Issue45025
This issue tracker has been migrated to GitHub,
and is currently read-only.
For more information,
see the GitHub FAQs in the Python's Developer Guide.
Created on 2021-08-27 01:47 by indygreg, last changed 2022-04-11 14:59 by admin.
Messages (9) | |||
---|---|---|---|
msg400388 - (view) | Author: Gregory Szorc (indygreg) * | Date: 2021-08-27 01:47 | |
At least the PyASCIIObject struct in Include/cpython/unicodeobject.h uses bit fields. Various preprocessor macros like PyUnicode_IS_ASCII() and PyUnicode_KIND() access this struct's bit field. This is problematic because according to the C specification, the storage of bit fields is unspecified and may vary from compiler to compiler or architecture to architecture. Theoretically, a build of libpython with compiler A may not have the same storage layout of a bit field as a separate binary built with compiler B. These 2 binaries could be linked/loaded together, resulting in a crash or incorrect behavior at run-time. https://stackoverflow.com/questions/6043483/why-bit-endianness-is-an-issue-in-bitfields/6044223#6044223 To ensure bit field behavior is consistent, the same compiler must be used for all bit field interaction. Since it is effectively impossible to ensure this for programs like Python where multiple compilers are commonly at play (a 3rd party C extension will likely not be built on the same machine that built libpython), bit fields must not be exposed in the C API. If a bit field must exist, the bit field should not be declared in a public .h header and any APIs for accessing the bit field must be implemented as compiled functions such that only a single compiler will define the bit field storage layout. In order to avoid undefined behavior, Python's C API should avoid all use of bit fields. This issue is in response to https://github.com/PyO3/pyo3/issues/1824. |
|||
msg400615 - (view) | Author: STINNER Victor (vstinner) * ![]() |
Date: 2021-08-30 15:03 | |
> At least the PyASCIIObject struct in Include/cpython/unicodeobject.h uses bit fields. Various preprocessor macros like PyUnicode_IS_ASCII() and PyUnicode_KIND() access this struct's bit field. What is your use case? Which functions do you need? You should not access directly the PyASCIIObject structure. Python provides many functions to access the content of a Unicode string object. |
|||
msg400617 - (view) | Author: Petr Viktorin (petr.viktorin) * ![]() |
Date: 2021-08-30 15:14 | |
The macro PyUnicode_KIND is part of the documented public C API. It accesses the bit field "state.kind" directly. |
|||
msg400620 - (view) | Author: STINNER Victor (vstinner) * ![]() |
Date: 2021-08-30 15:24 | |
> The macro PyUnicode_KIND is part of the documented public C API. IMO it was a mistake to expose it as part of the public C API. This is an implementation detail which should not be exposed. The C API should not expose *directly* how characters are stored in memory, but provide an abstract way to read and write Unicode characters. The PEP 393 implementation broke the old C API in many ways because it exposed too many implementation details. Sadly, the new C API is... not better :-( If tomorrow, CPython is modified to use UTF-8 internally (as PyPy does), the C API will likely be broken *again* in many (new funny) ways. 11 years after the PEP 393 (Python 3.3), we only start fixing the old C API :-( The work will be completed in 2 or 3 Python releases (Python 3.12 or 3.13): * https://www.python.org/dev/peps/pep-0623/ * https://www.python.org/dev/peps/pep-0624/ The C API for Unicode strings is causing a lot of issues in PyPy which uses UTF-8 internally. C extensions can fail to build on PyPy if they use functions (macros) like PyUnicode_KIND(). |
|||
msg400621 - (view) | Author: STINNER Victor (vstinner) * ![]() |
Date: 2021-08-30 15:26 | |
> In order to avoid undefined behavior, Python's C API should avoid all use of bit fields. See also the PEP 620. IMO more generally, the C API should not expose structures, but provide ways to access it through getter and setter functions. See bpo-40120 "Undefined C behavior going beyond end of struct via a [1] arrays" which is a similar issue. |
|||
msg400622 - (view) | Author: Petr Viktorin (petr.viktorin) * ![]() |
Date: 2021-08-30 15:30 | |
PyUnicode_KIND does *not* expose the implementation details to the programmer. If the internal representation os strings is switched to use masks and shifts instead of bitfields, PyUnicode_KIND (and others) can be adapted to the new details without breaking API compatibility. And that switch would fix this issue. |
|||
