compile("-"*3000000 + "4", '', mode) causes hard crash

[cmcmarrow]

BPO	46110
Nosy	@gvanrossum, @terryjreedy, @ericvsmith, @ambv, @ericsnowcurrently, @serhiy-storchaka, @Kojoley, @lysnikolaou, @pablogsal, @tirkarthi, @sweeneyde, @cmcmarrow
PRs	bpo-46110: Add a recursion check to avoid stack overflow in the PEG parser #30177 [3.10] bpo-46110: Add a recursion check to avoid stack overflow in the PEG parser (GH-30177) #30214 [3.9] bpo-46110: Add a recursion check to avoid stack overflow in the PEG parser (GH-30177) #30215 bpo-46110: Revert "bpo-46110: Add a recursion check to avoid stack overflow in the PEG parser" #30363 bpo-46110: Restore commit 9d35dedc5e7e940b639230fba93c763bd9f19c09 #30366

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = None
closed_at = <Date 2022-01-04.23:00:52.902>
created_at = <Date 2021-12-17.05:22:07.027>
labels = ['interpreter-core', '3.10', '3.9', 'type-crash', '3.11']
title = 'compile("-"*3000000 + "4", \'\', mode) causes hard crash'
updated_at = <Date 2022-01-10.11:42:32.294>
user = 'https://github.com/cmcmarrow'

bugs.python.org fields:

activity = <Date 2022-01-10.11:42:32.294>
actor = 'vstinner'
assignee = 'none'
closed = True
closed_date = <Date 2022-01-04.23:00:52.902>
closer = 'pablogsal'
components = ['Parser']
creation = <Date 2021-12-17.05:22:07.027>
creator = 'charles.mcmarrow.4'
dependencies = []
files = []
hgrepos = []
issue_num = 46110
keywords = ['patch']
message_count = 45.0
messages = ['408753', '408757', '408758', '408781', '408783', '408828', '408829', '408830', '408831', '408833', '408964', '408965', '408967', '409501', '409520', '409522', '409526', '409527', '409533', '409535', '409543', '409544', '409547', '409549', '409553', '409554', '409556', '409593', '409598', '409601', '409606', '409608', '409612', '409613', '409630', '409631', '409635', '409638', '409639', '409705', '409710', '409718', '409737', '410119', '410132']
nosy_count = 12.0
nosy_names = ['gvanrossum', 'terry.reedy', 'eric.smith', 'lukasz.langa', 'eric.snow', 'serhiy.storchaka', 'Kojoley', 'lys.nikolaou', 'pablogsal', 'xtreak', 'Dennis Sweeney', 'charles.mcmarrow.4']
pr_nums = ['30177', '30214', '30215', '30363', '30366']
priority = 'normal'
resolution = 'fixed'
stage = 'resolved'
status = 'closed'
superseder = None
type = 'crash'
url = 'https://bugs.python.org/issue46110'
versions = ['Python 3.9', 'Python 3.10', 'Python 3.11']

[cmcmarrow]

eval("-"*3000000 + "4") in cmd causes hard crash

[ericvsmith]

In case it helps track this down. On my system I've tested these two setups:

On Windows, on the main branch, python just exists with no message when I run this from the REPL.

Also on Windows, with the Cygwin 3.8.12 version, I get MemoryError:

Python 3.8.12 (default, Nov 23 2021, 20:18:25)
[GCC 11.2.0] on cygwin
Type "help", "copyright", "credits" or "license" for more information.
>>> eval("-"*3000000 + "4")
s_push: parser stack overflow
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
MemoryError

Those are the only two systems I have available to test with.

[sweeneyde]

This is the top of the stacktrace I got on Windows in Visual Studio:

ucrtbased.dll!00007ff9096d8ea8()	Unknown
ucrtbased.dll!00007ff9096d727c()	Unknown
ucrtbased.dll!00007ff9096d6f69()	Unknown
ucrtbased.dll!00007ff9096d70b3()	Unknown
ucrtbased.dll!00007ff9096d72e9()	Unknown
ucrtbased.dll!00007ff9096cef0c()	Unknown
ucrtbased.dll!00007ff9096cf446()	Unknown

python311_d.dll!tok_get(tok_state * tok, const char * * p_start, const char * * p_end) Line 1699 C
python311_d.dll!_PyTokenizer_Get(tok_state * tok, const char * * p_start, const char * * p_end) Line 2061 C
python311_d.dll!_PyPegen_fill_token(Parser * p) Line 223 C
python311_d.dll!_PyPegen_is_memoized(Parser * p, int type, void * pres) Line 309 C
python311_d.dll!factor_rule(Parser * p) Line 12622 C
python311_d.dll!factor_rule(Parser * p) Line 12682 C
python311_d.dll!factor_rule(Parser * p) Line 12682 C
python311_d.dll!factor_rule(Parser * p) Line 12682 C
python311_d.dll!factor_rule(Parser * p) Line 12682 C
python311_d.dll!factor_rule(Parser * p) Line 12682 C
python311_d.dll!factor_rule(Parser * p) Line 12682 C
python311_d.dll!factor_rule(Parser * p) Line 12682 C
python311_d.dll!factor_rule(Parser * p) Line 12682 C
python311_d.dll!factor_rule(Parser * p) Line 12682 C
python311_d.dll!factor_rule(Parser * p) Line 12682 C
python311_d.dll!factor_rule(Parser * p) Line 12682 C
...

[tirkarthi]

See also https://bugs.python.org/issue32758

[tirkarthi]

https://bugs.python.org/issue42609 too

[terryjreedy]

Windows, IDLE, 3.10.1: compile("-"*3000000 + "4", '', mode) crashes execution process for any of 'exec', 'eval', 'single'.

bpo-42609 is also about 'too high' string multiplication with new compilet, though the exact breaking point in crash dumps seems different.

[pablogsal]

This is a stack overflow in the parser, unfortunately, which unfortunately is very difficult to defend against.