The attached script hits some "This should never happen" code in the subprocess module.

These lines here:
https://github.com/python/cpython/blob/2.7/Lib/subprocess.py#L1036-L1038

The root cause is a lack of checking WIFSTOPPED and WSTOPSIG in the handler.

When a process elects into being ptraced via PTRACE_TRACEME, it is stopped on the SIGSEGV instead of terminating, allowing the user to attach a debugger before the kernel destroys the process.

This bug makes it impossible to wait on any process which crashes, which is set up to wait for a debugger.

To further clarify the report:

When the attached proof-of-concept is executed, a RuntimeException is raised, which has a comment "Should never happen".

The issue isn't due to SIGCHLD, but rather following a waitpid() call.  The code attempts to suss the exit code / reason for waitpid() returning, but does not check for WIFSTOPPED in its handler.

The attached patch should fix it.

I want to incorporate a bug.py like regression test into test_subprocess.py.

test added.

New changeset 269296b2a047 by Gregory P. Smith in branch '3.5':
Issue #29335: Fix subprocess.Popen.wait() when the child process has
https://hg.python.org/cpython/rev/269296b2a047

New changeset ed5255a61648 by Gregory P. Smith in branch '3.6':
Issue #29335: Fix subprocess.Popen.wait() when the child process has
https://hg.python.org/cpython/rev/ed5255a61648

New changeset 4f5e7d018195 by Gregory P. Smith in branch 'default':
Issue #29335: Fix subprocess.Popen.wait() when the child process has
https://hg.python.org/cpython/rev/4f5e7d018195

Among other buildbot failures:

http://buildbot.python.org/all/builders/x86%20Tiger%203.6/builds/142/steps/test/logs/stdio

======================================================================
ERROR: test_child_terminated_in_stopped_state (test.test_subprocess.POSIXProcessTestCase)
Test wait() behavior when waitpid returns WIFSTOPPED; issue29335.
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/Users/db3l/buildarea/3.6.bolen-tiger/build/Lib/test/test_subprocess.py", line 2514, in test_child_terminated_in_stopped_state
    libc = ctypes.CDLL(libc_name)
  File "/Users/db3l/buildarea/3.6.bolen-tiger/build/Lib/ctypes/__init__.py", line 348, in __init__
    self._handle = _dlopen(self._name, mode)
OSError: dlopen(libc..dylib, 6): image not found

----------------------------------------------------------------------
Ran 260 tests in 102.297s


Also, http://buildbot.python.org/all/builders/x86%20Ubuntu%20Shared%203.x/builds/240/steps/test/logs/stdio

New changeset 8e3d412f8e89 by Gregory P. Smith in branch '2.7':
Issue #29335: Fix subprocess.Popen.wait() when the child process has
https://hg.python.org/cpython/rev/8e3d412f8e89

thanks Ned, I was awaiting interesting buildbot results. :)

fixed in 2.7 and 3.5 onwards.  thanks for the report Zach.

not closing until I also apply the fix to the subprocess32 backport.

Of note, there's no need to actually cause a SIGSEGV to generate the signal.

The tests might be more clear to replace:

    libc.printf(ctypes.c_char_p(0xdeadbeef))

with

    os.kill(os.getpid(), signal.SIGSEGV)

If you want crashes, look at the portable faulthandler._sigsegv() :-)

Neat, though that's not in the standard library.

The current logic for getting a handle to libc could also be simplified via ctypes.util.find_library (https://docs.python.org/3/library/ctypes.html#finding-shared-libraries).

Darwin:

    >>> import ctypes.util
    >>> ctypes.util.find_library('c')
    '/usr/lib/libc.dylib'
    
Linux:

    >>> import ctypes.util
    >>> ctypes.util.find_library('c')
    'libc.so.6'

New changeset 56bc3b768c3cc3817031b56d5e7a279aa1296bc9 by Gregory P. Smith in branch 'master':
bpo-29335 - apply suggested test_subprocess simplifications from haypo and Zach: (#1757)
https://github.com/python/cpython/commit/56bc3b768c3cc3817031b56d5e7a279aa1296bc9

Fixed applied to subprocess32 in https://github.com/google/python-subprocess32/commit/0f1958e982bf44db569470def7281bcafa2a8b0e

New changeset cdee3f14f7f4c995e7eedb0bf6a67e260c739f7d by Victor Stinner in branch 'master':
bpo-30764: test_subprocess uses SuppressCrashReport (#2405)
https://github.com/python/cpython/commit/cdee3f14f7f4c995e7eedb0bf6a67e260c739f7d

New changeset 849b062a82ca2f09e33259d34067faba196c9e23 by Victor Stinner in branch '3.5':
bpo-30764: test_subprocess uses SuppressCrashReport (#2405) (#2411)
https://github.com/python/cpython/commit/849b062a82ca2f09e33259d34067faba196c9e23

New changeset 9ad50d94599aed0c37beaf78948ec271c8aa3881 by Victor Stinner in branch '3.6':
bpo-30764: test_subprocess uses SuppressCrashReport (#2405) (#2410)
https://github.com/python/cpython/commit/9ad50d94599aed0c37beaf78948ec271c8aa3881

New changeset 2097b9e0ef32ab7a0d745edc0f707c615780c006 by Victor Stinner in branch '2.7':
[2.7] bpo-30764: test_subprocess uses SuppressCrashReport (#2405) (#2412)
https://github.com/python/cpython/commit/2097b9e0ef32ab7a0d745edc0f707c615780c006