Segmentation fault in `test_call.py` (`c_recurse`) on Linux with Clang (LTO+PGO)

[ashm-dev]

Bug report

Bug description:

Running the CPython test suite results in a segmentation fault during test_call. The crash occurs in Lib/test/test_call.py at line 1081 (c_recurse).

Environment:

• CPython commit: 798070d8ca4 (Mar 14 2026)
• OS: Linux-6.19.6-arch1-1-x86_64-with-glibc2.43 little-endian
• Compiler: Clang 22.1.1 (Target: x86_64-pc-linux-gnu, GCC installation: 15.2.1)

Build command:

CC=clang CXX=clang++ CFLAGS='-march=native' AR=llvm-ar NM=llvm-nm RANLIB=llvm-ranlib LDFLAGS='-fuse-ld=lld' ./configure --enable-optimizations --with-lto=full
make

Output / Traceback:

0:06:59 load avg: 3.73 [117/501] test_call
Fatal Python error: Segmentation fault

Current thread 0x00007f2aa84d5780 [python] (most recent call first):
  File "/home/boss/projects/oss/cpython/main/Lib/test/test_call.py", line 1081 in c_recurse
  File "/home/boss/projects/oss/cpython/main/Lib/test/test_call.py", line 1081 in c_recurse
  File "/home/boss/projects/oss/cpython/main/Lib/test/test_call.py", line 1081 in c_recurse
  File "/home/boss/projects/oss/cpython/main/Lib/test/test_call.py", line 1081 in c_recurse
  File "/home/boss/projects/oss/cpython/main/Lib/test/test_call.py", line 1081 in c_recurse
  File "/home/boss/projects/oss/cpython/main/Lib/test/test_call.py", line 1081 in c_recurse
  File "/home/boss/projects/oss/cpython/main/Lib/test/test_call.py", line 1081 in c_recurse
  File "/home/boss/projects/oss/cpython/main/Lib/test/test_call.py", line 1081 in c_recurse
  File "/home/boss/projects/oss/cpython/main/Lib/test/test_call.py", line 1081 in c_recurse
  File "/home/boss/projects/oss/cpython/main/Lib/test/test_call.py", line 1081 in c_recurse
  File "/home/boss/projects/oss/cpython/main/Lib/test/test_call.py", line 1081 in c_recurse
  File "/home/boss/projects/oss/cpython/main/Lib/test/test_call.py", line 1081 in c_recurse
  File "/home/boss/projects/oss/cpython/main/Lib/test/test_call.py", line 1081 in c_recurse
  File "/home/boss/projects/oss/cpython/main/Lib/test/test_call.py", line 1081 in c_recurse
  File "/home/boss/projects/oss/cpython/main/Lib/test/test_call.py", line 1081 in c_recurse
  File "/home/boss/projects/oss/cpython/main/Lib/test/test_call.py", line 1081 in c_recurse
  File "/home/boss/projects/oss/cpython/main/Lib/test/test_call.py", line 1081 in c_recurse
  File "/home/boss/projects/oss/cpython/main/Lib/test/test_call.py", line 1081 in c_recurse
  File "/home/boss/projects/oss/cpython/main/Lib/test/test_call.py", line 1081 in c_recurse
  File "/home/boss/projects/oss/cpython/main/Lib/test/test_call.py", line 1081 in c_recurse
  File "/home/boss/projects/oss/cpython/main/Lib/test/test_call.py", line 1081 in c_recurse
  File "/home/boss/projects/oss/cpython/main/Lib/test/test_call.py", line 1081 in c_recurse
  File "/home/boss/projects/oss/cpython/main/Lib/test/test_call.py", line 1081 in c_recurse
  File "/home/boss/projects/oss/cpython/main/Lib/test/test_call.py", line 1081 in c_recurse
  File "/home/boss/projects/oss/cpython/main/Lib/test/test_call.py", line 1081 in c_recurse
  File "/home/boss/projects/oss/cpython/main/Lib/test/test_call.py", line 1081 in c_recurse
  File "/home/boss/projects/oss/cpython/main/Lib/test/test_call.py", line 1081 in c_recurse
  File "/home/boss/projects/oss/cpython/main/Lib/test/test_call.py", line 1081 in c_recurse
  File "/home/boss/projects/oss/cpython/main/Lib/test/test_call.py", line 1081 in c_recurse
  File "/home/boss/projects/oss/cpython/main/Lib/test/test_call.py", line 1081 in c_recurse
  File "/home/boss/projects/oss/cpython/main/Lib/test/test_call.py", line 1081 in c_recurse
  File "/home/boss/projects/oss/cpython/main/Lib/test/test_call.py", line 1081 in c_recurse
  File "/home/boss/projects/oss/cpython/main/Lib/test/test_call.py", line 1081 in c_recurse
  File "/home/boss/projects/oss/cpython/main/Lib/test/test_call.py", line 1081 in c_recurse
  File "/home/boss/projects/oss/cpython/main/Lib/test/test_call.py", line 1081 in c_recurse
  File "/home/boss/projects/oss/cpython/main/Lib/test/test_call.py", line 1081 in c_recurse
  File "/home/boss/projects/oss/cpython/main/Lib/test/test_call.py", line 1081 in c_recurse
  File "/home/boss/projects/oss/cpython/main/Lib/test/test_call.py", line 1081 in c_recurse
  File "/home/boss/projects/oss/cpython/main/Lib/test/test_call.py", line 1081 in c_recurse
  File "/home/boss/projects/oss/cpython/main/Lib/test/test_call.py", line 1081 in c_recurse
  File "/home/boss/projects/oss/cpython/main/Lib/test/test_call.py", line 1081 in c_recurse
  File "/home/boss/projects/oss/cpython/main/Lib/test/test_call.py", line 1081 in c_recurse
  File "/home/boss/projects/oss/cpython/main/Lib/test/test_call.py", line 1081 in c_recurse
  File "/home/boss/projects/oss/cpython/main/Lib/test/test_call.py", line 1081 in c_recurse
  File "/home/boss/projects/oss/cpython/main/Lib/test/test_call.py", line 1081 in c_recurse
  File "/home/boss/projects/oss/cpython/main/Lib/test/test_call.py", line 1081 in c_recurse
  File "/home/boss/projects/oss/cpython/main/Lib/test/test_call.py", line 1081 in c_recurse
  File "/home/boss/projects/oss/cpython/main/Lib/test/test_call.py", line 1081 in c_recurse
  File "/home/boss/projects/oss/cpython/main/Lib/test/test_call.py", line 1081 in c_recurse
  File "/home/boss/projects/oss/cpython/main/Lib/test/test_call.py", line 1081 in c_recurse

