Movatterモバイル変換


[0]ホーム

URL:


Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Sign up
Appearance settings

Segfault inunion_repr fromlist_repr_impl in free-threaded build #132713

Closed
Assignees
sobolevn
Labels
3.13bugs and security fixes3.14bugs and security fixesinterpreter-core(Objects, Python, Grammar, and Parser dirs)topic-free-threadingtopic-typingtype-crashA hard crash of the interpreter, possibly with a core dump
@devdanzin

Description

@devdanzin

Crash report

What happened?

Callingrepr in many threads on a list containing a largetyping.Union segfaults in a free-threaded build:

importabcimportbuiltinsimportcollections.abcimportitertoolsimporttypesimporttypingfromfunctoolsimportreducefromoperatorimportor_abc_types= [clsforclsinabc.__dict__.values()ifisinstance(cls,type)]builtins_types= [clsforclsinbuiltins.__dict__.values()ifisinstance(cls,type)]collections_abc_types= [clsforclsincollections.abc.__dict__.values()ifisinstance(cls,type)]collections_types= [clsforclsincollections.__dict__.values()ifisinstance(cls,type)]itertools_types= [clsforclsinitertools.__dict__.values()ifisinstance(cls,type)]types_types= [clsforclsintypes.__dict__.values()ifisinstance(cls,type)]typing_types= [clsforclsintyping.__dict__.values()ifisinstance(cls,type)]all_types= (abc_types+builtins_types+collections_abc_types+collections_types+itertools_types+types_types+typing_types)all_types= [tfortinall_typesifnotissubclass(t,BaseException)]BIG_UNION=reduce(or_,all_types,int)fromthreadingimportThreadfromtimeimportsleepforxinrange(100):union_list= [int|BIG_UNION]*17defstress_list():forxinrange(3):try:union_list.pop()exceptException:passrepr(union_list)sleep(0.006)union_list.__getitem__(None,None)alive= []forxinrange(25):alive.append(Thread(target=stress_list,args=()))fortinalive:t.start()

Example segfault backtrace:

Thread 60 "Thread-59 (stre" received signal SIGSEGV, Segmentation fault.0x0000555555d21751 in _Py_TYPE (ob=<unknown at remote 0xdddddddddddddddd>) at ./Include/object.h:270270             return ob->ob_type;#0  0x0000555555d21751 in _Py_TYPE (ob=<unknown at remote 0xdddddddddddddddd>) at ./Include/object.h:270#1  union_repr (self=<optimized out>) at Objects/unionobject.c:296#2  0x0000555555b8949a in PyObject_Repr (v=<unknown at remote 0x7fffb48464b0>) at Objects/object.c:776#3  0x0000555555cc06a1 in PyUnicodeWriter_WriteRepr (writer=writer@entry=0x7fff660907f0,    obj=<unknown at remote 0x207c>) at Objects/unicodeobject.c:13951#4  0x0000555555aeba03 in list_repr_impl (v=0x7fffb4a8dc90) at Objects/listobject.c:606#5  list_repr (self=[]) at Objects/listobject.c:633#6  0x0000555555b8949a in PyObject_Repr (v=[]) at Objects/object.c:776#7  0x0000555555e07abf in _PyEval_EvalFrameDefault (tstate=<optimized out>, frame=<optimized out>,    throwflag=<optimized out>) at Python/generated_cases.c.h:2306#8  0x0000555555ddcf53 in _PyEval_EvalFrame (tstate=0x529000325210, frame=0x529000384328, throwflag=0)    at ./Include/internal/pycore_ceval.h:119#9  _PyEval_Vector (tstate=0x529000325210, func=0x7fffb4828dd0, locals=0x0, args=<optimized out>,    argcount=1, kwnames=0x0) at Python/ceval.c:1917#10 0x0000555555a4f42b in _PyObject_VectorcallTstate (tstate=0x529000325210,    callable=<function at remote 0x7fffb4828dd0>, args=0x207c, nargsf=3, nargsf@entry=1,    kwnames=<unknown at remote 0x7fff66090450>, kwnames@entry=0x0) at ./Include/internal/pycore_call.h:169#11 0x0000555555a4ccbf in method_vectorcall (method=<optimized out>, args=<optimized out>,    nargsf=<optimized out>, kwnames=<optimized out>) at Objects/classobject.c:72#12 0x0000555555e8005b in _PyObject_VectorcallTstate (tstate=0x529000325210,    callable=<method at remote 0x7fff660c0eb0>, args=0x7fff93df06d8, nargsf=0, kwnames=0x0)    at ./Include/internal/pycore_call.h:169#13 context_run (self=<_contextvars.Context at remote 0x7fffb4a8ebf0>, args=<optimized out>,    nargs=<optimized out>, kwnames=0x0) at Python/context.c:728#14 0x0000555555e0a3e7 in _PyEval_EvalFrameDefault (tstate=<optimized out>, frame=<optimized out>,    throwflag=<optimized out>) at Python/generated_cases.c.h:3551

Once it aborted with message:

python: Objects/unionobject.c:296: PyObject *union_repr(PyObject *): Assertion `PyTuple_Check(alias->args)' failed.

Found usingfusil by@vstinner.

CPython versions tested on:

CPython main branch

Operating systems tested on:

Linux

Output from running 'python -VV' on the command line:

Python 3.14.0a7+ experimental free-threading build (heads/main:741c6386b86, Apr 18 2025, 15:04:45) [Clang 19.1.7 (++20250114103320+cd708029e0b2-1exp120250114103432.75)]

Linked PRs

Metadata

Metadata

Assignees

Labels

3.13bugs and security fixes3.14bugs and security fixesinterpreter-core(Objects, Python, Grammar, and Parser dirs)topic-free-threadingtopic-typingtype-crashA hard crash of the interpreter, possibly with a core dump

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions


    [8]ページ先頭

    ©2009-2025 Movatter.jp