Skip to content

3.12: segmentation fault from compile() builtin #99708

Closed

Description

@davidhewitt

Crash report

I can trigger a crash of the 3.12 interpreter using the following Python instruction:

compile("assert (False if 1 else True)", "<string>", "exec")

Error messages

The full output when running locally-built cpython with debug assertions avoids a segfault, triggering an assertion instead:

$ ./python
Python 3.12.0a2+ (heads/main:f1a4a6a587, Nov 22 2022, 22:12:33) [GCC 9.4.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> compile("assert (False if 1 else True)", "<string>", "exec")
python: Python/compile.c:8703: remove_redundant_jumps: Assertion `no_empty_basic_blocks(g)' failed.
Aborted

Your environment

I originally encountered the segmentation fault on macOS with 3.12.0a1.

I have reproduced it above with f1a4a6a on ubuntu (inside WSL).

Linked PRs

Activity

  1. added
    type-crashA hard crash of the interpreter, possibly with a core dump
    on Nov 22, 2022
  2. corona10 commented on Nov 23, 2022

    @corona10
    Member
  3. self-assigned this
    on Nov 23, 2022
  4. iritkatriel commented on Nov 23, 2022

    @iritkatriel
    Member

    Thanks for the report. This is not only with exceptions, seems to be empty exit block with a const-False if condition:

    % ./python.exe -c "compile('def f():\n\tif not (False if 1 else True): return 12', 'file', 'exec')"
    Assertion failed: (no_empty_basic_blocks(g)), function remove_redundant_jumps, file compile.c, line 8691.
    zsh: abort      ./python.exe -c 
    % ./python.exe -c "compile('def f():\n\tif not (False if 1 else True): xyz = 123', 'file', 'exec')"
    % ./python.exe -c "compile('def f():\n\tif not (False if 1 else True):\n\t\txyz = 123\n\t\treturn 42', 'file', 'exec')"
    % 
    
  5. iritkatriel commented on Nov 23, 2022

    @iritkatriel
    Member

    A newline seems to make a difference:

    % ./python.exe -c "compile('def f():\n\tif not (False if 1 else True): return 12', 'file', 'exec')"
    Assertion failed: (no_empty_basic_blocks(g)), function remove_redundant_jumps, file compile.c, line 8691.
    zsh: abort      ./python.exe -c 
    % ./python.exe -c "compile('def f():\n\tif not (False if 1 else True):\n\t return 12', 'file', 'exec')"
    %
    
  6. iritkatriel commented on Nov 23, 2022

    @iritkatriel
    Member

    A newline seems to make a difference

    That's because we add a NOP for the line of the dead code, so the block is not empty.

  7. added 3 commits that reference this issue on Nov 23, 2022
  8. added a commit that references this issue on Nov 24, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

3.12only security fixesinterpreter-core(Objects, Python, Grammar, and Parser dirs)type-crashA hard crash of the interpreter, possibly with a core dump

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions