Visitar URL original
test: W-RE-PARSER-DEOPT-DETACH sentinel for re._parser JIT crash · SonicField/cpython@85ed449 · GitHub
Skip to content

Commit 85ed449

Browse files
committed
test: W-RE-PARSER-DEOPT-DETACH sentinel for re._parser JIT crash
Repro for re._parser JIT correctness regression discovered via pythia python#128 python#2 perf seam (generalist 22:05Z; supervisor-opened W-RE-PARSER-DEOPT-DETACH workstream 22:06:56Z). Workload: cinderjit.auto() + repeated re.compile() of named-group patterns past the 1000-call auto-compile threshold so re._parser:Tokenizer.__next + SubPattern.__getitem__ + .getwidth all hit deopt-backoff + JIT-detach. Subsequent re.compile() either: (a) AttributeError: 'SubPattern' object has no attribute 'state' at Lib/re/_compiler.py:761 (p.state.groupdict) (b) SIGSEGV (exit 139, core dumped) Without JIT_ENABLE=1: 2000+ iterations PASS clean. Two failure modes (AttributeError + SIGSEGV) on the same workload suggest UAF / corrupted attribute storage post-deopt-detach rather than a missing __init__ run (theologian 22:06:38Z structural read). JIT trace messages preceding crash include sequential Deopt backoff for Tokenizer.__next, Tokenizer.match, SubPattern.__getitem__, SubPattern.getwidth (all reaching 1000 guard failures and detaching), with Skipping compilation messages for SubPattern.__init__ + State.__init__. Test is currently @unittest.skip per W-A4-mid sentinel precedent (test exists, currently skipped, will be un-skipped when the underlying bug is fixed and the workload runs clean — at that point this becomes a regression gate). cinderx_dev oracle deferred until devgpu004 SSH-2FA infra restored; per Alex policy "all bugs presumed Phoenix-introduced" the working hypothesis is Phoenix regression, not pre-existing CinderX class. Auth: pythia python#128 python#2 surfacing; generalist 22:05:55Z bug escalation; theologian 22:06:38Z + supervisor 22:06:56Z CONCUR (α) + sentinel commit + W-RE-PARSER-DEOPT-DETACH workstream open.
1 parent 25f0b96 commit 85ed449

1 file changed

Lines changed: 77 additions & 0 deletions

File tree

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
r"""W-RE-PARSER-DEOPT-DETACH sentinel — re._parser JIT correctness
2+
regression discovered via pythia #128 #2 perf seam (generalist
3+
2026-04-24 22:05Z; supervisor-opened workstream 22:06:56Z).
4+
5+
Workload: re.compile() of patterns containing named groups, hammered
6+
across the auto-compile threshold so re._parser:Tokenizer.__next + sibling
7+
parser methods get JIT-compiled by cinderjit.auto().
8+
9+
Observed at HEAD a45aa5b69c (push 50, x86_64 release):
10+
- After ~1000 iterations the JIT auto-compiles re._parser internals.
11+
- Subsequent re.compile() calls either:
12+
(a) raise AttributeError: 'SubPattern' object has no attribute 'state'
13+
(re/_compiler.py:761 reading p.state.groupdict)
14+
(b) SIGSEGV (exit code 139)
15+
- Without JIT (no JIT_ENABLE=1): clean PASS through 2000+ iterations.
16+
17+
Reduction: even a single pattern r'(?P<int>\d+)' is sufficient to
18+
trigger the crash; diverse-pattern corpus also reproduces.
19+
20+
JIT trace messages preceding the failure (cinderjit.auto() context):
21+
Deopt backoff: Tokenizer.__next reached 1000 guard failures, suppressing
22+
detaching JIT from Tokenizer.__next
23+
Deopt backoff: Tokenizer.match reached 1000 guard failures, suppressing
24+
detaching JIT from Tokenizer.match
25+
Skipping compilation of re._parser:SubPattern.__init__
26+
(all STORE_ATTRs generic, no specialised LOAD_ATTRs)
27+
Deopt backoff: SubPattern.__getitem__ reached 1000 guard failures
28+
Deopt backoff: SubPattern.getwidth reached 1000 guard failures
29+
Skipping compilation of re._parser:State.__init__
30+
(all STORE_ATTRs generic, no specialised LOAD_ATTRs)
31+
32+
Two failure modes (AttributeError vs SIGSEGV) suggest UAF / corrupted
33+
attribute storage post-deopt-detach rather than a missing __init__ run
34+
(theologian 22:06:38Z structural read).
35+
36+
W-RE-PARSER-DEOPT-DETACH workstream open per supervisor 22:06:56Z;
37+
investigation pending. cinderx_dev oracle deferred until devgpu004
38+
SSH-2FA infra restored.
39+
40+
This test is currently SKIPPED — uncomment the workload to reproduce
41+
the SIGSEGV / AttributeError. It exists as a sentinel: when
42+
W-RE-PARSER-DEOPT-DETACH is fixed, un-skip and add as regression
43+
gate.
44+
"""
45+
46+
import unittest
47+
48+
49+
class TestREParserJITCrash(unittest.TestCase):
50+
def setUp(self):
51+
try:
52+
import _cinderx # noqa: F401
53+
import cinderjit
54+
self.cinderjit = cinderjit
55+
cinderjit.auto()
56+
except ImportError:
57+
self.skipTest("cinderjit not available")
58+
59+
@unittest.skip(
60+
"W-RE-PARSER-DEOPT-DETACH sentinel — uncomment to reproduce "
61+
"AttributeError/SIGSEGV; un-skip when bug is fixed (sentinel "
62+
"preserved per W-A4-mid sentinel precedent)."
63+
)
64+
def test_named_group_compile_repeated(self):
65+
"""Reduced repro: single named-group pattern, hammered past
66+
the auto-compile threshold so re._parser:Tokenizer.__next +
67+
SubPattern.__getitem__ + .getwidth all hit deopt-backoff +
68+
detach. Subsequent re.compile() either crashes or raises
69+
AttributeError on SubPattern.state."""
70+
import re
71+
for _ in range(2000):
72+
re.compile(r'(?P<int>\d+)')
73+
re.purge()
74+
75+
76+
if __name__ == '__main__':
77+
unittest.main()

0 commit comments

Comments
 (0)