Skip to content

Multi-line arguments in a function call crashes CPython #101928

Description

@xiaxinmeng

Crash report

In a function call, if one argument is split in two lines, CPython crashes. For example, we split the lambda expression, i.e., lamda_exp=lambda:1, in test2.py into two lines (See test1.py) . CPython reports a segmentation fault.

This crash just occurs on the latest main branch(e.g.commit a1f08f5, 8a2b7ee ). The older version of CPython(e.g. CPython 3.10.8, CPython 3.9.0 ) does not report any crash.

test1.py (Segmentation fault)

def foo(param, lambda_exp):
    pass

foo(param=0,
    lambda_exp=lambda:
    1)

test2.py (work well )

def foo(param, lambda_exp):
    pass

foo(param=0,
    lambda_exp=lambda:1)

Error messages

Segmentation Fault

Your environment

  • CPython versions tested on: main branch from GitHub (commit a1f08f5)
  • Operating system and architecture: Ubuntu 18.04

Linked PRs

Activity

  1. added
    type-crashA hard crash of the interpreter, possibly with a core dump
    on Feb 15, 2023
  2. changed the title [-]Multi-line arguments in function call crashes CPython[/-] [+]Multi-line arguments in a function call crashes CPython[/+] on Feb 15, 2023
  3. hauntsaninja commented on Feb 15, 2023

    @hauntsaninja
    Contributor

    Thanks for the report! I bisected this to #101633 cc @penguin-wwy @iritkatriel

  4. iritkatriel commented on Feb 15, 2023

    @iritkatriel
    Member

    Thank you @hauntsaninja.

    I see the problem - we are now creating a basicblock with

    RETURN_CONST followed by NOP, and the redundant NOP is not being removed before propagate_line_numbers() uses BB_HAS_FALLTHROUGH on the block, which only looks at the last instruction to see if it exits the block.

    Possible fixes:

    1. (easiest) replace LOAD_CONST, RETURN_VALUE by NOP, RETURN_CONST (instead of RETURN_CONST, NOP).
    2. make sure the redundant NOP is removed before propagate_line_numbers is called

    I'll fix it tomorrow if nobody else will beat me to it.

  5. penguin-wwy commented on Feb 15, 2023

    @penguin-wwy
    Contributor

    Thank you @hauntsaninja.

    I see the problem - we are now creating a basicblock with

    RETURN_CONST followed by NOP, and the redundant NOP is not being removed before propagate_line_numbers() uses BB_HAS_FALLTHROUGH on the block, which only looks at the last instruction to see if it exits the block.

    Possible fixes:

    1. (easiest) replace LOAD_CONST, RETURN_VALUE by NOP, RETURN_CONST (instead of RETURN_CONST, NOP).
    
    2. make sure the redundant NOP is removed before propagate_line_numbers is called
    

    I'll fix it tomorrow if nobody else will beat me to it.

    @iritkatriel Thanks for the fix suggestion, I tried to fix it using the first method and it seems to have minimal impact and is effective.

  6. added a commit that references this issue on Feb 16, 2023
  7. iritkatriel commented on Feb 16, 2023

    @iritkatriel
    Member

    Thanks for the report @xiaxinmeng, and for the fix @penguin-wwy .

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    3.12only security fixesinterpreter-core(Objects, Python, Grammar, and Parser dirs)release-blockertype-crashA hard crash of the interpreter, possibly with a core dump

    Projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions