remove_unreachable: Assertion `target->b_predecessors == 0 || target == b->b_next' failed

[15r10nk]

Crash report

What happened?

The following code causes an assertion in a cpython debug build

name_3=5
name_2=2
name_1=0

while name_3 <= name_2 > name_1:
    try:
        raise
    except:
        pass
    finally:
        pass

output (Python 3.13.0a5+):

python3: Python/flowgraph.c:994: remove_unreachable: Assertion `target->b_predecessors == 0 || target == b->b_next' failed.

The bug is in the current 3.13 branch.
I bisected the problem down to 04697bc
@iritkatriel I think this is again one for you.

Little side note. I found this bug after fuzzing for ~3 days. I want to start to test the cpython main branch in the future and I hope to find bugs like this earlier.

CPython versions tested on:

3.13

Operating systems tested on:

No response

Output from running 'python -VV' on the command line:

No response

Linked PRs

• gh-124871: fix 'visited' tracking in compiler's reachability analysis #124952
• [3.13] gh-124871: fix 'visited' tracking in compiler's reachability analysis (GH-124952) #124977

[iritkatriel]

This bug went away with fe23f8e.

[iritkatriel]

The issue here is that we have a small basicblock which has SETUP_FINALLY instructions and is reachable from two other blocks via jumps - one conditional and one unconditional. The inline_small_or_no_lineno_blocks function inlines this block where it called unconditionally, but not where it's called conditionally. So the block remains, and is reachable, and when reachability calculation follows the SETUP_FINALLY target of the second time, this assertion trips.

I need to figure out whether the assertion is wrong or it's something else.

[iritkatriel]

I need to figure out whether the assertion is wrong it's or something else.

The assertion is wrong. The reason it was added was because this function marks blocks as visited when they are processed, and not when they are inserted to the queue (as other traversals do). The assertion ensured that we don't enter the same block to the queue more than once. The PR changes it to mark blocks as visited as soon as they are inserted to the queue, and remove the assertion.

[15r10nk]

awesome, thank you.