GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — Parser stack overflow: deeply-nested source causes SIGSEGV instead of SyntaxError · Issue #7655 · RustPython/RustPython

Parser stack overflow: deeply-nested source causes SIGSEGV instead of SyntaxError #7655

New issue
Copy link
New issue
Copy link
Closed
#8827
Closed
Parser stack overflow: deeply-nested source causes SIGSEGV instead of SyntaxError#7655
#8827
Copy link
Assignees
sigmaith

Description

@changjoon-park
changjoon-park
opened on Apr 22, 2026
Issue body actions

Summary

Parsing deeply-nested Python source (brackets, parens, etc.) crashes the interpreter with SIGSEGV at ~4000 levels of nesting. CPython caps this at 200 via SyntaxError: too many nested parentheses from the parser's internal depth limit.

The crash is in the parser itself (rustpython-ruff_python_parser 0.15.8): compile(src, '<s>', 'exec') (parser + codegen, does NOT go through _ast::ast_to_object) and ast.parse() crash at the identical depth threshold, showing the shared component is the parser, not post-parse conversion.

This is the parser-layer root cause of the class of bugs tracked in #2796. #4857 also still reproduces on current main (closed as fixed in 2023).

Expected

Matches CPython 3.13.4 behavior:

$ python3 -c "import ast; ast.parse('[' * 5000 + '1' + ']' * 5000)"
Traceback (most recent call last):
  ...
SyntaxError: too many nested parentheses (<unknown>, line 1)

(CPython's parser rejects at depth 201 via a hard-coded limit, well before the native stack is exhausted.)

Actual

$ rustpython -c "import ast; ast.parse('[' * 5000 + '1' + ']' * 5000)"
[no output, exit 139 — SIGSEGV]

$ rustpython -c "src='['*5000+'1'+']'*5000; compile(src,'<s>','exec')"
[no output, exit 139 — SIGSEGV]

# #4857's original reproducer also still crashes:
$ rustpython -c "import ast; ast.parse('+chr(33)' * 1000000)"
[no output, exit 139]

Threshold

Depth compile() ast.parse()
3000 ok ok
4000 SIGSEGV SIGSEGV
15000 SIGSEGV SIGSEGV

Identical thresholds confirm the crash is in the parser, not in post-parse conversion.

Relation to prior fixes

  • Fix segfault on cyclic or deeply-nested AST in compile() #7630 guarded _ast::ast_from_object (AST object → Rust IR conversion).
  • Fix stack overflow on deeply-nested JSON in json.loads() #7632 guarded json.loads() via vm.with_recursion.

Both fixes live downstream of the parser. The parser's own recursive descent has no depth guard, so any Python source deeply nested in brackets, parens, unary ops, or binary ops reaches the native stack limit first.

Environment

  • RustPython main @ 5a45d41d (parser: rustpython-ruff_python_parser 0.15.8)
  • Compared against: CPython 3.13.4
  • macOS 15.1 / Darwin 24.1.0
  • Rust release build

Activity

  1. sigmaith commented on Aug 17, 2026

    @sigmaith
    sigmaith
    on Aug 17, 2026
    Contributor
    More actions

    take

  2. github-actions
    assigned
    sigmaith
    on Aug 17, 2026
  3. youknowone
    closed this as completedin c9c78dbon Sep 30, 2026
  4. kangdora
    added a commit that references this issue on Oct 1, 2026

    Bound AST nesting so deep source raises instead of crashing (RustPyth…

    This issue will close once commit c9c78db is merged into the 'main' branch.
    c9c78db
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

  • @sigmaith
    sigmaith

Labels

No labels
No labels

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions

    You are visitor 01402503 — GeezerVison does not store the pages you look up.
    Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.