Bug report

Bug description:

The segfault described here is related toPEP-667 andPEP-709.

I think I experienced a couple of similar but not same segfaults, and this here is just one of a few of them. I might be wrong though.
I'd like to start working on fixing this in order to possibly find more unhappy paths.

Reproduction

Here are a bunch of reproductions:

deff():lambda:kk:int    [kforkin [0]iflocals()]f()

deff():lambda:kk= [sys._getframe(0).f_locals["k"]forkin [0]]f()

deff():lambda:kk=1    [eval("")forkin [0]]f()

@alexmojaki also found

deff():lambda:kk=1    [locals()forkin [0]]f()

deff():lambda:kk:int    [locals()forkin [0]]f()

This one shows the problem the best:

deffetch_locals_proxy():# anything that fetches PEP 667 FrameLocalsProxy contents# causes the crashsys._getframe(1).f_locals.items()deff():lambda:kk=1    [fetch_locals_proxy()forkin [0]]f()

Traceback

Fatal Python error: Segmentation faultCurrent thread 0x00007fd059596740 (most recent call first):  File "/tmp/repro/dump-1.py", line 9 in fetch_locals_proxy  File "/tmp/repro/dump-1.py", line 14 in f  File "/tmp/repro/dump-1.py", line 17 in <module>Segmentation fault (core dumped)

Conclusions

1. There must be a statement that allows to create a closure for a variable, for instancek, in a scope ("target scope"). It's eitherk = ... ork: int in the repros.

2. There must be an inlined comprehensionthat bindsk as target (e.g.k = 1; [x for x in [0] if locals()] doesn't cause segfault).

3. After binding the variable during the evaluation of the inlined comprehension, something must fetch the contents of the PEP 667 proxy of the target scope.

4. The target scope must be anyoptimized scope (not confirmed for generator expressions), since only those involvePEP 667FrameLocalsProxy. That's the reason why the crash doesn't happen at a module/class level:

   classSpam:lambda:kk= [kforkin [0]iflocals()]

   or on Python <3.13, before PEP 667 had been introduced.

5. The iterable traversed in the comprehension isn't special (the crash doesn't happen for certain objects, e.g.[None]¹,(...,), but happens for others, e.g.[0],range(1)). Not confirmed for every platform.

Thanks@Eclips4 for hints to finding the best reproduction. Thanks@trag1c for reporting the problem after accidentally running into it in a real-life use case.

I'm delighted to accept any help or guidance (cc@JelleZijlstra@carljm), as I want to author the patch to fix this issue and learn something in the process. Thanks!

CPython versions tested on:

3.13, 3.14, CPython main branch

Operating systems tested on:

Linux

Linked PRs

• gh-128396: Fix a crash when inline comprehension has the same local variable as the outside scope #130235
• [3.13] gh-128396: Fix a crash when inline comprehension has the same … #130311