python / python/cpython

UBSan SEGV in `_Py_LazyJitTrampoline` when building with Clang and `--with-undefined-behavior-sanitizer` + experimental JIT

Open
#141,621 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

3.15 build interpreter-core topic-JIT type-crash
Dominant language
Python
Stars
77.2k
Forks
35.9k
PR metrics pending

Description

Bug report

Bug description:

Environment

  • CPython: main branch (local clone at .../cpython/main)

  • Platform: Linux x86_64 (glibc)

  • Compiler:

    • clang-18, clang-19, clang-20, clang-21 (see “Additional information”)
    • System default compiler (no CC / CXX set) – used for comparison

  • Configure flags:

./configure --with-pydebug --with-undefined-behavior-sanitizer --enable-experimental-jit=yes

Steps to reproduce

With Clang (example with clang-21):

CC=clang-21 CXX=clang++-21 ./configure --with-pydebug --with-undefined-behavior-sanitizer --enable-experimental-jit=yes && make

Actual behavior

During the build, _bootstrap_python crashes under UndefinedBehaviorSanitizer while freezing the abc module:

Crash log 
./_bootstrap_python ./Programs/_freeze_module.py abc ./Lib/abc.py Python/frozen_modules/abc.h
UndefinedBehaviorSanitizer:DEADLYSIGNAL
==1010144==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0x786f1ca45ff8 (pc 0x5feecae08630 bp 0x7ffe824db540 sp 0x7ffe824d5720 T1010144)
==1010144==The signal is caused by a READ memory access.
    #0 0x5feecae08630 in _Py_LazyJitTrampoline /home/shamil/oss/cpython/main/Python/jit.c:693:12
    #1 0x5feecaba2c40 in _PyEval_EvalFrameDefault /home/shamil/oss/cpython/main/Python/generated_cases.c.h:5495:13
    #2 0x5feeca7d564f in _PyEval_EvalFrame /home/shamil/oss/cpython/main/./Include/internal/pycore_ceval.h:121:16
    #3 0x5feeca7d564f in gen_send_ex2 /home/shamil/oss/cpython/main/Objects/genobject.c:259:24
    #4 0x5feeca7ce905 in gen_iternext /home/shamil/oss/cpython/main/Objects/genobject.c:635:9
    #5 0x5feeca81a7ae in list_extend_iter_lock_held /home/shamil/oss/cpython/main/Objects/listobject.c:1263:26
    #6 0x5feeca8122c0 in list_extend_impl /home/shamil/oss/cpython/main/Objects/listobject.c:1471:9
    #7 0x5feeca8122c0 in list_extend /home/shamil/oss/cpython/main/Objects/clinic/listobject.c.h:145:20
    #8 0x5feeca8122c0 in _PyList_Extend /home/shamil/oss/cpython/main/Objects/listobject.c:1480:12
    #9 0x5feeca726ca5 in PySequence_List /home/shamil/oss/cpython/main/Objects/abstract.c:2086:10
    #10 0x5feeca726ca5 in PySequence_Fast /home/shamil/oss/cpython/main/Objects/abstract.c:2117:9
    #11 0x5feecaa2167d in PyUnicode_Join /home/shamil/oss/cpython/main/Objects/unicodeobject.c:9960:12
    #12 0x5feecab87a03 in _PyEval_EvalFrameDefault /home/shamil/oss/cpython/main/Python/generated_cases.c.h:3902:35
    #13 0x5feecab4a2ad in _PyEval_Vector /home/shamil/oss/cpython/main/Python/ceval.c:2104:12
    #14 0x5feecab4a2ad in PyEval_EvalCode /home/shamil/oss/cpython/main/Python/ceval.c:944:21
    #15 0x5feecaed18b7 in run_eval_code_obj /home/shamil/oss/cpython/main/Python/pythonrun.c:1372:12
    #16 0x5feecaed1256 in run_mod /home/shamil/oss/cpython/main/Python/pythonrun.c:1475:19
    #17 0x5feecaecd6eb in pyrun_file /home/shamil/oss/cpython/main/Python/pythonrun.c:1300:15
    #18 0x5feecaecc28e in _PyRun_SimpleFileObject /home/shamil/oss/cpython/main/Python/pythonrun.c:521:13
    #19 0x5feecaecbc06 in _PyRun_AnyFileObject /home/shamil/oss/cpython/main/Python/pythonrun.c:81:15
    #20 0x5feecaf486bf in pymain_run_file_obj /home/shamil/oss/cpython/main/Modules/main.c:410:15
    #21 0x5feecaf486bf in pymain_run_file /home/shamil/oss/cpython/main/Modules/main.c:429:15
    #22 0x5feecaf47a95 in pymain_run_python /home/shamil/oss/cpython/main/Modules/main.c:691:21
    #23 0x5feecaf47a95 in Py_RunMain /home/shamil/oss/cpython/main/Modules/main.c:772:5
    #24 0x5feecb12bcc3 in main /home/shamil/oss/cpython/main/Programs/_bootstrap_python.c:100:12
    #25 0x786f1c62a574 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #26 0x786f1c62a627 in __libc_start_main csu/../csu/libc-start.c:360:3
    #27 0x5feeca499954 in _start (/home/shamil/oss/cpython/main/_bootstrap_python+0x775954) (BuildId: 7bed80e84f1f8597cf26ffc2c98fb769c5537a67)

==1010144==Register values:
rax = 0x0000786f1ca46000  rbx = 0x00005feecb965378  rcx = 0x0000000000000000  rdx = 0x0000000000000005
rdi = 0x0000786f1ca46000  rsi = 0x0000000000001000  rbp = 0x00007ffe824db540  rsp = 0x00007ffe824d5720
 r8 = 0x00000000ffffffff   r9 = 0x0000000000000000  r10 = 0x0000000000000022  r11 = 0x0000000000000246
r12 = 0x00005fef0c1a3970  r13 = 0x00005feecb70e550  r14 = 0x0000786f1c5af308  r15 = 0x0000786f1c5af298
UndefinedBehaviorSanitizer can not provide additional info.
SUMMARY: UndefinedBehaviorSanitizer: SEGV /home/shamil/oss/cpython/main/Python/jit.c:693:12 in _Py_LazyJitTrampoline
==1010144==ABORTING
make: *** [Makefile:1952: Python/frozen_modules/abc.h] Error 1

Expected behavior

The build should complete successfully, without an UndefinedBehaviorSanitizer crash in _Py_LazyJitTrampoline during module freezing.

Additional information

  • The same crash reproduces with:

    CC=clang-18 CXX=clang++-18 ./configure --with-pydebug --with-undefined-behavior-sanitizer --enable-experimental-jit=yes && make

CC=clang-19 CXX=clang++-19 ./configure --with-pydebug --with-undefined-behavior-sanitizer --enable-experimental-jit=yes && make

CC=clang-20 CXX=clang++-20 ./configure --with-pydebug --with-undefined-behavior-sanitizer --enable-experimental-jit=yes && make

CC=clang-21 CXX=clang++-21 ./configure --with-pydebug --with-undefined-behavior-sanitizer --enable-experimental-jit=yes && make

  • With the same configure flags but without forcing Clang (no CC / CXX in the environment), the build finishes successfully and _bootstrap_python does not crash under UBSan:

    ./configure --with-pydebug --with-undefined-behavior-sanitizer --enable-experimental-jit=yes && make
CPython versions tested on:

CPython main branch

Operating systems tested on:

Linux

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at Python/jit.c:693, where the UBSan stack trace identifies _Py_LazyJitTrampoline, then reproduce with the listed Clang configure flags and make command. Check the _bootstrap_python freeze step for abc and compare it with the successful build using the system compiler. Done means the experimental-JIT UBSan build completes without the reported SEGV.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
build-system, compilers
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.