oracle / oracle/graalpython

[Bug]: ArrayIndexOutOfBoundsException with `__build_class__`

Open
#1,096 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
Python
Stars
1.6k
Forks
155
Avg merge
9h 42m
Merged PRs (30d)
36

Description

Describe the bug

GraalPy crashes when running this fuzzed code:

def fn(x):
    pass

__build_class__(fn, '', '')
Operating system

Linux

CPU architecture

x86_64

GraalPy version

GraalPy 3.13.14 (Oracle GraalVM Native 25.3.4.1)

JDK version

No response

Context configuration

No response

Steps to reproduce

Snippet listed above

Expected behavior

No crash

Stack trace
java.lang.ArrayIndexOutOfBoundsException: Stack trace is imprecise, the top frames are missing and/or have wrong line numbers. To get precise stack traces, build the image with option -H:-ReduceImplicitExceptionStackTraceInformation
	at org.graalvm.py/com.oracle.graal.python.builtins.objects.function.PArguments.getArgument(PArguments.java:246)
	at org.graalvm.py/com.oracle.graal.python.builtins.objects.function.PArguments.getArgument(PArguments.java:250)
	at org.graalvm.py/com.oracle.graal.python.nodes.bytecode_dsl.PBytecodeDSLRootNode$CopyArguments.perform(PBytecodeDSLRootNode.java:1599)
	at org.graalvm.py/com.oracle.graal.python.nodes.bytecode_dsl.PBytecodeDSLRootNodeGen$CopyArguments_Node.execute$uncached(PBytecodeDSLRootNodeGen.java)
	at org.graalvm.py/com.oracle.graal.python.nodes.bytecode_dsl.PBytecodeDSLRootNodeGen$UncachedBytecodeNodeTailCall.handleCopyArguments_(PBytecodeDSLRootNodeGen.java:36250)
	at org.graalvm.py/com.oracle.graal.python.nodes.bytecode_dsl.PBytecodeDSLRootNodeGen$UncachedBytecodeNodeTailCall.__stub_handleCopyArguments_(PBytecodeDSLRootNodeGen.java:0)
	at org.graalvm.py/com.oracle.graal.python.nodes.bytecode_dsl.PBytecodeDSLRootNodeGen$UncachedBytecodeNodeTailCall.continueAt(PBytecodeDSLRootNodeGen.java:35093)
	at org.graalvm.py/com.oracle.graal.python.nodes.bytecode_dsl.PBytecodeDSLRootNodeGen.continueAt(PBytecodeDSLRootNodeGen.java:3501)
	at org.graalvm.py/com.oracle.graal.python.nodes.bytecode_dsl.PBytecodeDSLRootNodeGen.execute(PBytecodeDSLRootNodeGen.java:3493)
	at org.graalvm.truffle.runtime/com.oracle.truffle.runtime.OptimizedCallTarget.executeRootNode(OptimizedCallTarget.java:808)
	at org.graalvm.truffle.runtime/com.oracle.truffle.runtime.OptimizedCallTarget.profiledPERoot(OptimizedCallTarget.java:722)
	at org.graalvm.truffle.runtime/com.oracle.truffle.runtime.OptimizedCallTarget.callBoundary(OptimizedCallTarget.java:641)
	at org.graalvm.truffle.runtime.svm/com.oracle.svm.truffle.api.SubstrateOptimizedCallTarget.invokeCallBoundary(SubstrateOptimizedCallTarget.java:124)
	at com.oracle.truffle.enterprise.svm/com.oracle.svm.enterprise.truffle.compiler.SubstrateEnterpriseOptimizedCallTarget.invokeCompiledAdapterOrCallBoundary(SubstrateEnterpriseOptimizedCallTarget.java:293)
	at com.oracle.truffle.enterprise.svm/com.oracle.svm.enterprise.truffle.compiler.SubstrateEnterpriseOptimizedCallTarget.invokeFromInterpreter(SubstrateEnterpriseOptimizedCallTarget.java:269)
	at com.oracle.truffle.enterprise.svm/com.oracle.svm.enterprise.truffle.compiler.SubstrateEnterpriseOptimizedCallTarget.doInvoke(SubstrateEnterpriseOptimizedCallTarget.java:255)
	at org.graalvm.truffle.runtime/com.oracle.truffle.runtime.OptimizedCallTarget.callDirect(OptimizedCallTarget.java:573)
	at org.graalvm.truffle.runtime/com.oracle.truffle.runtime.OptimizedIndirectCallNode.call(OptimizedIndirectCallNode.java:68)
[...snip...]
Additional context

No response

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by running the provided build_class reproducer on GraalPy and trace the failure from PArguments.getArgument through PBytecodeDSLRootNode$CopyArguments. Investigate the argument handling involved in this call and add a regression check if the relevant test location is identified. Done means the snippet completes without an ArrayIndexOutOfBoundsException.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, python
Domain
compilers
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.