JIT error stubs don't account for peeks #126222
Labels
3.13
bugs and security fixes
3.14
new features, bugs and security fixes
interpreter-core
(Objects, Python, Grammar, and Parser dirs)
topic-JIT
type-crash
A hard crash of the interpreter, possibly with a core dump
Crash report
When deciding how many stack items to pop in an
_ERROR_POP_N
stub, we use_PyUop_num_popped
. However, for opcodes with "peeked" items that never get popped, this is incorrect.For example, consider
SET_ADD(2)
. It has three inputs and two outputs. However, both of the bottom inputs are the same as the outputs, and are never really popped. When compiling an error stub for the JIT, using_PyUop_num_popped
will create_ERROR_POP_N(3)
, which leaks both references and shrinks the stack too far:The compiled trace for the comprehension is:
@markshannon, does this make sense to generate new tables for in the cases generator? Not sure what the best option is.
The text was updated successfully, but these errors were encountered: