René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Pointer arithmetic on NULL in INSTRUMENTED_JUMP","articleBody":"# Bug report\n\n### Bug description:\n\nFound by the CI UBSan job, e.g. [this run](https://github.com/python/cpython/actions/runs/28271616914/job/83769993905?pr=152311):\n\n```\nPython/generated_cases.c.h:8158:17: runtime error: applying non-zero offset 44 to null pointer\nSUMMARY: UndefinedBehaviorSanitizer: undefined-behavior Python/generated_cases.c.h:8158:17 \n```\n\nNote this requires applying https://github.com/python/cpython/pull/152311 which seems to change the state ever so slightly uncovering the UB. Locally I get with clang:\n\n```\n$ ./python -m test test_monitoring\nUsing random seed: 1062411673\n0:00:00 load avg: 1.00 mem: 41.2 MiB Run 1 test sequentially in a single process\n0:00:00 load avg: 1.00 mem: 41.2 MiB [1/1] test_monitoring\nPython/generated_cases.c.h:8158:17: runtime error: applying non-zero offset 44 to null pointer\nSUMMARY: UndefinedBehaviorSanitizer: undefined-behavior Python/generated_cases.c.h:8158:17 \nPython/generated_cases.c.h:8050:13: runtime error: applying non-zero offset 2 to null pointer\nSUMMARY: UndefinedBehaviorSanitizer: undefined-behavior Python/generated_cases.c.h:8050:13 \nPython/generated_cases.c.h:13861:59: runtime error: applying non-zero offset to non-null pointer 0x000000000002 produced null pointer\nSUMMARY: UndefinedBehaviorSanitizer: undefined-behavior Python/generated_cases.c.h:13861:59 \nPython/generated_cases.c.h:13881:57: runtime error: applying non-zero offset to non-null pointer 0x000000000002 produced null pointer\nSUMMARY: UndefinedBehaviorSanitizer: undefined-behavior Python/generated_cases.c.h:13881:57 \n0:00:00 load avg: 1.00 mem: 43.0 MiB [1/1] test_monitoring passed\n\n== Tests result: SUCCESS ==\n\n1 test OK.\n\nTotal duration: 357 ms\nTotal tests: run=98\nTotal test files: run=1/1\nResult: SUCCESS\n```\n\nThe UB is reported, e.g. at:\n\nhttps://github.com/python/cpython/blob/b3154aa4507f6d2612c128e912860be963dbff1a/Python/generated_cases.c.h#L8158\n\nWhich calls `INSTRUMENTED_JUMP`:\n\nhttps://github.com/python/cpython/blob/b3154aa4507f6d2612c128e912860be963dbff1a/Python/ceval_macros.h#L387-L403\n\nIf `_Py_call_instrumentation_jump` raises it returns NULL (setting *next_instr*). But then on the error path, we do `next_instr + oparg` resulting in the UB.\n\n### CPython versions tested on:\n\nCPython main branch\n\n### Operating systems tested on:\n\n_No response_\n\n\u003c!-- gh-linked-prs --\u003e\n### Linked PRs\n* gh-152376\n* gh-152566\n* gh-152567\n* gh-152577\n\u003c!-- /gh-linked-prs --\u003e\n","author":{"url":"https://github.com/StanFromIreland","@type":"Person","name":"StanFromIreland"},"datePublished":"2026-06-27T08:58:50.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":0},"url":"https://github.com/152375/cpython/issues/152375"}