classification
Title: SIGSEGV in _heapqmodule.c
Type: crash Stage: resolved
Components: Extension Modules Versions: Python 3.4, Python 3.2, Python 3.3, Python 2.7
process
Status: closed Resolution: fixed
Dependencies: Superseder:
Assigned To: pitrou Nosy List: maxxedev, neologix, pitrou, python-dev, rhettinger, stutzbach
Priority: high Keywords: patch

Created on 2013-02-22 20:25 by maxxedev, last changed 2013-03-04 19:45 by pitrou. This issue is now closed.

Files
File name Uploaded Description Edit
stressheapq.py pitrou, 2013-02-23 23:33
heapq_race.patch pitrou, 2013-02-23 23:33
heapq_race2.patch pitrou, 2013-02-23 23:50
Messages (9)
msg182698 - (view) Author: maxxedev (maxxedev) Date: 2013-02-22 20:25
I've been getting sporadic SIGSEGV crashes in _heapqmodule.c

I have not be able to reliably reproduce it, but here is a stacktrace:

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x2aaaad51d940 (LWP 13976)]
(gdb) where
#0  0x00002aaaab617e8a in _siftdown (heap=0xa1f2d8, startpos=0, pos=46)
    at [...]/Python-2.7.2/Modules/_heapqmodule.c:67
#1  0x00002aaaab617f76 in heappush (self=<value optimized out>, args=<value optimized out>)
    at [...]/Python-2.7.2/Modules/_heapqmodule.c:137
#2  0x000000000049ba34 in call_function (f=0xa565e0, throwflag=<value optimized out>) at Python/ceval.c:4013
#3  PyEval_EvalFrameEx (f=0xa565e0, throwflag=<value optimized out>) at Python/ceval.c:2666
#4  0x000000000049ca8d in call_function (f=0xa60f40, throwflag=<value optimized out>) at Python/ceval.c:4099
#5  PyEval_EvalFrameEx (f=0xa60f40, throwflag=<value optimized out>) at Python/ceval.c:2666
#6  0x000000000049ca8d in call_function (f=0xa5e210, throwflag=<value optimized out>) at Python/ceval.c:4099
#7  PyEval_EvalFrameEx (f=0xa5e210, throwflag=<value optimized out>) at Python/ceval.c:2666
#8  0x000000000049ca8d in call_function (f=0xa5e020, throwflag=<value optimized out>) at Python/ceval.c:4099
#9  PyEval_EvalFrameEx (f=0xa5e020, throwflag=<value optimized out>) at Python/ceval.c:2666
#10 0x000000000049ca8d in call_function (f=0xa5de00, throwflag=<value optimized out>) at Python/ceval.c:4099
#11 PyEval_EvalFrameEx (f=0xa5de00, throwflag=<value optimized out>) at Python/ceval.c:2666
#12 0x000000000049ca8d in call_function (f=0xa5dc30, throwflag=<value optimized out>) at Python/ceval.c:4099
#13 PyEval_EvalFrameEx (f=0xa5dc30, throwflag=<value optimized out>) at Python/ceval.c:2666
#14 0x000000000049d87b in PyEval_EvalCodeEx (co=0x896530, globals=<value optimized out>, locals=<value optimized out>,
    args=0x99dba8, argcount=1, kws=0x0, kwcount=0, defs=0x0, defcount=0, closure=0x0) at Python/ceval.c:3253
#15 0x00000000004fbf9f in function_call (func=0x8c30c8, arg=0x99db90, kw=0x0) at Objects/funcobject.c:526
#16 0x000000000041882d in PyObject_Call (func=0x8c30c8, arg=0x99db90, kw=0x0) at Objects/abstract.c:2529
#17 0x000000000041fd3f in instancemethod_call (func=<value optimized out>, arg=0x99db90, kw=0x0)
    at Objects/classobject.c:2578
#18 0x000000000041882d in PyObject_Call (func=0x2aaaaab7e730, arg=0x2aaaaaabc050, kw=0x0) at Objects/abstract.c:2529
#19 0x0000000000494a66 in PyEval_CallObjectWithKeywords (func=0x2aaaaab7e730, arg=0x2aaaaaabc050, kw=0x0)
    at Python/ceval.c:3882
#20 0x00000000004d30d2 in t_bootstrap (boot_raw=0x96d320) at ./Modules/threadmodule.c:614
#21 0x0000003fa780683d in start_thread () from /lib64/libpthread.so.0
#22 0x0000003fa6cd503d in clone () from /lib64/libc.so.6
msg182702 - (view) Author: Charles-Fran├žois Natali (neologix) * (Python committer) Date: 2013-02-22 21:58
The heapq C implementation is apparently not thread-safe: PyObject_RichCompareBool() and Py_DECREF() can lead to arbitrary python code being called, which can result in a context switch.
msg182834 - (view) Author: Antoine Pitrou (pitrou) * (Python committer) Date: 2013-02-23 23:33
Here is a reproducer.
msg182835 - (view) Author: Antoine Pitrou (pitrou) * (Python committer) Date: 2013-02-23 23:33
And a patch (for 2.7).
msg182837 - (view) Author: Antoine Pitrou (pitrou) * (Python committer) Date: 2013-02-23 23:50
Updated patch with tests.
msg183426 - (view) Author: Raymond Hettinger (rhettinger) * (Python committer) Date: 2013-03-04 09:07
Antoine, thanks for the patch.  This looks like a reasonable solution that is fast and prevents segfaults.
msg183488 - (view) Author: Roundup Robot (python-dev) Date: 2013-03-04 19:33
New changeset 21ded74b51fa by Antoine Pitrou in branch '2.7':
Issue #17278: Fix a crash in heapq.heappush() and heapq.heappop() when the list is being resized concurrently.
http://hg.python.org/cpython/rev/21ded74b51fa
msg183490 - (view) Author: Roundup Robot (python-dev) Date: 2013-03-04 19:39
New changeset 905b02749c26 by Antoine Pitrou in branch '3.2':
Issue #17278: Fix a crash in heapq.heappush() and heapq.heappop() when the list is being resized concurrently.
http://hg.python.org/cpython/rev/905b02749c26

