Skip to content

gh-141976: Check stack bounds in JIT optimizer #142201

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Fidget-Spinner merged 9 commits into from
Dec 4, 2025
Merged

gh-141976: Check stack bounds in JIT optimizer #142201

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
0760415
Check stack bounds in JIT optimizer
Fidget-Spinner Dec 2, 2025
3c22cb5
📜🤖 Added by blurb_it.
blurb-it[bot] Dec 2, 2025
63f6fc0
apply review suggestions
Fidget-Spinner Dec 3, 2025
f7059b9
Merge remote-tracking branch 'upstream/main' into optimizer_check
Fidget-Spinner Dec 3, 2025
08d6c79
address review
Fidget-Spinner Dec 4, 2025
ac6c21a
check before not after
Fidget-Spinner Dec 4, 2025
558c2cf
fix tests
Fidget-Spinner Dec 4, 2025
a1b0ff1
fix mypy
Fidget-Spinner Dec 4, 2025
32631e8
refactor into own function
Fidget-Spinner Dec 4, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions Lib/test/test_generated_cases.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2115,6 +2115,7 @@ def test_validate_uop_unused_input(self):
"""
output = """
case OP: {
CHECK_STACK_BOUNDS(-1);
stack_pointer += -1;
ASSERT_WITHIN_STACK_BOUNDS(__FILE__, __LINE__);
break;
Expand All @@ -2132,6 +2133,7 @@ def test_validate_uop_unused_input(self):
"""
output = """
case OP: {
CHECK_STACK_BOUNDS(-1);
stack_pointer += -1;
ASSERT_WITHIN_STACK_BOUNDS(__FILE__, __LINE__);
break;
Expand All @@ -2153,6 +2155,7 @@ def test_validate_uop_unused_output(self):
case OP: {
JitOptRef foo;
foo = NULL;
CHECK_STACK_BOUNDS(1);
stack_pointer[0] = foo;
stack_pointer += 1;
ASSERT_WITHIN_STACK_BOUNDS(__FILE__, __LINE__);
Expand All @@ -2172,6 +2175,7 @@ def test_validate_uop_unused_output(self):
"""
output = """
case OP: {
CHECK_STACK_BOUNDS(1);
stack_pointer += 1;
ASSERT_WITHIN_STACK_BOUNDS(__FILE__, __LINE__);
break;
Expand Down
1 change: 1 addition & 0 deletions Misc/NEWS.d/next/Core_and_Builtins/2025-12-02-21-11-46.gh-issue-141976.yu7pDV.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
Check against abstract stack overflow in the JIT optimizer.
25 changes: 21 additions & 4 deletions Python/optimizer_analysis.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -144,10 +144,6 @@ incorrect_keys(PyObject *obj, uint32_t version)

#define CURRENT_FRAME_IS_INIT_SHIM() (ctx->frame->code == ((PyCodeObject *)&_Py_InitCleanup))

#define WITHIN_STACK_BOUNDS() \
(CURRENT_FRAME_IS_INIT_SHIM() || (STACK_LEVEL() >= 0 && STACK_LEVEL() <= STACK_SIZE()))


#define GETLOCAL(idx) ((ctx->frame->locals[idx]))

#define REPLACE_OP(INST, OP, ARG, OPERAND) \
Expand Down Expand Up @@ -192,6 +188,27 @@ incorrect_keys(PyObject *obj, uint32_t version)

#define JUMP_TO_LABEL(label) goto label;

static int
check_stack_bounds(JitOptContext *ctx, JitOptRef *stack_pointer, int offset, int opcode)
{
int stack_level = (int)(stack_pointer + (offset) - ctx->frame->stack);
int should_check = !CURRENT_FRAME_IS_INIT_SHIM() ||
(opcode == _RETURN_VALUE) ||
(opcode == _RETURN_GENERATOR) ||
(opcode == _YIELD_VALUE);
if (should_check && (stack_level < 0 || stack_level > STACK_SIZE())) {
ctx->contradiction = true;
ctx->done = true;
return 1;
}
return 0;
}

#define CHECK_STACK_BOUNDS(offset) \
if (check_stack_bounds(ctx, stack_pointer, offset, opcode)) { \
break; \
} \

static int
optimize_to_bool(
_PyUOpInstruction *this_instr,
Expand Down
Loading
Loading