[3.12] GH-105840: Fix assertion failures when specializing calls with too many __defaults__ (GH-105863)

miss-islington · brandtbucher · web-flow · commit 560adb01f970 · 2023-06-16T18:29:55.000Z
GH-105840: Fix assertion failures when specializing calls with too many __defaults__ (GH-105847) (cherry picked from commit 2beab5b) Co-authored-by: Brandt Bucher <brandtbucher@microsoft.com>
diff --git a/Lib/test/test_opcache.py b/Lib/test/test_opcache.py
@@ -452,6 +452,35 @@ def f():
             self.assertFalse(f())
 
 
+class TestCallCache(unittest.TestCase):
+    def test_too_many_defaults_0(self):
+        def f():
+            pass
+
+        f.__defaults__ = (None,)
+        for _ in range(1025):
+            f()
+
+    def test_too_many_defaults_1(self):
+        def f(x):
+            pass
+
+        f.__defaults__ = (None, None)
+        for _ in range(1025):
+            f(None)
+            f()
+
+    def test_too_many_defaults_2(self):
+        def f(x, y):
+            pass
+
+        f.__defaults__ = (None, None, None)
+        for _ in range(1025):
+            f(None, None)
+            f(None)
+            f()
+
+
 if __name__ == "__main__":
     import unittest
     unittest.main()
diff --git a/Misc/NEWS.d/next/Core and Builtins/2023-06-15-22-11-43.gh-issue-105840.Fum_g_.rst b/Misc/NEWS.d/next/Core and Builtins/2023-06-15-22-11-43.gh-issue-105840.Fum_g_.rst
@@ -0,0 +1,2 @@
+Fix possible crashes when specializing function calls with too many
+``__defaults__``.
diff --git a/Python/specialize.c b/Python/specialize.c
@@ -1666,9 +1666,9 @@ specialize_py_call(PyFunctionObject *func, _Py_CODEUNIT *instr, int nargs,
     }
     int argcount = code->co_argcount;
     int defcount = func->func_defaults == NULL ? 0 : (int)PyTuple_GET_SIZE(func->func_defaults);
-    assert(defcount <= argcount);
     int min_args = argcount-defcount;
-    if (nargs > argcount || nargs < min_args) {
+    // GH-105840: min_args is negative when somebody sets too many __defaults__!
+    if (min_args < 0 || nargs > argcount || nargs < min_args) {
         SPECIALIZATION_FAIL(CALL, SPEC_FAIL_WRONG_NUMBER_ARGUMENTS);
         return -1;
     }

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,2 @@`
	`1`	`+Fix possible crashes when specializing function calls with too many`
	`2`	+``__defaults__``.
Original file line number	Diff line number	Diff line change
`@@ -1666,9 +1666,9 @@ specialize_py_call(PyFunctionObject func, _Py_CODEUNIT instr, int nargs,`
`1666`	`1666`	`}`
`1667`	`1667`	`int argcount = code->co_argcount;`
`1668`	`1668`	`int defcount = func->func_defaults == NULL ? 0 : (int)PyTuple_GET_SIZE(func->func_defaults);`
`1669`		`- assert(defcount <= argcount);`
`1670`	`1669`	`int min_args = argcount-defcount;`
`1671`		`- if (nargs > argcount \|\| nargs < min_args) {`
	`1670`	`+ // GH-105840: min_args is negative when somebody sets too many __defaults__!`
	`1671`	`+ if (min_args < 0 \|\| nargs > argcount \|\| nargs < min_args) {`
`1672`	`1672`	`SPECIALIZATION_FAIL(CALL, SPEC_FAIL_WRONG_NUMBER_ARGUMENTS);`
`1673`	`1673`	`return -1;`
`1674`	`1674`	`}`