New changeset 451299b97b4f by Antoine Pitrou in branch '3.3':
Issue #17278: Fix a crash in heapq.heappush() and heapq.heappop() when the list is being resized concurrently.
http://hg.python.org/cpython/rev/451299b97b4f

New changeset d57c60db94e7 by Antoine Pitrou in branch 'default':
Issue #17278: Fix a crash in heapq.heappush() and heapq.heappop() when the list is being resized concurrently.
http://hg.python.org/cpython/rev/d57c60db94e7
msg183492 - (view) Author: Antoine Pitrou (pitrou) * (Python committer) Date: 2013-03-04 19:45
Ok, committed, thank you!
History
Date User Action Args
2013-03-04 19:45:21pitrousetstatus: open -> closed
resolution: fixed
messages: + msg183492

stage: patch review -> resolved
2013-03-04 19:39:46python-devsetmessages: + msg183490
2013-03-04 19:33:55python-devsetnosy: + python-dev
messages: + msg183488
2013-03-04 09:07:35rhettingersetassignee: rhettinger -> pitrou
messages: + msg183426
2013-03-04 09:06:28rhettingersetmessages: - msg183401
2013-03-03 20:56:40rhettingersetmessages: + msg183401
2013-02-27 04:57:33rhettingersetpriority: normal -> high
assignee: rhettinger
2013-02-23 23:50:28pitrousetfiles: + heapq_race2.patch

messages: + msg182837
stage: patch review
2013-02-23 23:33:59pitrousetfiles: + heapq_race.patch
keywords: + patch
messages: + msg182835

versions: + Python 3.2, Python 3.3, Python 3.4
2013-02-23 23:33:41pitrousetfiles: + stressheapq.py
nosy: + pitrou
messages: + msg182834

2013-02-22 21:58:26neologixsetnosy: + neologix
messages: + msg182702
2013-02-22 20:31:55serhiy.storchakasetnosy: + rhettinger, stutzbach
components: + Extension Modules, - Library (Lib)
2013-02-22 20:25:39maxxedevcreate