Current thread's C stack trace (most recent call first):
  Binary file "./python", at _Py_DumpStack+0x3a [0x55753f5efb8a]
  Binary file "./python", at +0x664ab8 [0x55753f5fbab8]
  Binary file "./python", at +0x6649f7 [0x55753f5fb9f7]
  Binary file "/usr/lib/libc.so.6", at +0x3e2d0 [0x7f2aa85162d0]
  Binary file "./python", at _PyEval_EvalFrameDefault+0x14 [0x55753f1bd324]
  Binary file "./python", at _PyFunction_Vectorcall+0x318 [0x55753f1bb408]
  Binary file "./python", at PyObject_Vectorcall+0x3d [0x55753f386dfd]
  Binary file "./python", at _PyEval_EvalFrameDefault+0x25bfa [0x55753f1e2f0a]
  Binary file "./python", at _PyFunction_Vectorcall+0x318 [0x55753f1bb408]
  Binary file "./python", at PyObject_Vectorcall+0x3d [0x55753f386dfd]
  Binary file "./python", at _PyEval_EvalFrameDefault+0x25bfa [0x55753f1e2f0a]
  Binary file "./python", at _PyFunction_Vectorcall+0x318 [0x55753f1bb408]
  Binary file "./python", at PyObject_Vectorcall+0x3d [0x55753f386dfd]
  Binary file "./python", at _PyEval_EvalFrameDefault+0x25bfa [0x55753f1e2f0a]
  Binary file "./python", at _PyFunction_Vectorcall+0x318 [0x55753f1bb408]
  Binary file "./python", at PyObject_Vectorcall+0x3d [0x55753f386dfd]
  Binary file "./python", at _PyEval_EvalFrameDefault+0x25bfa [0x55753f1e2f0a]
  Binary file "./python", at _PyFunction_Vectorcall+0x318 [0x55753f1bb408]
  Binary file "./python", at PyObject_Vectorcall+0x3d [0x55753f386dfd]
  Binary file "./python", at _PyEval_EvalFrameDefault+0x25bfa [0x55753f1e2f0a]
  Binary file "./python", at _PyFunction_Vectorcall+0x318 [0x55753f1bb408]
  Binary file "./python", at PyObject_Vectorcall+0x3d [0x55753f386dfd]
  Binary file "./python", at _PyEval_EvalFrameDefault+0x25bfa [0x55753f1e2f0a]
  Binary file "./python", at _PyFunction_Vectorcall+0x318 [0x55753f1bb408]
  Binary file "./python", at PyObject_Vectorcall+0x3d [0x55753f386dfd]
  Binary file "./python", at _PyEval_EvalFrameDefault+0x25bfa [0x55753f1e2f0a]
  Binary file "./python", at _PyFunction_Vectorcall+0x318 [0x55753f1bb408]
  Binary file "./python", at PyObject_Vectorcall+0x3d [0x55753f386dfd]
  Binary file "./python", at _PyEval_EvalFrameDefault+0x25bfa [0x55753f1e2f0a]
  Binary file "./python", at _PyFunction_Vectorcall+0x318 [0x55753f1bb408]
  Binary file "./python", at PyObject_Vectorcall+0x3d [0x55753f386dfd]
  Binary file "./python", at _PyEval_EvalFrameDefault+0x25bfa [0x55753f1e2f0a]
  <truncated rest of calls>

