGNAL===================================================================3999430==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000008 (pc 0x7da56db089a7 bp 0x7ffd350e2e90 sp 0x7ffd350e21a0 T0)==3999430==The signal is caused by a READ memory access.==3999430==Hint: address points to the zero page.    #0 0x7da56db089a7  (<unknown module>)    #1 0x55577b512f97 in _PyEval_EvalFrame /home/danzin/projects/jit_cpython/./Include/internal/pycore_ceval.h:119:16    #2 0x55577b512f97 in _PyEval_Vector /home/danzin/projects/jit_cpython/Python/ceval.c:2483:12    #3 0x55577b5129b4 in PyEval_EvalCode /home/danzin/projects/jit_cpython/Python/ceval.c:1008:21    #4 0x55577bafc2ce in run_eval_code_obj /home/danzin/projects/jit_cpython/Python/pythonrun.c:1366:12    #5 0x55577bafb49b in run_mod /home/danzin/projects/jit_cpython/Python/pythonrun.c:1469:19    #6 0x55577baf5a9c in pyrun_file /home/danzin/projects/jit_cpython/Python/pythonrun.c:1294:15    #7 0x55577baf35fc in _PyRun_SimpleFileObject /home/danzin/projects/jit_cpython/Python/pythonrun.c:518:13    #8 0x55577baf296d in _PyRun_AnyFileObject /home/danzin/projects/jit_cpython/Python/pythonrun.c:81:15    #9 0x55577bb6ea4a in pymain_run_file_obj /home/danzin/projects/jit_cpython/Modules/main.c:410:15    #10 0x55577bb6ea4a in pymain_run_file /home/danzin/projects/jit_cpython/Modules/main.c:429:15    #11 0x55577bb6cb13 in pymain_run_python /home/danzin/projects/jit_cpython/Modules/main.c:691:21    #12 0x55577bb6cb13 in Py_RunMain /home/danzin/projects/jit_cpython/Modules/main.c:772:5    #13 0x55577bb6da16 in pymain_main /home/danzin/projects/jit_cpython/Modules/main.c:802:12    #14 0x55577bb6db87 in Py_BytesMain /home/danzin/projects/jit_cpython/Modules/main.c:826:12    #15 0x7da56e62a574 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16    #16 0x7da56e62a627 in __libc_start_main csu/../csu/libc-start.c:360:3    #17 0x55577aed64f4 in _start (/home/danzin/projects/jit_cpython/python+0x2db4f4) (BuildId: 2bff0bd42ddf0d6a9c5bada7767fdb560f820115)==3999430==Register values:rax = 0x0000000000000000  rbx = 0x0000000000000000  rcx = 0x0000000000000000  rdx = 0x000055577c2ad760rdi = 0x0000000000000000  rsi = 0x00007c356d9e53b8  rbp = 0x00007ffd350e2e90  rsp = 0x00007ffd350e21a0 r8 = 0x00007c356d9e5408   r9 = 0x0000000000000003  r10 = 0x00000aaaef855aac  r11 = 0x00000aaaef855aacr12 = 0x00007c356d9e5298  r13 = 0x00007c356d9e5420  r14 = 0x000055577c509830  r15 = 0x0000000000000001AddressSanitizer can not provide additional info.SUMMARY: AddressSanitizer: SEGV (<unknown module>)==3999430==ABORTING

Output from running withPYTHON_LLTRACE=4 PYTHON_OPT_DEBUG=4:
3004_segfault_lltrace_opt_debug.txt

Found usinglafleur.

CPython versions tested on:

CPython main branch

Operating systems tested on:

Linux

Output from running 'python -VV' on the command line:

Python 3.15.0a3+ (heads/main-dirty:3cc57505e53, Dec 23 2025, 05:19:47) [Clang 21.1.2 (2ubuntu6)]

Linked PRs

Metadata

Metadata

Assignees

No one assigned

    Labels

    interpreter-core(Objects, Python, Grammar, and Parser dirs)topic-JITtype-crashA hard crash of the interpreter, possibly with a core dump

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions


      [8]ページ先頭

      ©2009-2026 Movatter.jp