Skip to content

Segfault when using store-context AST node in a load context #69016

Closed
Closed
Segfault when using store-context AST node in a load context#69016
Labels
stdlibStandard Library Python modules in the Lib/ directorytype-crashA hard crash of the interpreter, possibly with a core dump

Description

@masklinn
masklinn
mannequin
opened on Aug 8, 2015
BPO 24828
Nosy @benjaminp, @masklinn, @tirkarthi

Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.

Show more details

GitHub fields:

assignee = None
closed_at = <Date 2020-10-16.12:32:50.900>
created_at = <Date 2015-08-08.14:03:34.212>
labels = ['library', 'type-crash']
title = 'Segfault when using store-context AST node in a load context'
updated_at = <Date 2020-10-16.12:32:50.899>
user = 'https://github.com/masklinn'

bugs.python.org fields:

activity = <Date 2020-10-16.12:32:50.899>
actor = 'serhiy.storchaka'
assignee = 'none'
closed = True
closed_date = <Date 2020-10-16.12:32:50.900>
closer = 'serhiy.storchaka'
components = ['Library (Lib)']
creation = <Date 2015-08-08.14:03:34.212>
creator = 'xmorel'
dependencies = []
files = []
hgrepos = []
issue_num = 24828
keywords = []
message_count = 4.0
messages = ['248269', '325987', '326079', '378704']
nosy_count = 3.0
nosy_names = ['benjamin.peterson', 'xmorel', 'xtreak']
pr_nums = []
priority = 'normal'
resolution = 'out of date'
stage = 'resolved'
status = 'closed'
superseder = None
type = 'crash'
url = 'https://bugs.python.org/issue24828'
versions = ['Python 2.7']

Activity

  1. masklinn commented on Aug 8, 2015

    @masklinn
    masklinnmannequin
    on Aug 8, 2015
    MannequinAuthor

    It looks to be fixed in 3.3 and up, but in Python 2.7

        import ast
    m = ast.Module(body=[
        ast.Expr(value=ast.Name(id='foo', ctx=ast.Store()))
    ])
    ast.fix_missing_locations(m)
    code = compile(m, '', mode='exec')
    eval(code)
 
will segfault on eval. So will a similarly incorrect ast.Attribute node.

    Version tested:

    Python 2.7.10 (default, May 28 2015, 12:02:55)
    [GCC 4.2.1 Compatible Apple LLVM 6.0 (clang-600.0.57)] on darwin

  2. masklinn
    added
    stdlibStandard Library Python modules in the Lib/ directory
    type-crashA hard crash of the interpreter, possibly with a core dump
    on Aug 8, 2015

  3. tirkarthi commented on Sep 21, 2018

    @tirkarthi
    tirkarthi
    on Sep 21, 2018
    Member

    Thanks for the script. The crash is still reproducible as of now with at least python 2.7.14 . I need to check on the latest 2.7 branch yet.

    On python 3 it produces an error as below :

    Traceback (most recent call last):
  File "../backups/bpo24828.py", line 6, in <module>
    code = compile(m, '', mode='exec')
ValueError: expression must have Load context but has Store instead

    Crash report on Mac OS

    MacOS/Python
    Identifier: Python
    Version: 2.7.14 (2.7.14)
    Code Type: X86-64 (Native)
    Parent Process: zsh [13087]
    Responsible: iTerm2 [230]
    User ID: 501

    Date/Time: 2018-09-21 18:13:27.072 +0530
    OS Version: Mac OS X 10.10.4 (14E46)
    Report Version: 11
    Anonymous UUID: BCB9DD4C-B310-CA87-7308-42F6715FDA83

    Sleep/Wake UUID: FA788657-D625-40D6-8701-16E042836F5F

    Time Awake Since Boot: 24000 seconds
    Time Since Wake: 14000 seconds

    Crashed Thread: 0 Dispatch queue: com.apple.main-thread

    Exception Type: EXC_BAD_ACCESS (SIGSEGV)
    Exception Codes: KERN_INVALID_ADDRESS at 0x0000000000000000

    VM Regions Near 0:
    -->
    __TEXT 00000001075be000-00000001075c0000 [ 8K] r-x/rwx SM=COW /usr/local/Cellar/python@2/2.7.14_3/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python

    Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
    0 org.python.python 0x00000001075fc8bb dict_set_item_by_hash_or_entry + 14
    1 org.python.python 0x000000010764fa63 PyEval_EvalFrameEx + 14664
    2 org.python.python 0x000000010764bf29 PyEval_EvalCodeEx + 1583
    3 org.python.python 0x000000010764b8f4 PyEval_EvalCode + 54
    4 org.python.python 0x0000000107647fdc builtin_eval + 570
    5 org.python.python 0x00000001076527c8 PyEval_EvalFrameEx + 26285
    6 org.python.python 0x000000010764bf29 PyEval_EvalCodeEx + 1583
    7 org.python.python 0x000000010764b8f4 PyEval_EvalCode + 54
    8 org.python.python 0x000000010766f05d run_mod + 53
    9 org.python.python 0x000000010766f100 PyRun_FileExFlags + 133
    10 org.python.python 0x000000010766ec4f PyRun_SimpleFileExFlags + 698
    11 org.python.python 0x00000001076805f9 Py_Main + 3137
    12 libdyld.dylib 0x00007fff9354a5c9 start + 1

