Skip to content

_testinternalcapi: optimize_cfg / compiler_codegen const table mismatches cause crashes #148973

@iritkatriel

Description

@iritkatriel

Crash report

What happened?

Using _testinternalcapi.compiler_codegen together with _testinternalcapi.optimize_cfg exposed several problems: easy-to-hit segfaults when the const list did not match the instruction stream, metadata["consts"] built at the wrong time so it could miss constants added by _PyCodegen_AddReturnAtEnd (notably None for implicit module return), and a missing error path in the CFG optimizer that left an exception set and then crashed instead of raising ValueError.

from _testinternalcapi import compiler_codegen, optimize_cfg
import ast
# (A) Wrong const list for the real bytecode
insts, meta = compiler_codegen(ast.parse("x = (1, 2)", optimize=1), "<s>", 0)
optimize_cfg(insts, [(1, 2)], 0)  # segfault
# (B) If consts were snapshotted before AddReturnAtEnd, meta["consts"] could be wrong;
# with (B) fixed, this documents the failure mode:
insts, meta = compiler_codegen(ast.parse("pass", mode="exec"), "<s>", 0)
optimize_cfg(insts, [], 0)  # segfault without proper NULL handling after get_const_value

CPython versions tested on:

3.15

Operating systems tested on:

macOS

Output from running 'python -VV' on the command line:

No response

Linked PRs

Metadata

Metadata

Assignees

Labels

interpreter-core(Objects, Python, Grammar, and Parser dirs)type-crashA hard crash of the interpreter, possibly with a core dump

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions