GeezerVison

Copy link

Copy Markdown

Member

vstinner requested review from ericsnowcurrently and markshannon as code owners November 2, 2025 18:15

sergey-miryanov reviewed Nov 2, 2025

View reviewed changes

sergey-miryanov reviewed Nov 2, 2025

View reviewed changes

picnixz reviewed Nov 2, 2025

View reviewed changes

efimov-mikhail reviewed Nov 2, 2025

View reviewed changes

sergey-miryanov approved these changes Nov 2, 2025

View reviewed changes

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

picnixz reviewed Nov 2, 2025

View reviewed changes

ZeroIntensity reviewed Nov 2, 2025

View reviewed changes

import subprocess, sys
cmd=[sys.executable, 'reproducer.py']
success = 0
while True:
    proc = subprocess.run(cmd)
    if proc.returncode != 1:
        print()
        print(f"Exitcode {proc.returncode}")
        break
    success += 1
    print(success)

import faulthandler
import sys
faulthandler.dump_traceback_later(10 * 1e-308, exit=True, file=sys.__stderr__)
assert False

ZeroIntensity approved these changes Nov 3, 2025

View reviewed changes

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

4 checks passed

vstinner deleted the faulthandler_freed branch November 4, 2025 10:48

…40921)

faulthandler now detects if a frame or a code object is invalid or
freed.

Add helper functions:

* _PyCode_SafeAddr2Line()
* _PyFrame_SafeGetCode()
* _PyFrame_SafeGetLasti()

_PyMem_IsPtrFreed() now detects pointers in [-0xff, 0xff] range
as freed.
(cherry picked from commit a84181c)

Co-authored-by: Victor Stinner <[email protected]>

)

faulthandler now detects if a frame or a code object is invalid or
freed.

Add helper functions:

* _PyCode_SafeAddr2Line()
* _PyFrame_SafeGetCode()
* _PyFrame_SafeGetLasti()

_PyMem_IsPtrFreed() now detects pointers in [-0xff, 0xff] range
as freed.

(cherry picked from commit a84181c)

#140981)

gh-140815: Fix faulthandler for invalid/freed frame (GH-140921)

faulthandler now detects if a frame or a code object is invalid or
freed.

Add helper functions:

* _PyCode_SafeAddr2Line()
* _PyFrame_SafeGetCode()
* _PyFrame_SafeGetLasti()

_PyMem_IsPtrFreed() now detects pointers in [-0xff, 0xff] range
as freed.
(cherry picked from commit a84181c)

Co-authored-by: Victor Stinner <[email protected]>

…140985)

gh-140815: Fix faulthandler for invalid/freed frame (#140921)

faulthandler now detects if a frame or a code object is invalid or
freed.

Add helper functions:

* _PyCode_SafeAddr2Line()
* _PyFrame_SafeGetCode()
* _PyFrame_SafeGetLasti()

_PyMem_IsPtrFreed() now detects pointers in [-0xff, 0xff] range
as freed.

(cherry picked from commit a84181c)

)

faulthandler now detects if a frame or a code object is invalid or
freed.

Add helper functions:

* _PyCode_SafeAddr2Line()
* _PyFrame_SafeGetCode()
* _PyFrame_SafeGetLasti()

_PyMem_IsPtrFreed() now detects pointers in [-0xff, 0xff] range
as freed.

Summary:
This diff adds a patch to the `third-party/python/3.12` Meta-internal fork. It backports the trampoline-frame part of the upstream gh-140815 fix to fix a crash in `faulthandler`'s traceback dump. Upstream fixed this in main, 3.14 and 3.13, but not in 3.12, which only takes security fixes.

Upstream:
- 3.13 backport: python/cpython#140985
- 3.14 backport: python/cpython#140981 (shipped in 3.14.1, already in `third-party/python/3.14`)
- main: python/cpython#140921
- issue: python/cpython#140815

The hunks were checked against the 3.14 backport in `third-party/python/3.14/pristine/Python/traceback.c` rather than the 3.13 PR diff.

**Problem**
A `__del__` that runs while a frame called from C (e.g. by `map()`) is being popped sees two `FRAME_OWNED_BY_CSTACK` shim frames in a row, because a frame is unlinked before it is cleared (GH-99729). `dump_traceback()` skips only one shim and passes the second to `dump_frame()`:
- Debug builds fail `assert(frame->owner != FRAME_OWNED_BY_CSTACK)`.
- Release builds call `PyUnstable_InterpreterFrame_GetLine()` on the shim. Meta's `_PyFrame_EnsureFrameFullyInitialized()` then reads the shim's `f_funcobj`, which release builds leave uninitialized, and crashes with SIGSEGV.

This killed rank 90 of f1134899418. The stuck-job detector's stack-dump signal arrived while a finalizer was in this state, and the dump died right after printing `File "<shim>"`.

**Fix**
Same as upstream: `dump_frame()` ignores trampoline frames, and the one-shim skip in the `dump_traceback()` loop is removed along with its assert. Adapted to 3.12:
- the owner is still `FRAME_OWNED_BY_CSTACK` (3.14 renamed it `FRAME_OWNED_BY_INTERPRETER`);
- `dump_frame()` stays `void`, so the early return is `return;` instead of `return 0;`.

As upstream, shims now count toward `MAX_FRAME_DEPTH`.

The rest of gh-140815 (`_PyFrame_SafeGetCode()`, `_PyFrame_SafeGetLasti()`, `_PyCode_SafeAddr2Line()`, `<freed frame>` / `<invalid frame>`) is not backported. Its frame validation needed a CinderX JIT-frame adaptation in 3.14 (`third-party/python/3.14/patches/21-jit-frame-safe-get-code`) and would need a separate one for 3.12.

Upstream added no test for this, so `test_dump_traceback_consecutive_shims` is Meta-local.

Reviewed By: itamaro

Differential Revision: D121622997

fbshipit-source-id: 7315ccecef7e3432116334db435a0c62a201b332