msg400624 - (view) | Author: STINNER Victor (vstinner) * ![]() |
Date: 2021-08-30 15:37 | |
> PyUnicode_KIND does *not* expose the implementation details to the programmer. PyUnicode_KIND() is very specific to the exact PEP 393 implementation. Documentation of this field: --- /* Character size: - PyUnicode_WCHAR_KIND (0): * character type = wchar_t (16 or 32 bits, depending on the platform) - PyUnicode_1BYTE_KIND (1): * character type = Py_UCS1 (8 bits, unsigned) * all characters are in the range U+0000-U+00FF (latin1) * if ascii is set, all characters are in the range U+0000-U+007F (ASCII), otherwise at least one character is in the range U+0080-U+00FF - PyUnicode_2BYTE_KIND (2): * character type = Py_UCS2 (16 bits, unsigned) * all characters are in the range U+0000-U+FFFF (BMP) * at least one character is in the range U+0100-U+FFFF - PyUnicode_4BYTE_KIND (4): * character type = Py_UCS4 (32 bits, unsigned) * all characters are in the range U+0000-U+10FFFF * at least one character is in the range U+10000-U+10FFFF */ unsigned int kind:3; --- I don't think that PyUnicode_KIND() makes sense if CPython uses UTF-8 tomorrow. > If the internal representation os strings is switched to use masks and shifts instead of bitfields, PyUnicode_KIND (and others) can be adapted to the new details without breaking API compatibility. PyUnicode_KIND() was exposed in the *public* C API because unicodeobject.h provides functions as macros for best performances, and these macros use PyUnicode_KIND() internally. Macros like PyUnicode_READ(kind, data, index) are also designed for best performances with the exact PEP 393 implementation. The public C API should only contain PyUnicode_READ_CHAR(unicode, index): this macro doesn't use "kind" or "data" which are (again) specific to the PEP 393. In the CPython implementation, we should use the most efficient code, it's fine to use macros accessing directly structures. But for the public C API, I would recommend to only provide abstractions, even if there are a little bit slower. |
|||
msg400634 - (view) | Author: Gregory Szorc (indygreg) * | Date: 2021-08-30 16:38 | |
My use case for these low-level APIs is to write tests for low-level string/encoding handling in my custom use of the PyPreConfig and PyConfig structs. I wanted to verify that exact byte sequences were turned into specific representations inside of Python strings. This includes ensuring that certain byte sequences retain their appropriate "character" width in internal storage. I know there are alternative ways of performing this testing. But testing against the actual data structure used internally by CPython seemed the most precise since it isolates problems to the "store in Python" side of the problem and not "what does Python do once the data is stored." |
|||
msg400788 - (view) | Author: STINNER Victor (vstinner) * ![]() |
Date: 2021-08-31 22:02 | |
> My use case for these low-level APIs is to write tests for low-level string/encoding handling in my custom use of the PyPreConfig and PyConfig structs. I wanted to verify that exact byte sequences were turned into specific representations inside of Python strings. This includes ensuring that certain byte sequences retain their appropriate "character" width in internal storage. CPython contains many checks to ensure that a string always use the most effecient storage, especially in debug mode. The C API should not allow to create a string using an inefficient storage, unless you "abuse" the C API :-D I'm not sure what do you test. |
History | |||
---|---|---|---|
Date | User | Action | Args |
2022-04-11 14:59:49 | admin | set | github: 89188 |
2021-08-31 22:02:29 | vstinner | set | messages: + msg400788 |
2021-08-30 16:38:54 | indygreg | set | messages: + msg400634 |
2021-08-30 15:37:53 | vstinner | set | messages: + msg400624 |
2021-08-30 15:30:43 | petr.viktorin | set | messages: + msg400622 |
2021-08-30 15:26:43 | vstinner | set | messages: + msg400621 |
2021-08-30 15:24:40 | vstinner | set | nosy:
+ methane, serhiy.storchaka messages: + msg400620 |
2021-08-30 15:14:27 | petr.viktorin | set | messages: + msg400617 |
2021-08-30 15:03:16 | vstinner | set | messages: + msg400615 |
2021-08-30 08:43:55 | georg.brandl | set | nosy:
+ georg.brandl |
2021-08-30 08:20:28 | georg.brandl | set | nosy:
+ vstinner |
2021-08-27 07:24:26 | erlendaasland | set | nosy:
+ petr.viktorin |
2021-08-27 01:55:53 | indygreg | set | title: Reliance on C bit fields is C API is undefined behavior -> Reliance on C bit fields in C API is undefined behavior |
2021-08-27 01:47:13 | indygreg | create |