    Thread 0 crashed with X86 Thread State (64-bit):
    rax: 0xc6079cb3d3de86bb rbx: 0x00000001077d3168 rcx: 0x0000000000000000 rdx: 0xc6079cb3d3de86bb
    rdi: 0x00000001077d3168 rsi: 0x00000001078f4a08 rbp: 0x00007fff586410d0 rsp: 0x00007fff586410c0
    r8: 0x0000000000000000 r9: 0x0000000000000000 r10: 0x0000000000000001 r11: 0x000000000024e797
    r12: 0x0000000107871a00 r13: 0x0000000107871b70 r14: 0x0000000000000008 r15: 0x00000001078f4a08
    rip: 0x00000001075fc8bb rfl: 0x0000000000010206 cr2: 0x0000000000000000

    Thanks

  4. tirkarthi commented on Sep 22, 2018

    @tirkarthi
    tirkarthi
    on Sep 22, 2018
    Member

    Reproducible on latest 2.7 branch as well. Stack trace as below :

    Program received signal SIGSEGV, Segmentation fault.
    dict_set_item_by_hash_or_entry (
    op={'code': <code at remote 0x10059cc30>, 'ast': <module at remote 0x1005ab868>, '__builtins__': <module at remote 0x10023db08>, '__file__': '../backups/bpo24828.py', 'm': <Module(body=[<Expr(lineno=1, value=<Name(ctx=<Store at remote 0x1005a5f10>, id='foo', col_offset=0, lineno=1) at remote 0x1005c2790>, col_offset=0) at remote 0x1005c27d0>]) at remote 0x1005c2810>, '__package__': None, '__name__': '__main__', '__doc__': None}, key=<optimized out>, hash=<optimized out>,
    value=<optimized out>, ep=<optimized out>) at Objects/dictobject.c:792
    792 Py_INCREF(value);
    (gdb) bt
    #0 dict_set_item_by_hash_or_entry (op={'code': <code at remote 0x10059cc30>, 'ast': <module at remote 0x1005ab868>, '__builtins__': <module at remote 0x10023db08>, '__file__': '../backups/bpo24828.py', 'm': <Module(body=[<Expr(lineno=1, value=<Name(ctx=<Store at remote 0x1005a5f10>, id='foo', col_offset=0, lineno=1) at remote 0x1005c2790>, col_offset=0) at remote 0x1005c27d0>]) at remote 0x1005c2810>, '__package__': None, '__name__': '__main__', '__doc__': None}, key=<optimized out>, hash=<optimized out>, value=<optimized out>, ep=<optimized out>) at Objects/dictobject.c:792
    #1 PyDict_SetItem (op={'code': <code at remote 0x10059cc30>, 'ast': <module at remote 0x1005ab868>, '__builtins__': <module at remote 0x10023db08>, '__file__': '../backups/bpo24828.py', 'm': <Module(body=[<Expr(lineno=1, value=<Name(ctx=<Store at remote 0x1005a5f10>, id='foo', col_offset=0, lineno=1) at remote 0x1005c2790>, col_offset=0) at remote 0x1005c27d0>]) at remote 0x1005c2810>, '__package__': None, '__name__': '__main__', '__doc__': None}, key='foo', value=0x0) at Objects/dictobject.c:848
    #2 0x00000001000ab62e in PyEval_EvalFrameEx (f=<unknown at remote 0x8>, throwflag=<optimized out>) at Python/ceval.c:2186
    #3 0x00000001000a735a in PyEval_EvalCodeEx (co=<optimized out>, globals=<optimized out>, locals=<optimized out>, args=0x0, argcount=<optimized out>, kws=<optimized out>, kwcount=<optimized out>, defs=0x0, defcount=<optimized out>, closure=<optimized out>) at Python/ceval.c:3604
    #4 0x00000001000a6cb6 in PyEval_EvalCode (co=0x100293168, globals='foo', locals=0x0) at Python/ceval.c:669
    #5 0x00000001000a302a in builtin_eval (self={'code': <code at remote 0x10059cc30>, 'ast': <module at remote 0x1005ab868>, '__builtins__': <module at remote 0x10023db08>, '__file__': '../backups/bpo24828.py', 'm': <Module(body=[<Expr(lineno=1, value=<Name(ctx=<Store at remote 0x1005a5f10>, id='foo', col_offset=0, lineno=1) at remote 0x1005c2790>, col_offset=0) at remote 0x1005c27d0>]) at remote 0x1005c2810>, '__package__': None, '__name__': '__main__', '__doc__': None}, args=<optimized out>) at Python/bltinmodule.c:679
    #6 0x00000001000ae8a7 in call_function (oparg=<optimized out>, pp_stack=<optimized out>) at Python/ceval.c:4372
