I've attached a script that crashes the Python interpreter.  

I can get the crash to occur under Windows Vista with this version of Python:

C:\tmp\remote>c:\Python27\python.exe
Python 2.7.1 Stackless 3.1b3 060516 (release27-maint, Jan  1 2011, 13:04:37) [MSC v.1500 32 bit (Intel)] on win32

Also, I got it to segfault under Ubuntu Linux:

jharper@ubuntu:~$ uname -a
Linux ubuntu 2.6.35-27-generic #48-Ubuntu SMP Tue Feb 22 20:25:29 UTC 2011 i686 GNU/Linux
jharper@ubuntu:~$ python
Python 2.6.6 (r266:84292, Sep 15 2010, 15:52:39) 
[GCC 4.4.5] on linux2

Note, when I commented out the line, "pprint(code_args)", the script generated a SystemError exception instead of crashing.

The marshal loads and dumps don't seem to be necessary to reproduce the crash.  On both the Windows Vista and Ubuntu Linux systems, the crash still occurred when I replaced:

mcopy_code = loads(dumps(code))

with:

mcopy_code = code #loads(dumps(code))

You need to pass co_freevars and co_cellvars as well for your example to work. It shouldn't crash, but I don't consider this particular crash as a bug, as it is a known limitation that new.code doesn't perform all consistency checks that are necessary to guarantee that the function execution doesn't crash the interpreter.

It certainly can't be fixed in 2.6.

Martin,

Thanks for your response.  I didn't know it was possible to pass freevars and cellvars to new.code.  I think the documentation needs to be updated.  The documentation for 2.7.3 located at http://docs.python.org/library/new.html?highlight=new#new.code is as follows:

new.code(argcount, nlocals, stacksize, flags, codestring, constants, names, varnames, filename, name, firstlineno, lnotab)

After I got your reply to this bug report I did help(new.code) and I see that it includes freevars and cellvars as optional arguments.

In Py3, new.code and new.function become types.CodeType and types.FunctionType. The 'documentation' of their signatures is only available with help(types.xxx). So the library doc issue is 2.7 only.

Running with IDLE, 3.3b0, Win7, the converted example does crash after 5 seconds or so even with the missing arg and the pprint gone. The crash is in the new_fun(5) call. I might have gotten something wrong. Or maybe the the help is wrong.

I couldn't reproduce this on the latest main branch with an updated version of the code sample (see attached repro.py). I also couldn't get such a crash with some variations of this.

I'm marking this as fixed for now. We can re-open this if anyone runs into an up-to-date case of this crash.