Skip to content

Type propagation does not account for the setting local variables via frame.f_locals in a debugger or similar. #115709

Closed

Description

@markshannon

Bug report

Bug description:

Consider

def testfunc(loops):
    for _ in range(loops):
        a = 1
        a + a
        a + a
        change_a()
        a + a

and suppose that change_a manages to change the value of the local a to "a".
Specialization will have converted the subsequent a + a to integer addition, and type propagation will have stripped the guard, resulting in a crash.

This is incredibly unlikely, and very hard to come up with a test for but it is theoretically possible.
It may be become more likely (and easier to test for) if PEP 667 is accepted.

Linked PRs

Activity

  1. markshannon commented on Feb 20, 2024

    @markshannon
    MemberAuthor

    The fix is relatively straightforward:
    Invalidate all executors depending on a code object should any locals associated with that code object get changed via frame.f_locals

  2. encukou commented on Feb 27, 2024

    @encukou
    Member

    Is this on track for 3.13.0a5 (on 2024-03-12), or should I look into it?

  3. markshannon commented on Feb 27, 2024

    @markshannon
    MemberAuthor

    It's on track for the release, but probably not for 3.13.0a5.

    The fix will be easier with PEP 667, so I'm waiting to see if that is accepted first.
    Identifying if a local variable has changed is currently awkward with PyFrame_LocalsToFast and PyFrame_FastToLocals, but with PEP 667 it is almost trivial.

  4. Yhg1s commented on May 5, 2024

    @Yhg1s
    Member

    Since PEP 667 was accepted, is this on track to be finished before beta 1 (next Tuesday)?

  5. added a commit that references this issue on May 6, 2024
  6. gvanrossum commented on May 7, 2024

    @gvanrossum
    Member

    I believe this is fixed now by gh-118639 and definitely no longer blocking the release. Waiting for @markshannon to close it.

  7. added a commit that references this issue on May 8, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    3.13only security fixesinterpreter-core(Objects, Python, Grammar, and Parser dirs)release-blockertype-bugAn unexpected behavior, bug, or error

    Projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions