Movatterモバイル変換


[0]ホーム

URL:


Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Sign up
Appearance settings

Segfault during deallocation of_elementtree.XMLParser #111784

Closed
Labels
3.12only security fixes3.13bugs and security fixesextension-modulesC modules in the Modules dirrelease-blockertopic-XMLtype-crashA hard crash of the interpreter, possibly with a core dump
@mgorny

Description

@mgorny

Crash report

What happened?

I've originally hit it while runningslixmpp's test suite. I've been able to reduce it to the following program:

importasyncioimportxml.etree.ElementTreeasETfromtypingimportOptionaldefset_see_other_host()->Optional[ET.Element]:passclassXMLStream:defdisconnect(self):asyncio.ensure_future(self._end_stream_wait())asyncdef_end_stream_wait(self):awaitasyncio.wait_for(asyncio.Future(),1)def_remove_schedules(self):passparser=ET.XMLPullParser()xmpp=XMLStream()foo=xmpp._remove_schedulesxmpp.disconnect()loop=asyncio.get_event_loop()loop.run_until_complete(asyncio.Queue().join())

I've been able to reproduce this with 3.12.0, and the tips of 3.12 and main branches. I've been able to bisect it to the following commit:

commit 1b5a2b085c28d230c9ef9bd9b472afc85e087cedAuthor:     Kumar Aditya <59607654+kumaraditya303@users.noreply.github.com>AuthorDate: 2023-05-17 01:35:07 +0200Commit:     GitHub <noreply@github.com>CommitDate: 2023-05-17 01:35:07 +0200    GH-103092: isolate `_elementtree` (#104561)

Backtrace:

(gdb) bt#0  0x00007f9da2d8611c in xmlparser_gc_clear (self=0x7f9da2617760) at ./Modules/_elementtree.c:3784#1  0x00007f9da2d86857 in xmlparser_dealloc (self=0x7f9da2617760) at ./Modules/_elementtree.c:3809#2  0x0000559a2edd2145 in _Py_Dealloc (op=0x7f9da2617760) at Objects/object.c:2858#3  0x0000559a2edae16d in Py_DECREF (op=0x7f9da2617760) at ./Include/object.h:879#4  Py_XDECREF (op=0x7f9da2617760) at ./Include/object.h:972#5  0x0000559a2edbbadb in _PyObject_FreeInstanceAttributes (self=0x7f9da3146d20) at Objects/dictobject.c:5646#6  0x0000559a2ee03a71 in subtype_dealloc (self=0x7f9da3146d20) at Objects/typeobject.c:2064#7  0x0000559a2edd2145 in _Py_Dealloc (op=0x7f9da3146d20) at Objects/object.c:2858#8  0x0000559a2edae16d in Py_DECREF (op=0x7f9da3146d20) at ./Include/object.h:879#9  Py_XDECREF (op=0x7f9da3146d20) at ./Include/object.h:972#10 0x0000559a2edafbef in free_keys_object (interp=0x559a2f2a73a8 <_PyRuntime+76872>, keys=0x7f9da26c9ac0) at Objects/dictobject.c:675#11 0x0000559a2edaef84 in dictkeys_decref (interp=0x559a2f2a73a8 <_PyRuntime+76872>, dk=0x7f9da26c9ac0) at Objects/dictobject.c:335#12 0x0000559a2edb31e2 in PyDict_Clear (op=0x7f9da322ba00) at Objects/dictobject.c:2120#13 0x0000559a2edb7a1e in dict_tp_clear (op=0x7f9da322ba00) at Objects/dictobject.c:3588#14 0x0000559a2efb69ec in delete_garbage (tstate=0x559a2f30ce28 <_PyRuntime+493256>, gcstate=0x559a2f2a7798 <_PyRuntime+77880>,     collectable=0x7ffffccdee70, old=0x559a2f2a77e0 <_PyRuntime+77952>) at Modules/gcmodule.c:1033#15 0x0000559a2efb707c in gc_collect_main (tstate=0x559a2f30ce28 <_PyRuntime+493256>, generation=2, n_collected=0x0,     n_uncollectable=0x0, nofail=1) at Modules/gcmodule.c:1313#16 0x0000559a2efb8a1e in _PyGC_CollectNoFail (tstate=0x559a2f30ce28 <_PyRuntime+493256>) at Modules/gcmodule.c:2154#17 0x0000559a2ef74d80 in finalize_modules (tstate=0x559a2f30ce28 <_PyRuntime+493256>) at Python/pylifecycle.c:1677#18 0x0000559a2ef751cb in Py_FinalizeEx () at Python/pylifecycle.c:1931#19 0x0000559a2efb4ced in Py_RunMain () at Modules/main.c:709#20 0x0000559a2efb4d9f in pymain_main (args=0x7ffffccdefd0) at Modules/main.c:737#21 0x0000559a2efb4e5f in Py_BytesMain (argc=2, argv=0x7ffffccdf138) at Modules/main.c:761#22 0x0000559a2eccc885 in main (argc=2, argv=0x7ffffccdf138) at ./Programs/python.c:15

CC@kumaraditya303

CPython versions tested on:

3.12, CPython main branch

Operating systems tested on:

Linux

Output from running 'python -VV' on the command line:

Python 3.13.0a1+ (heads/main:ba8aa1fd37, Nov 6 2023, 16:26:31) [GCC 13.2.1 20231014]

Linked PRs

Metadata

Metadata

Assignees

No one assigned

    Labels

    3.12only security fixes3.13bugs and security fixesextension-modulesC modules in the Modules dirrelease-blockertopic-XMLtype-crashA hard crash of the interpreter, possibly with a core dump

    Projects

    Status

    Done

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions


      [8]ページ先頭

      ©2009-2025 Movatter.jp