debug_traceBlockByNumber / debug_traceTransaction with callTracer can panic in v2.7.3

[jonathanudd]

System information

Geth version: Geth/v2.7.3/linux-amd64/go1.25.5

OS & Version: Linux

Commit hash : release tag v2.7.3

Arguments:
--datadir=<...> --http.addr=0.0.0.0 --http.api=eth,net,web3,debug,txpool --http.corsdomain=* --http.vhosts=* --ws.addr=0.0.0.0 --ws.api=eth,net,web3,debug,txpool --ws.origins=*
--metrics.addr=0.0.0.0 --metrics.port=6060 --gcmode=archive --syncmode=full --cache=2048 --http --http.port=8545 --ws --ws.port=8546 --metrics --port=<...>

Description

• Steps to reproduce the behaviour

Run callTracer against block 0x1:

curl --location '<RPC_URL>'
--header 'Content-Type: application/json'
--data '{"method":"debug_traceBlockByNumber","params":["0x1", {"tracer":"callTracer"}],"id":1,"jsonrpc":"2.0"}'

Or reproduce on the specific transaction that fails:

curl --location '<RPC_URL>'
--header 'Content-Type: application/json'
--data '{"method":"debug_traceTransaction","params":["0x321adce8d5f7ec7db9d4ac842f056f7803976679b8105aceb80360924429cb35", {"tracer":"callTracer"}],"id":1,"jsonrpc":"2.0"}'

Control case on the same transaction with the default tracer:

curl --location '<RPC_URL>'
--header 'Content-Type: application/json'
--data '{"method":"debug_traceTransaction","params":["0x321adce8d5f7ec7db9d4ac842f056f7803976679b8105aceb80360924429cb35", {}],"id":1,"jsonrpc":"2.0"}'

Observed scope:

• this started after upgrading from v2.6.0 to v2.7.3
• default tracing still works
• prestateTracer works
• 4byteTracer works
• callTracer works for many transactions, but crashes on specific ones
• Expected behaviour

callTracer should return a normal trace result for the block/transaction, or at least return a handled RPC error without crashing the method handler.

• Actual behaviour

The RPC returns:

{"jsonrpc":"2.0","id":1,"error":{"code":-32603,"message":"method handler crashed"}}

The same transaction succeeds with the default tracer.

This looks like a regression in the callTracer hook-based path introduced in v2.7.3. The panic shows callTracer.OnTxEnd indexing t.callstack[0] when the callstack is empty.

Backtrace

ERROR[04-08|15:00:31.484] RPC method debug_traceBlockByNumber crashed: runtime error: index out of range [0] with length 0
goroutine 17383 [running]:
github.com/ethereum/go-ethereum/rpc.(*callback).call.func1()
github.com/ethereum/go-ethereum/rpc/service.go:199 +0xb9
panic({0x3c9e420?, 0xc00bf640f0?})
runtime/panic.go:783 +0x136
github.com/ethereum/go-ethereum/eth/tracers/native.(*callTracer).OnTxEnd(0xc00ec2b810, 0xc02790ef00, {0x0, 0x0})
github.com/ethereum/go-ethereum/eth/tracers/native/call.go:229 +0xa5
github.com/ethereum/go-ethereum/core.ApplyTransactionWithEVM.func2()
github.com/ethereum/go-ethereum/core/state_processor.go:214 +0x48
github.com/ethereum/go-ethereum/core.ApplyTransactionWithEVM(0xc01856a9c0, 0xc0118fdbb8, 0xc00e3524e0, 0xc00a8fbb20, {0x0, 0x8f, 0x5a, 0x89, 0x5a, 0x74, ...}, ...)
github.com/ethereum/go-ethereum/core/state_processor.go:238 +0x6d5
github.com/ethereum/go-ethereum/eth/tracers.(*API).traceTx(0xc0013909c0, {0x4bffdc8, 0xc01463b360}, 0xc02afa1a80, 0xc01856a9c0, 0xc00ec2b7c0, {0x4a22368, 0x4a22378, 0xc01157e330, {0x20, .
..}, ...}, ...)
github.com/ethereum/go-ethereum/eth/tracers/api.go:1247 +0xa96
github.com/ethereum/go-ethereum/eth/tracers.(*API).traceBlock(0xc0013909c0, {0x4bffdc8, 0xc01463b360}, 0xc01856a180, 0xc02afa1840)
github.com/ethereum/go-ethereum/eth/tracers/api.go:731 +0x130d
github.com/ethereum/go-ethereum/eth/tracers.(*API).TraceBlockByNumber(0xc0013909c0, {0x4bffdc8, 0xc01463b360}, 0x1, 0xc02afa1840)
github.com/ethereum/go-ethereum/eth/tracers/api.go:489 +0x178
reflect.Value.call({0xc0002671f0, 0xc001446dd0, 0x13}, {0x3e79ee5, 0x4}, {0xc0452e0240, 0x4, 0x4})
reflect/value.go:581 +0xe71
reflect.Value.Call({0xc0002671f0, 0xc001446dd0, 0x13}, {0xc0452e0240, 0x4, 0x4})
reflect/value.go:365 +0xb3
github.com/ethereum/go-ethereum/rpc.(*callback).call(0xc00714fec0, {0x4bffdc8, 0xc01463b360}, {0xc00bf657b8, 0x18}, {0xc00ca7c390, 0x2, 0x2})
github.com/ethereum/go-ethereum/rpc/service.go:205 +0x539
github.com/ethereum/go-ethereum/rpc.(*handler).runMethod(0xc033a260a0, {0x4bffdc8, 0xc01463b360}, 0xc046a19260, 0xc00714fec0, {0xc00ca7c390, 0x2, 0x2})
github.com/ethereum/go-ethereum/rpc/handler.go:593 +0xcc
github.com/ethereum/go-ethereum/rpc.(*handler).handleCall(0xc033a260a0, 0xc00e319ec0, 0xc046a19260)
github.com/ethereum/go-ethereum/rpc/handler.go:534 +0x54f
github.com/ethereum/go-ethereum/rpc.(*handler).handleCallMsg(0xc033a260a0, 0xc00e319ec0, {0x4bffd90, 0xc00e318e70}, 0xc046a19260)
github.com/ethereum/go-ethereum/rpc/handler.go:480 +0x271
github.com/ethereum/go-ethereum/rpc.(*handler).handleNonBatchCall(0xc033a260a0, 0xc00e319ec0, {0x4bffd90, 0xc00e318e70}, 0xc046a19260)
github.com/ethereum/go-ethereum/rpc/handler.go:306 +0x332
github.com/ethereum/go-ethereum/rpc.(*handler).handleMsg.func1.1(0xc00e319ec0)
github.com/ethereum/go-ethereum/rpc/handler.go:279 +0x50
github.com/ethereum/go-ethereum/rpc.(*handler).startCallProc.func1()
github.com/ethereum/go-ethereum/rpc/handler.go:397 +0x1fb
github.com/panjf2000/ants/v2.(*goWorker).run.func1()
github.com/panjf2000/ants/v2@v2.4.5/worker.go:70 +0xce
created by github.com/panjf2000/ants/v2.(*goWorker).run in goroutine 17332
github.com/panjf2000/ants/v2@v2.4.5/worker.go:48 +0x72