    #7 PyEval_EvalFrameEx (f=Frame 0x1002d4bc0, for file ../backups/bpo24828.py, line 7, in <module> (), throwflag=<optimized out>) at Python/ceval.c:3009
    #8 0x00000001000a735a in PyEval_EvalCodeEx (co=<optimized out>, globals=<optimized out>, locals=<optimized out>, args=0x0, argcount=<optimized out>, kws=<optimized out>, kwcount=<optimized out>, defs=0x0, defcount=<optimized out>, closure=<optimized out>) at Python/ceval.c:3604
    #9 0x00000001000a6cb6 in PyEval_EvalCode (co=0x100293168, globals='foo', locals=0x0) at Python/ceval.c:669
    #10 0x00000001000d4de4 in run_mod (mod=<optimized out>, filename=<optimized out>, globals={'code': <code at remote 0x10059cc30>, 'ast': <module at remote 0x1005ab868>, '__builtins__': <module at remote 0x10023db08>, '__file__': '../backups/bpo24828.py', 'm': <Module(body=[<Expr(lineno=1, value=<Name(ctx=<Store at remote 0x1005a5f10>, id='foo', col_offset=0, lineno=1) at remote 0x1005c2790>, col_offset=0) at remote 0x1005c27d0>]) at remote 0x1005c2810>, '__package__': None, '__name__': '__main__', '__doc__': None}, locals={'code': <code at remote 0x10059cc30>, 'ast': <module at remote 0x1005ab868>, '__builtins__': <module at remote 0x10023db08>, '__file__': '../backups/bpo24828.py', 'm': <Module(body=[<Expr(lineno=1, value=<Name(ctx=<Store at remote 0x1005a5f10>, id='foo', col_offset=0, lineno=1) at remote 0x1005c2790>, col_offset=0) at remote 0x1005c27d0>]) at remote 0x1005c2810>, '__package__': None, '__name__': '__main__', '__doc__': None}, flags=<optimized out>, arena=<optimized out>) at Python/pythonrun.c:1385
    #11 PyRun_FileExFlags (fp=<optimized out>, filename=<optimized out>, start=<optimized out>, globals={'code': <code at remote 0x10059cc30>, 'ast': <module at remote 0x1005ab868>, '__builtins__': <module at remote 0x10023db08>, '__file__': '../backups/bpo24828.py', 'm': <Module(body=[<Expr(lineno=1, value=<Name(ctx=<Store at remote 0x1005a5f10>, id='foo', col_offset=0, lineno=1) at remote 0x1005c2790>, col_offset=0) at remote 0x1005c27d0>]) at remote 0x1005c2810>, '__package__': None, '__name__': '__main__', '__doc__': None}, locals={'code': <code at remote 0x10059cc30>, 'ast': <module at remote 0x1005ab868>, '__builtins__': <module at remote 0x10023db08>, '__file__': '../backups/bpo24828.py', 'm': <Module(body=[<Expr(lineno=1, value=<Name(ctx=<Store at remote 0x1005a5f10>, id='foo', col_offset=0, lineno=1) at remote 0x1005c2790>, col_offset=0) at remote 0x1005c27d0>]) at remote 0x1005c2810>, '__package__': None, '__name__': '__main__', '__doc__': None}, closeit=1, flags=<optimized out>) at Python/pythonrun.c:1371
    #12 0x00000001000d491a in PyRun_SimpleFileExFlags (fp=0x7fff71bec070, filename=0xc6079cb3d3de86bb <error: Cannot access memory at address 0xc6079cb3d3de86bb>, closeit=8, flags=0x7fff5fbffa70) at Python/pythonrun.c:957
    #13 0x00000001000ea8f2 in Py_Main (argc=<optimized out>, argv=<optimized out>) at Modules/main.c:645
    #14 0x00007fff8b5055c9 in start () from /usr/lib/system/libdyld.dylib
    #15 0x00007fff8b5055c9 in start () from /usr/lib/system/libdyld.dylib
    #16 0x0000000000000000 in ?? ()

    Adding Benjamin since he is the 2.7 release manager and it's something specific to 2.7.

    Thanks

  5. masklinn commented on Oct 16, 2020

    @masklinn
    masklinnmannequin
    on Oct 16, 2020
    MannequinAuthor

    Should I close this since I believe 2.7 is not supported anymore?

  6. serhiy-storchaka
    closed this as completedon Oct 16, 2020
  7. ezio-melotti
    transferred this issue fromon Apr 10, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    stdlibStandard Library Python modules in the Lib/ directorytype-crashA hard crash of the interpreter, possibly with a core dump

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions