Tachyon sample dump/replay crashes #144336

Activity

1. hauntsaninja

   added

   type-bugAn unexpected behavior, bug, or errorAn unexpected behavior, bug, or error

   on Jan 30, 2026
2. hauntsaninja

   changed the title [-]Tachyon sample dump/replay has issue with bad filename[/-] [+]Tachyon sample dump/replay crashes[/+] on Jan 30, 2026
3. johnslavik

   added

   topic-profiling

   on Jan 30, 2026
4. StanFromIreland

   added

   stdlibStandard Library Python modules in the Lib/ directoryStandard Library Python modules in the Lib/ directory

   on Jan 30, 2026
5. StanFromIreland commented on Jan 30, 2026

   

   StanFromIreland

   on Jan 30, 2026

   Member

   More actions

   Maybe after reading the filename in parse_code_object, we should check the content and not just the length? WDYT @pablogsal
6. pablogsal commented on Jan 30, 2026

   

   pablogsal

   on Jan 30, 2026

   Member

   More actions

   Don't yet have a minimal repro, but maybe the issue is apparent to you

   Unfortunately not :(

   If you could have a repro or you can send over the file that would be amazing!
7. pablogsal commented on Jan 30, 2026

   

   pablogsal

   on Jan 30, 2026

   Member

   More actions

   Oh wait this is opening a python file:

     File "/.../lib/python3.15/profiling/sampling/heatmap_collector.py", line 905, in _generate_file_html
       source_lines = Path(filename).read_text(encoding='utf-8', errors='replace').splitlines()
                      ~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
     File "/.../lib/python3.15/pathlib/__init__.py", line 985, in read_text
       with self.open(mode='r', encoding=encoding, errors=errors, newline=newline) as f:
            ~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
     File "/.../lib/python3.15/pathlib/__init__.py", line 969, in open
       return io.open(self, mode, buffering, encoding, errors, newline)
              ~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
   ValueError: embedded null byte
   

   It's here:

   cpython/Lib/profiling/sampling/heatmap_collector.py

   Line 905 in 96e4cd6

   source_lines = Path(filename).read_text(encoding='utf-8', errors='replace').splitlines()

   Is not the result file is just a python file!
8. pablogsal commented on Jan 30, 2026

   

   pablogsal

   on Jan 30, 2026

   Member

   More actions

   Ah damn, ok, the filename comes from stat.filename. Yeah I think i still would like to see at least the file

   👍React with 👍1Reacted by Shantanu
9. hauntsaninja commented on Feb 2, 2026

   

   hauntsaninja

   on Feb 2, 2026

   Last edited by hauntsaninja

   ContributorAuthor

   More actions

   Let me try to figure out a repro or shareable dump.

   In the meantime, here's something maybe useful from the bad file I have:

   >>> collector = CollapsedStackCollector(interval)
   >>> count = reader.replay_samples(collector, None)
   >>> next(k for k in collector.stack_counter if r"\x00" in repr(k))
   ((<many tuples of (filename, lineno, func)>, ('\x00', 0, '`@')), 17992827)
   

   There is a second instance as well. That one is:

   >>> [k for k in collector.stack_counter if r"\x00" in repr(k)][1]
   ((<many tuples of (filename, lineno, func)>, ('\x00', 0, 'P'), (filename, lineno, func)), 17992827)
   
10. pablogsal commented on Feb 3, 2026

    

    pablogsal

    on Feb 3, 2026

    Member

    More actions

    @hauntsaninja can you try to apply this diff and see if it reproduces?

    diff --git a/Modules/_remote_debugging/object_reading.c b/Modules/_remote_debugging/object_reading.c
    index 447b7fd5926..36503f4be5d 100644
    --- a/Modules/_remote_debugging/object_reading.c
    +++ b/Modules/_remote_debugging/object_reading.c
    @@ -87,6 +87,15 @@ read_py_str(
         }
         buf[len] = '\0';
    
    +    // Reject garbage: valid Python identifier strings (filenames, function names)
    +    // should not contain null bytes. This detects corrupted memory from reading
    +    // stale pointers that point to freed/reallocated memory.
    +    if (memchr(buf, '\0', len) != NULL) {
    +        set_exception_cause(unwinder, PyExc_RuntimeError,
    +            "String contains null byte (likely corrupted memory)");
    +        goto err;
    +    }
    +
         result = PyUnicode_FromStringAndSize(buf, len);
         if (result == NULL) {
             set_exception_cause(unwinder, PyExc_RuntimeError, "Failed to create PyUnicode from remote string data");
11. ivonastojanovic commented on Oct 23, 2026

    

    ivonastojanovic

    on Oct 23, 2026

    Contributor

    More actions

    Closing this one since this was fixed in #158853.
12. ivonastojanovic

    closed this as completedon Oct 23, 2026