Description

Fidget-Spinner

opened on Oct 17, 2025

Issue body actions

Bug report

Bug description:

The current JIT doesn't expose this bug as it doesn't project calls through BINARY_OP_SUBSCR_GETITEM. However, the problem is that the uop puts 3 things on the stack:

op(_BINARY_OP_SUBSCR_CHECK_FUNC, (container, unused -- container, unused, getitem)) {

However, BINARY_OP is only expected to have at most 2 items on the stack.

On my branch with recording the BINARY_OP_CHECK_FUNC, this causes a segfault due to stack overflow.

We should really re-add the code that calculates the maximum stack size from constituent uops. This is also blocking work on decref elimination in the JIT.

Example repro on my branch with trace recording:

class Get:
    def __getitem__(self, i):
        return i


g = Get()
def foo():
    for _ in range(4099):
        g[1]

foo()

@mpage (as author of the original PR to sum up uop stack effect) @markshannon

CPython versions tested on:

CPython main branch

Operating systems tested on:

No response

Activity

1. Fidget-Spinner

   added

   type-bugAn unexpected behavior, bug, or errorAn unexpected behavior, bug, or error

   topic-JIT

   on Oct 17, 2025
2. StanFromIreland

   added

   interpreter-core(Objects, Python, Grammar, and Parser dirs)(Objects, Python, Grammar, and Parser dirs)

   on Oct 18, 2025
3. markshannon commented on Oct 19, 2025

   

   markshannon

   on Oct 19, 2025

   Member

   More actions

   We should be rejecting this pattern in the code generator. Even we add some headroom to the stack, the code generator should check that the code is within the headroom.

   As for adding headroom, both for this case and for decref elimination, maybe we should just merge #135465
4. Fidget-Spinner

   added a commit that references this issue on Nov 13, 2025

   gh-139109: A new tracing JIT compiler frontend for CPython (GH-140310)

   4fa80ce
5. StanFromIreland

   added a commit that references this issue on Dec 6, 2025

   pythongh-139109: A new tracing JIT compiler frontend for CPython (pyt…

   6ddc353
6. markshannon commented on Dec 19, 2025

   

   markshannon

   on Dec 19, 2025

   Member

   More actions

   We now have TOS caching, so BINARY_OP_SUBSCR_GETITEM is fine.
7. markshannon

   closed this as completedon Dec 19, 2025

Issue actions