Extension modules: _testcapi, _testinternalcapi, _testlimitedcapi, _testmultiphase, _testsinglephase, _testbuffer (total: 6)

CPython versions tested on:

3.15, CPython main branch

Operating systems tested on:

Linux

[ashm-dev]

Update:

I have investigated the issue further by isolating the build flags.

• Building with --with-pydebug works as expected.
• Building with --enable-optimizations (without LTO) works as expected.
• Building with LTO=full (without PGO) works as expected.
• Building with LTO (standard) works as expected.

The segmentation fault only occurs when both LTO and PGO are enabled simultaneously (specifically with --enable-optimizations --with-lto=full). It appears that this combination triggers an aggressive inlining optimization by the compiler (Clang 22.1.1) that leads to C-stack overflow during the test_call recursion tests.

UPD: Testing with --with-lto=thin + PGO shows that the segmentation fault persists across all LTO modes when combined with PGO, confirming the issue is specific to the interaction between LTO and PGO optimizations.

[Fidget-Spinner]

Can you try if passing --with-tail-call-interp fixes it? Usually if it does that means a giant function that isn't meant to be inlined in the eval loop is being inlined, and we should mark a Py_NO_INLINE on it.

[ashm-dev]

@Fidget-Spinner Yes, with the --with-tail-call-interp flag enabled, everything runs without a segfault

[ashm-dev]

I tried the --with-tail-call-interp flag as suggested. It indeed resolves the segmentation fault during test_call.

However, it causes a regression in test_perf_profiler (test_python_calls_appear_in_the_stack_if_perf_activated), which fails with an AssertionError. The profiler no longer finds the expected function names (py::bar) in the output, likely because the tail-call interpreter changes the stack frame structure that the profiler relies on.

This confirms that the issue is closely tied to how the eval loop manages function calls and stack frames.

[Fidget-Spinner]

Alright, now it's just a matter of finding which function is responsible :)

[ashm-dev]

@Fidget-Spinner The segfault is reproducible up to and including commit 9a83c02; it is no longer reproducible in subsequent commits.

[ashm-dev]

The issue reproduces from 798070d to 9a83c02, inclusive.

[Fidget-Spinner]

Looks like it's indeed a compiler problem? The commits listed shouldn't affect the interpreter to cause a stack overflow.