Uh oh!
There was an error while loading.Please reload this page.
- Notifications
You must be signed in to change notification settings - Fork33.7k
Closed
Description
Crash report
There is a path intype_mro_modified that results in double-free of*mro_meth:
A reproducer:
class B: passclass M(type): def mro(cls): del M.mro return (B,)class C(metaclass=M): passCrash with the debug CPython:
$ ./python mro-crasher.py/home/test/cpython/Include/object.h:601: _Py_NegativeRefcount: Assertion failed: object has negative ref count<object at 0x7f88c12d1a90 is freed>Fatal Python error: _PyObject_AssertFailed: _PyObject_AssertFailedPython runtime state: initializedCurrent thread 0x00007f88c13cb080 (most recent call first): File "/home/test/mro-crasher.py", line 9 in <module>Aborted (core dumped)This bug was introduced in#73052.