classification
Title: interpreter crash when multiplying large tuples
Type: crash Stage:
Components: Interpreter Core Versions: Python 2.7
process
Status: open Resolution:
Dependencies: Superseder:
Assigned To: Nosy List: imz, inada.naoki, serhiy.storchaka
Priority: normal Keywords:

Created on 2018-03-27 10:10 by imz, last changed 2018-03-27 22:39 by imz.

Messages (6)
msg314508 - (view) Author: Ivan Zakharyaschev (imz) Date: 2018-03-27 10:10
The issue https://bugs.python.org/msg314475 has arisen for tuples (but not for lists, as in the example there) in 2.7.14 for me. How should we fix it in a better way?

This bug is not reproducible in python 3.5.4.

[builder@localhost ~]$ python
Python 2.7.14 (default, Nov  7 2017, 17:07:17) 
[GCC 6.3.1 20170118 (ALT 6.3.1-alt2)] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> x = [0] * 2**20
>>> x *= 2**20
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
MemoryError
>>> x = [0,0,0,0,0,0] * 2**20
>>> x *= 2**20
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
MemoryError
>>> x = ('a', 'b')
>>> x = ('a', 'b') * 2**20
>>> x *= 2**20
Segmentation fault
[builder@localhost ~]$ python --version
Python 2.7.14
[builder@localhost ~]$ python
Python 2.7.14 (default, Nov  7 2017, 17:07:17) 
[GCC 6.3.1 20170118 (ALT 6.3.1-alt2)] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> import sys
>>> sys.maxsize
2147483647
>>> sys.maxint
2147483647
>>> 
[builder@localhost ~]$ python RPM/BUILD/Python-2.7.14/Lib/test/test_tuple.py
test_addmul (__main__.TupleTest) ... ok
test_bigrepeat (__main__.TupleTest) ... Segmentation fault
[builder@localhost ~]$
msg314510 - (view) Author: Ivan Zakharyaschev (imz) Date: 2018-03-27 10:12
I meant the old issue https://bugs.python.org/issue1704621 .
msg314512 - (view) Author: INADA Naoki (inada.naoki) * (Python committer) Date: 2018-03-27 10:58
Would you paste traceback?
msg314522 - (view) Author: Serhiy Storchaka (serhiy.storchaka) * (Python committer) Date: 2018-03-27 11:48
tuplerepeat() in Objects/tupleobject.c uses a questionable check that relies on signed integer overflow. It is a matter of time when this rifle will shoot in the foot. But I didn't expected issues with old good gcc 6.3. Was the interpreter compiled with non-standard options or ran on non-x86 platform?
msg314559 - (view) Author: Ivan Zakharyaschev (imz) Date: 2018-03-27 22:37
The traceback:

[builder@localhost ~]$ python -c 'x = ("a", "b") * 2**20; x *= 2**20'
Segmentation fault (core dumped)
[builder@localhost ~]$ gdb python core.23284 
GNU gdb (GDB) 7.9-alt4 (ALT)
Copyright (C) 2015 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "i586-alt-linux".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from python...Reading symbols from /usr/lib/debug/usr/bin/python2.7.debug...done.
done.

warning: core file may not match specified executable file.
[New LWP 23284]
Warning: couldn't activate thread debugging using libthread_db: Cannot find new threads: generic error
Warning: couldn't activate thread debugging using libthread_db: Cannot find new threads: generic error

warning: Unable to find libthread_db matching inferior's thread library, thread debugging will not be available.
Warning: couldn't activate thread debugging using libthread_db: Cannot find new threads: generic error
Warning: couldn't activate thread debugging using libthread_db: Cannot find new threads: generic error

warning: Unable to find libthread_db matching inferior's thread library, thread debugging will not be available.
Core was generated by `python -c x = ("a", "b") * 2**20; x *= 2**20'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  tuplerepeat (a=0xf694301c, n=1048576) at Objects/tupleobject.c:503
503	            *p = items[j];
(gdb) bt
#0  tuplerepeat (a=0xf694301c, n=1048576) at Objects/tupleobject.c:503
#1  0xf7546d47 in sequence_repeat (n=0x80a83ac, seq=0xf694301c, repeatfunc=0xf75b24a0 <tuplerepeat>) at Objects/abstract.c:1210
#2  PyNumber_InPlaceMultiply (v=0xf694301c, w=0x80a83ac) at Objects/abstract.c:1374
#3  0xf7602ff8 in PyEval_EvalFrameEx (f=<optimized out>, throwflag=<optimized out>) at Python/ceval.c:1653
#4  0xf7608fee in PyEval_EvalCodeEx (co=0xf71a8ba8, globals=0xf7240714, locals=0xf7240714, args=0x0, argcount=0, kws=0x0, kwcount=0, defs=0x0, defcount=0, closure=0x0) at Python/ceval.c:3589
#5  0xf760916e in PyEval_EvalCode (co=0xf71a8ba8, globals=0xf7240714, locals=0xf7240714) at Python/ceval.c:669
#6  0xf762c508 in run_mod (arena=0x8068320, flags=0xffa1a82c, locals=0xf7240714, globals=0xf7240714, filename=0xf765fec9 "<string>", mod=<optimized out>) at Python/pythonrun.c:1376
#7  PyRun_StringFlags (str=0x804b160 "x = (\"a\", \"b\") * 2**20; x *= 2**20\n", start=257, globals=0xf7240714, locals=0xf7240714, flags=0xffa1a82c) at Python/pythonrun.c:1339
#8  0xf762e160 in PyRun_SimpleStringFlags (command=0x804b160 "x = (\"a\", \"b\") * 2**20; x *= 2**20\n", flags=0xffa1a82c) at Python/pythonrun.c:974
#9  0xf764498e in Py_Main (argc=<optimized out>, argv=<optimized out>) at Modules/main.c:589
#10 0x080484f7 in main (argc=3, argv=0xffa1a974) at Modules/python.c:20
(gdb) quit
[builder@localhost ~]$ 

It was built like this -- http://git.altlinux.org/tasks/archive/done/_188/193020/build/100/i586/log :

i586-alt-linux-gcc -pthread -c -fno-strict-aliasing -pipe -Wall -g -O3 -march=i586 -mtune=generic -DNDEBUG -pipe -Wall -g -O3 -march=i586 -mtune=generic  -I. -IInclude -I./Include  -fPIC -DPy_BUILD_CORE -o Objects/tupleobject.o Objects/tupleobject.c

The same happens with gcc7-7.3.1-alt3 here -- http://git.altlinux.org/tasks/202598/build/100/i586/log .
msg314560 - (view) Author: Ivan Zakharyaschev (imz) Date: 2018-03-27 22:39
It was run in i586 chroot on x86_64.
History
Date User Action Args
2018-03-27 22:39:18imzsetmessages: + msg314560
2018-03-27 22:37:22imzsetmessages: + msg314559
2018-03-27 11:48:25serhiy.storchakasetnosy: + serhiy.storchaka
messages: + msg314522
2018-03-27 10:58:13inada.naokisetnosy: + inada.naoki
messages: + msg314512
2018-03-27 10:12:54imzsetmessages: + msg314510
2018-03-27 10:10:51imzcreate