Skip to content

Fix stack-use-after-return in test cpp_extension arrayref bindings#183781

Open
jeffdaily wants to merge 1 commit into
mainfrom
jeffdaily/test-cpp-extension-arrayref-uar
Open

Fix stack-use-after-return in test cpp_extension arrayref bindings#183781
jeffdaily wants to merge 1 commit into
mainfrom
jeffdaily/test-cpp-extension-arrayref-uar

Conversation

@jeffdaily
Copy link
Copy Markdown
Collaborator

The two pybind lambdas

m.def("get_intarrayref",   []() { return at::IntArrayRef({1, 2, 3}); });
m.def("get_symintarrayref",[]() { return at::SymIntArrayRef({1, 2, 3}); });

return non-owning ArrayRef views of a std::initializer_list that lives on the lambda's stack. By the time pybind11's type-caster reads the data (e.g. THPUtils_packInt64Array walking the int64_t* to build a Python tuple), the lambda has unwound and the storage is gone. ASAN catches it as stack-use-after-return in test/test_cpp_extensions_aot_*.py::TestPybindTypeCasters::test_pybind_return_types.

Back the values with static storage so the ArrayRef views remain valid for the lifetime of the program. The intent of the test (exercising the type-caster for these two types) is preserved; only the storage class changes.

Authored with Claude.

The two pybind lambdas

    m.def("get_intarrayref",   []() { return at::IntArrayRef({1, 2, 3}); });
    m.def("get_symintarrayref",[]() { return at::SymIntArrayRef({1, 2, 3}); });

return non-owning `ArrayRef` views of a `std::initializer_list` that lives on the lambda's stack. By the time pybind11's type-caster reads the data (e.g. `THPUtils_packInt64Array` walking the `int64_t*` to build a Python tuple), the lambda has unwound and the storage is gone. ASAN catches it as `stack-use-after-return` in `test/test_cpp_extensions_aot_*.py::TestPybindTypeCasters::test_pybind_return_types`.

Back the values with static storage so the `ArrayRef` views remain valid for the lifetime of the program. The intent of the test (exercising the type-caster for these two types) is preserved; only the storage class changes.

Authored with Claude.
@pytorch-bot
Copy link
Copy Markdown

pytorch-bot Bot commented May 14, 2026

🔗 Helpful Links

🧪 See artifacts and rendered test results at hud.pytorch.org/pr/183781

Note: Links to docs will display an error until the docs builds have been completed.

❗ 1 Active SEVs

There are 1 currently active SEVs. If your PR is affected, please view them below:

❌ 1 New Failure, 22 Pending, 1 Unrelated Failure

As of commit 96daecb with merge base a1cc64b (image):

NEW FAILURE - The following job has failed:

FLAKY - The following job failed but was likely due to flakiness present on trunk:

This comment was automatically generated by Dr. CI and updates every 15 minutes.

@pytorch-bot pytorch-bot Bot added the topic: not user facing topic category label May 14, 2026
@jeffdaily jeffdaily added the release notes: cpp release notes category label May 14, 2026
@jeffdaily jeffdaily removed the release notes: cpp release notes category label May 14, 2026
@jeffdaily jeffdaily requested review from albanD and ezyang May 14, 2026 20:55
Copy link
Copy Markdown
Contributor

@ezyang ezyang left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

thanks

@jeffdaily
Copy link
Copy Markdown
Collaborator Author

@pytorchbot merge -i

@pytorch-bot pytorch-bot Bot added the ciflow/trunk Trigger trunk jobs on your pull request label May 15, 2026
@pytorchmergebot
Copy link
Copy Markdown
Collaborator

Merge started

Your change will be merged while ignoring the following 1 checks: pull / linux-jammy-py3.14-clang18 / test (default, 4, 5, linux.4xlarge)

Learn more about merging in the wiki.

Questions? Feedback? Please reach out to the PyTorch DevX Team

Advanced Debugging
Check the merge workflow status
here

@pytorchmergebot
Copy link
Copy Markdown
Collaborator

Merge failed

Reason: 1 mandatory check(s) failed. The first few are:

Dig deeper by viewing the failures on hud

Details for Dev Infra team Raised by workflow job

Failing merge rule: Core Maintainers

@jeffdaily
Copy link
Copy Markdown
Collaborator Author

The lintrunner-noclang-all failure is on torch/_inductor/template_heuristics/triton.py:20 (RUFF F401 unused import + format) — an unrelated pre-existing issue in a file this PR doesn't touch. The changed-file lint runs (lintrunner-noclang-partial / lintrunner-clang-partial) both pass.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

ciflow/trunk Trigger trunk jobs on your pull request open source topic: not user facing topic category

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants