René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"JIT: `executor-\u003evm_data.valid` assertion failure in `unlink_executor`","articleBody":"# Crash report\n\n### What happened?\n\nSorry about the messy and convoluted bug report, I hope something interesting might be gleaned from it.\n\nIt's possible to non-deterministically abort a special debug JIT build by running the code below, **running from a Python executable from a venv where you installed a package in editable mode**. This darn requirement for an install in editable mode stumped me for hours! \n\nFor this special build, apply this diff (couldn't get it to work in a normal build by changing loop lengths):\n```diff\nindex 454c8dde031..9e21c41421a 100644\n--- a/Include/internal/pycore_backoff.h\n+++ b/Include/internal/pycore_backoff.h\n@@ -99,8 +99,8 @@ backoff_counter_triggers(_Py_BackoffCounter counter)\n // Must be larger than ADAPTIVE_COOLDOWN_VALUE, otherwise when JIT code is\n // invalidated we may construct a new trace before the bytecode has properly\n // re-specialized:\n-#define JUMP_BACKWARD_INITIAL_VALUE 4095\n-#define JUMP_BACKWARD_INITIAL_BACKOFF 12\n+#define JUMP_BACKWARD_INITIAL_VALUE 63\n+#define JUMP_BACKWARD_INITIAL_BACKOFF 6\n static inline _Py_BackoffCounter\n initial_jump_backoff_counter(void)\n {\n@@ -112,8 +112,8 @@ initial_jump_backoff_counter(void)\n  * Must be larger than ADAPTIVE_COOLDOWN_VALUE,\n  * otherwise when a side exit warms up we may construct\n  * a new trace before the Tier 1 code has properly re-specialized. */\n-#define SIDE_EXIT_INITIAL_VALUE 4095\n-#define SIDE_EXIT_INITIAL_BACKOFF 12\n+#define SIDE_EXIT_INITIAL_VALUE 63\n+#define SIDE_EXIT_INITIAL_BACKOFF 6\n\n static inline _Py_BackoffCounter\n initial_temperature_backoff_counter(void)\n```\n\nThis MRE must be invoked like this:\n```bash\n/path/to/venv/with/editable/install/bin/python mre.py\n```\n\nSorry about the long MRE, this code seems stubbornly hard to reduce. MRE:\n```python\nfrom random import random\n\nclass C_object_v1:\n\n    def __getitem__(self, item):\n        return 5\nobject_v1 = C_object_v1()\n\n\nint_v4 = -51452741571812374\nfloat_v6 = 46.1\nfloat_v7 = 77.26\n\nclass StatefulLen_stateful_len_object_v12:\n    def __init__(self):\n        self.len_count = 0\n\n    def __len__(self):\n        _len = 0 if self.len_count \u003c 70 else 99\n        self.len_count += 1\n        return _len\nstateful_len_object_v12 = StatefulLen_stateful_len_object_v12()\n\ndef uop_harness_f1():\n    class StatefulIter_uop_harness_f1_6059:\n\n        def __init__(self):\n            self._iter_count = 0\n            self._iterable = {1, 2, 3}\n\n        def __iter__(self):\n            self._iter_count += 1\n            if self._iter_count \u003c= 67:\n                return iter((None,))\n            return iter(self._iterable)\n    uop_harness_f1_6059 = StatefulIter_uop_harness_f1_6059()\n    evil_iterable = StatefulIter_uop_harness_f1_6059()\n    for _ in range(100):\n        tuple(evil_iterable)\n    object_v1 = globals()['object_v1']\n\n    class SwappedClass_2950:\n        pass\n    object_v1.__class__ = SwappedClass_2950\n    if object_v1:\n        pass\n    for i_loop_9595 in [0, 1, 2, 3, 4, 5, 6, 7, 8, 9] * 50:\n        res_compareopint = int_v4 \u003e int_v4\n    if random() \u003c 0.01:\n        object_v1.__class__.get_value = lambda *a, **kw: 'patched!'\nfor i_f1 in range(500):\n    try:\n        uop_harness_f1()\n    except Exception:\n        break\n```\n\nBacktrace:\n```\npython: Python/optimizer.c:1436: unlink_executor: Assertion `executor-\u003evm_data.valid' failed.\n\nProgram received signal SIGABRT, Aborted.\nDownload failed: Invalid argument.  Continuing without source file ./nptl/./nptl/pthread_kill.c.\n__pthread_kill_implementation (threadid=\u003coptimized out\u003e, signo=6, no_tid=0)\n    at ./nptl/pthread_kill.c:44\nwarning: 44     ./nptl/pthread_kill.c: No such file or directory\n(gdb) bt\n#0  __pthread_kill_implementation (threadid=\u003coptimized out\u003e, signo=6, no_tid=0)\n    at ./nptl/pthread_kill.c:44\n#1  __pthread_kill_internal (threadid=\u003coptimized out\u003e, signo=6) at ./nptl/pthread_kill.c:89\n#2  __GI___pthread_kill (threadid=\u003coptimized out\u003e, signo=signo@entry=6)\n    at ./nptl/pthread_kill.c:100\n#3  0x00007ffff7c4579e in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26\n#4  0x00007ffff7c288cd in __GI_abort () at ./stdlib/abort.c:73\n#5  0x00007ffff7c28830 in __assert_fail_base (fmt=\u003coptimized out\u003e, assertion=\u003coptimized out\u003e,\n    file=\u003coptimized out\u003e, line=\u003coptimized out\u003e, function=\u003coptimized out\u003e) at ./assert/assert.c:118\n#6  0x00007ffff7c3be1f in __assert_fail (assertion=\u003coptimized out\u003e, file=\u003coptimized out\u003e,\n    line=\u003coptimized out\u003e, function=\u003coptimized out\u003e) at ./assert/assert.c:127\n#7  0x00005555558a2603 in unlink_executor (executor=executor@entry=0x555555f44480)\n    at Python/optimizer.c:1436\n#8  0x00005555558a31a7 in uop_dealloc (op=op@entry=0x555555f44480) at Python/optimizer.c:271\n#9  0x00005555556dc978 in _Py_Dealloc (op=0x555555f44480) at Objects/object.c:3206\n#10 0x00007ffff71d59f7 in ?? ()\n#11 0x00007fffffffd470 in ?? ()\n#12 0x00007ffff71d522b in ?? ()\n#13 0x00007fffffffd470 in ?? ()\n#14 0x00007ffff71d4017 in ?? ()\n#15 0x0000555555e60c70 in ?? ()\n#16 0x00007ffff71d4000 in ?? ()\n#17 0x0000555555cca298 in _PyRuntime ()\n#18 0x00007ffff7fac0b8 in ?? ()\n#19 0x00007ffff7fac160 in ?? ()\n#20 0x00005555557ca1c0 in _PyEval_EvalFrameDefault (tstate=0xcdcdcdcdcdcdcdcd, frame=0x555555cca298 \u003c_PyRuntime+331064\u003e, throwflag=-842150451)\n    at Python/generated_cases.c.h:5598\nBacktrace stopped: previous frame inner to this frame (corrupt stack?)\n```\n\nHere are the outputs from running with `PYTHON_OPT_DEBUG=4` and `PYTHON_LLTRACE=4`, since they are too long I've attached them as files:\n[opt_debug2.txt](https://github.com/user-attachments/files/21367144/opt_debug2.txt)\n[lltrace2.txt](https://github.com/user-attachments/files/21367143/lltrace2.txt)\n\nFound using [lafleur](https://github.com/devdanzin/lafleur/).\n\n### CPython versions tested on:\n\nCPython main branch\n\n### Operating systems tested on:\n\nLinux\n\n### Output from running 'python -VV' on the command line:\n\nPython 3.15.0a0 (heads/main-dirty:6bf1c0ab349, Jul 21 2025, 20:28:08) [GCC 14.2.0]","author":{"url":"https://github.com/devdanzin","@type":"Person","name":"devdanzin"},"datePublished":"2025-07-22T12:46:27.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":15},"url":"https://github.com/136996/cpython/issues/136996"}