Skip to content

Some opcodes leave frame->prev_instr in an incorrect state #96049

Description

@tom-pytel

Bug report

Opcodes which have caches (specifically adaptive calls) leave frame->prev_instr pointing to the last byte of the cache instead of the actual last instruction.

Your environment

v3.11.0rc1
Linux tom-VirtualBox 5.15.0-46-generic #49~20.04.1-Ubuntu SMP Thu Aug 4 19:15:44 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux

Activity

  1. added a commit that references this issue on Aug 17, 2022
  2. self-assigned this
    on Aug 17, 2022
  3. brandtbucher commented on Aug 17, 2022

    @brandtbucher
    Member

    This is intentional. See this comment in the code:

    // NOTE: This is not necessarily the last instruction started in the given
    // frame. Rather, it is the code unit *prior to* the *next* instruction. For
    // example, it may be an inline CACHE entry, an instruction we just jumped
    // over, or (in the case of a newly-created frame) a totally invalid value:
    _Py_CODEUNIT *prev_instr;

    For my own understanding, how has this negatively affected you?

    CC @markshannon

  4. tom-pytel commented on Aug 17, 2022

    @tom-pytel
    ContributorAuthor

    For my own understanding, how has this negatively affected you?

    CC @markshannon

    Ok, I missed that quote, just figured since all other opcodes left the pointer at the last instruction these should as well since otherwise the location of the original instruction is unrecoverable (due to random data in cache area).

    This is problematic for us because we have an error reporting fork of the cpython interpreter as a product and after an exception we want to get the instruction which caused it. This particular patch leaves the last instruction pointer always valid but if it is not an issue and not desirable for the base cpython implementation then I will close the PR and just keep the change on our branch.

  5. brandtbucher commented on Aug 17, 2022

    @brandtbucher
    Member

    Ok, I missed that quote, just figured since all other opcodes left the pointer at the last instruction these should as well since otherwise the location of the original instruction is unrecoverable (due to random data in cache area).

    It is recoverable, just with a bit of effort. A call to PyCode_GetCode (or accessing the co_code member in the Python layer) will give you a copy of the bytecode with the caches cleared. It's safe to scan backwards over this to find the last "real" instruction.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

3.11only security fixes3.12only security fixestype-bugAn unexpected behavior, bug, or error

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions