gh-146442: Fix various bugs in compiler pipeline (#146443)

A0su · web-flow · commit ca95e979d6c9 · 2026-03-30T22:04:04.000+02:00
Fix null derefs, missing decrefs, and unchecked returns from bug report.
diff --git a/Python/assemble.c b/Python/assemble.c
@@ -418,6 +418,7 @@ assemble_emit_instr(struct assembler *a, instruction *instr)
     int size = instr_size(instr);
     if (a->a_offset + size >= len / (int)sizeof(_Py_CODEUNIT)) {
         if (len > PY_SSIZE_T_MAX / 2) {
+            PyErr_NoMemory();
             return ERROR;
         }
         RETURN_IF_ERROR(_PyBytes_Resize(&a->a_bytecode, len * 2));
diff --git a/Python/codegen.c b/Python/codegen.c
@@ -667,8 +667,8 @@ codegen_unwind_fblock_stack(compiler *c, location *ploc,
     _PyCompile_PopFBlock(c, top->fb_type, top->fb_block);
     RETURN_IF_ERROR(codegen_unwind_fblock(c, ploc, &copy, preserve_tos));
     RETURN_IF_ERROR(codegen_unwind_fblock_stack(c, ploc, preserve_tos, loop));
-    _PyCompile_PushFBlock(c, copy.fb_loc, copy.fb_type, copy.fb_block,
-                          copy.fb_exit, copy.fb_datum);
+    RETURN_IF_ERROR(_PyCompile_PushFBlock(c, copy.fb_loc, copy.fb_type, copy.fb_block,
+                          copy.fb_exit, copy.fb_datum));
     return SUCCESS;
 }
 
@@ -715,10 +715,14 @@ codegen_setup_annotations_scope(compiler *c, location loc,
 
     // if .format > VALUE_WITH_FAKE_GLOBALS: raise NotImplementedError
     PyObject *value_with_fake_globals = PyLong_FromLong(_Py_ANNOTATE_FORMAT_VALUE_WITH_FAKE_GLOBALS);
+    if (value_with_fake_globals == NULL) {
+        return ERROR;
+    }
+
     assert(!SYMTABLE_ENTRY(c)->ste_has_docstring);
     _Py_DECLARE_STR(format, ".format");
     ADDOP_I(c, loc, LOAD_FAST, 0);
-    ADDOP_LOAD_CONST(c, loc, value_with_fake_globals);
+    ADDOP_LOAD_CONST_NEW(c, loc, value_with_fake_globals);
     ADDOP_I(c, loc, COMPARE_OP, (Py_GT << 5) | compare_masks[Py_GT]);
     NEW_JUMP_TARGET_LABEL(c, body);
     ADDOP_JUMP(c, loc, POP_JUMP_IF_FALSE, body);
@@ -794,6 +798,9 @@ codegen_deferred_annotations_body(compiler *c, location loc,
         if (!mangled) {
             return ERROR;
         }
+        // NOTE: ref of mangled can be leaked on ADDOP* and VISIT macros due to early returns
+        // fixing would require an overhaul of these macros
+
         PyObject *cond_index = PyList_GET_ITEM(conditional_annotation_indices, i);
         assert(PyLong_CheckExact(cond_index));
         long idx = PyLong_AS_LONG(cond_index);
@@ -3279,7 +3286,10 @@ codegen_nameop(compiler *c, location loc,
     }
 
     int scope = _PyST_GetScope(SYMTABLE_ENTRY(c), mangled);
-    RETURN_IF_ERROR(scope);
+    if (scope == -1) {
+        goto error;
+    }
+
     _PyCompile_optype optype;
     Py_ssize_t arg = 0;
     if (_PyCompile_ResolveNameop(c, mangled, scope, &optype, &arg) < 0) {
diff --git a/Python/compile.c b/Python/compile.c
@@ -1100,18 +1100,22 @@ _PyCompile_TweakInlinedComprehensionScopes(compiler *c, location loc,
                 assert(orig == NULL || orig == Py_True || orig == Py_False);
                 if (orig != Py_True) {
                     if (PyDict_SetItem(c->u->u_metadata.u_fasthidden, k, Py_True) < 0) {
+                        Py_XDECREF(orig);
                         return ERROR;
                     }
                     if (state->fast_hidden == NULL) {
                         state->fast_hidden = PySet_New(NULL);
                         if (state->fast_hidden == NULL) {
+                            Py_XDECREF(orig);
                             return ERROR;
                         }
                     }
                     if (PySet_Add(state->fast_hidden, k) < 0) {
+                        Py_XDECREF(orig);
                         return ERROR;
                     }
                 }
+                Py_XDECREF(orig);
             }
         }
     }

Original file line number	Diff line number	Diff line change
`@@ -418,6 +418,7 @@ assemble_emit_instr(struct assembler a, instruction instr)`
`418`	`418`	`int size = instr_size(instr);`
`419`	`419`	`if (a->a_offset + size >= len / (int)sizeof(_Py_CODEUNIT)) {`
`420`	`420`	`if (len > PY_SSIZE_T_MAX / 2) {`
	`421`	`+ PyErr_NoMemory();`
`421`	`422`	`return ERROR;`
`422`	`423`	`}`
`423`	`424`	`RETURN_IF_ERROR(_PyBytes_Resize(&a->a_bytecode, len * 2));`
Original file line number	Diff line number	Diff line change
`@@ -1100,18 +1100,22 @@ _PyCompile_TweakInlinedComprehensionScopes(compiler *c, location loc,`
`1100`	`1100`	`assert(orig == NULL \|\| orig == Py_True \|\| orig == Py_False);`
`1101`	`1101`	`if (orig != Py_True) {`
`1102`	`1102`	`if (PyDict_SetItem(c->u->u_metadata.u_fasthidden, k, Py_True) < 0) {`
	`1103`	`+ Py_XDECREF(orig);`
`1103`	`1104`	`return ERROR;`
`1104`	`1105`	`}`
`1105`	`1106`	`if (state->fast_hidden == NULL) {`
`1106`	`1107`	`state->fast_hidden = PySet_New(NULL);`
`1107`	`1108`	`if (state->fast_hidden == NULL) {`
	`1109`	`+ Py_XDECREF(orig);`
`1108`	`1110`	`return ERROR;`
`1109`	`1111`	`}`
`1110`	`1112`	`}`
`1111`	`1113`	`if (PySet_Add(state->fast_hidden, k) < 0) {`
	`1114`	`+ Py_XDECREF(orig);`
`1112`	`1115`	`return ERROR;`
`1113`	`1116`	`}`
`1114`	`1117`	`}`
	`1118`	`+ Py_XDECREF(orig);`
`1115`	`1119`	`}`
`1116`	`1120`	`}`
`1117`	`1121`	`}`