perf trampoline segfaults on UBSan builds

Crash report

Caught on #161278. On a UBSan build ./python -X perf -c pass segfaults at:

Line 464 in 7e3290d

    
           return f(ts, frame, throw, prev_eval_frame != NULL ? prev_eval_frame : _PyEval_EvalFrameDefault);

-fsanitize=function reads a type signature 8 bytes before the called function on every call through a function pointer. The trampoline is machine code copied into an mmap'd buffer and has none. It sits at the start of the buffer, so the 8 bytes before it are unmapped and the read segfaults.

CPython versions tested on:

CPython main branch

Operating systems tested on:

Linux

Output from running 'python -VV' on the command line:

No response

Linked PRs

test_perf_profiler is skipped on most sanitizers, and so it didn't catch this issue:

if support.check_sanitizer(address=True, memory=True, ub=True, function=True):
    # gh-109580: Skip the test because it does crash randomly if Python is
    # built with ASAN.
    raise unittest.SkipTest("test crash randomly on ASAN/MSAN/UBSAN build")

I don't think that it's worth it to bother with testing perf support in test_embed, so I suggest to skip tests on perf_profiling:

diff --git a/Lib/test/test_embed.py b/Lib/test/test_embed.py
index 65feb162b0c..c8cfbcac0fd 100644
--- a/Lib/test/test_embed.py
+++ b/Lib/test/test_embed.py
@@ -1224,7 +1224,6 @@ def test_init_compat_env(self):
             'module_search_paths': self.IGNORE_CONFIG,
             'safe_path': True,
             'int_max_str_digits': 4567,
-            'perf_profiling': 1,
         }
         if Py_STATS:
             config['_pystats'] = 1
@@ -1261,7 +1260,6 @@ def test_init_python_env(self):
             'module_search_paths': self.IGNORE_CONFIG,
             'safe_path': True,
             'int_max_str_digits': 4567,
-            'perf_profiling': 1,
         }
         if Py_STATS:
             config['_pystats'] = True
@@ -1965,7 +1963,6 @@ def test_initconfig_api(self):
             'xoptions': {'faulthandler': True},
             'hash_seed': 10,
             'use_hash_seed': True,
-            'perf_profiling': 2,
         }
         config_dev_mode(preconfig, config)
         # Temporarily enable ignore_stderr=True to ignore warnings on JIT builds
diff --git a/Programs/_testembed.c b/Programs/_testembed.c
index 08bbcd4cfec..8fcb4a92dcb 100644
--- a/Programs/_testembed.c
+++ b/Programs/_testembed.c
@@ -845,7 +845,7 @@ static void set_most_env_vars(void)
 #ifdef Py_STATS
     putenv("PYTHONSTATS=1");
 #endif
-    putenv("PYTHONPERFSUPPORT=1");
+    // gh-161288: Do not set PYTHONPERFSUPPORT since it fails on UBSan builds
 }
 
 
@@ -1724,9 +1724,7 @@ static int test_initconfig_api(void)
         goto error;
     }
 
-    if (PyInitConfig_SetInt(config, "perf_profiling", 2) < 0) {
-        goto error;
-    }
+    // gh-161288: Do not set "perf_profiling" since it fails on UBSan builds
 
     // Set a UTF-8 string (program_name)
     if (PyInitConfig_SetStr(config, "program_name", PROGRAM_NAME_UTF8) < 0) {

The fix is not much bother, and we already have similar macros _Py_NO_SANITIZE_ADDRESS/THREAD/MEMORY.

pythongh-161288: drop the UBSan skip in `test_samply_profiler`

gh-161288: Fix perf trampoline crash on UBSan builds (#161294)

pythongh-161288: retrigger CI

[3.15] gh-161288: Fix perf trampoline crash on UBSan builds (GH-161294)…

[3.14] gh-161288: Fix perf trampoline crash on UBSan builds (GH-161294)…

Thanks for the fix!

Navigation Menu

Repository navigation

perf trampoline segfaults on UBSan builds #161288

Crash report

CPython versions tested on:

Operating systems tested on:

Output from running 'python -VV' on the command line:

Linked PRs

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

perf trampoline segfaults on UBSan builds #161288

Description

Crash report

CPython versions tested on:

Operating systems tested on:

Output from running 'python -VV' on the command line:

Linked PRs

Activity

vstinner commented on Nov 4, 2026

vstinner commented on Nov 4, 2026

NekoAsakura commented on Nov 4, 2026

vstinner commented on Nov 4, 2026

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions