GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — segfault/debug abort from `perf_map_write_entry` with lone surrogate in filename or qualname · Issue #156114 · python/cpython

segfault/debug abort from perf_map_write_entry with lone surrogate in filename or qualname #156114

New issue
Copy link
New issue
Copy link
Closed
Closed
segfault/debug abort from perf_map_write_entry with lone surrogate in filename or qualname#156114
Copy link
Labels
interpreter-core(Objects, Python, Grammar, and Parser dirs)(Objects, Python, Grammar, and Parser dirs)type-crashA hard crash of the interpreter, possibly with a core dumpA hard crash of the interpreter, possibly with a core dump

Description

@stestagg
stestagg
opened on Aug 20, 2026
Issue body actions

Crash report

What happened?

import sys
import sysconfig
import types

assert not sysconfig.get_config_var("PY_HAVE_PERF_TRAMPOLINE")
sys.activate_stack_trampoline("perf")
code = compile("pass", "bad\ud800file", "exec")
eval(code)
python3: Python/generated_cases.c.h:13862: PyObject *_PyEval_EvalFrameDefault(PyThreadState *, _PyInterpreterFrame *, int): Assertion `!_PyErr_Occurred(tstate)' failed.
Aborted

perf_map_write_entry does not check that the calls to PyUnicde_AsUTF8 succeed, resulting in null pointers being passed to snprintf. This is UB, and may crash in some libc versions, or may be replaced with a placeholder value.

Regardless, a failed conversion leaves a stale exception around, which then will trigger a debug abort a bit later (in debug builds):

cpython/Python/perf_trampoline.c

Lines 251 to 262 in e8158d1

perf_map_write_entry(void *state, const void *code_addr,
size_t code_size, PyCodeObject *co)
{
const char *entry = "";
if (co->co_qualname != NULL) {
entry = PyUnicode_AsUTF8(co->co_qualname);
}
const char *filename = "";
if (co->co_filename != NULL) {
filename = PyUnicode_AsUTF8(co->co_filename);
}
size_t perf_map_entry_size = snprintf(NULL, 0, "py::%s:%s", entry, filename) + 1;

Seems trivial to check the result value here. I notice that perf_jit_trampoline (similar code) uses a common helper function that checks the values and replaces them with "" if NULL

CPython versions tested on:

CPython main branch

Operating systems tested on:

Linux

Output from running 'python -VV' on the command line:

Python 3.16.0a0 (heads/main-dirty:20e6c2f, Aug 19 2026, 15:22:30) [Clang 22.1.8 ]

Linked PRs

  • gh-156114: Fix crash in perf trampoline with unencodable code names #156300
  • [3.15] gh-156114: Fix crash in perf trampoline with unencodable code names (GH-156300) #157773
  • [3.13] gh-156114: Fix crash in perf trampoline with unencodable code names (GH-156300) #157774

Activity

  1. stestagg
    added
    type-crashA hard crash of the interpreter, possibly with a core dumpA hard crash of the interpreter, possibly with a core dump
    on Aug 20, 2026
  2. aisk
    added
    interpreter-core(Objects, Python, Grammar, and Parser dirs)(Objects, Python, Grammar, and Parser dirs)
    on Aug 20, 2026
  3. ashm-dev
    added a commit that references this issue on Aug 23, 2026

    Merge branch 'main' into pythongh-156114

    37ce4bf
  4. ashm-dev
    added 2 commits that reference this issue on Sep 17, 2026

    Merge branch 'main' into pythongh-156114

    d142286

    Merge branch 'main' into pythongh-156114

    07d6ba8
  5. pablogsal
    added 4 commits that reference this issue on Sep 18, 2026

    gh-156114: Fix crash in perf trampoline with unencodable code names (#…

    6dad8b8

    [3.13] gh-156114: Fix crash in perf trampoline with unencodable code …

    2aed763

    [3.14] gh-156114: Fix crash in perf trampoline with unencodable code …

    d3369c2

    [3.15] gh-156114: Fix crash in perf trampoline with unencodable code …

    3af62d9
  6. kumaraditya303
    closed this as completedon Sep 20, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    interpreter-core(Objects, Python, Grammar, and Parser dirs)(Objects, Python, Grammar, and Parser dirs)type-crashA hard crash of the interpreter, possibly with a core dumpA hard crash of the interpreter, possibly with a core dump

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions

      You are visitor 01402520 — GeezerVison does not store the pages you look up.
      Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.