This issue tracker has been migrated to GitHub, and is currently read-only.
For more information, see the GitHub FAQs in the Python's Developer Guide.

classification
Title: Uninitialized free_extra in code_dealloc
Type: crash Stage:
Components: Interpreter Core Versions: Python 3.8, Python 3.7, Python 3.6
process
Status: open Resolution:
Dependencies: Superseder:
Assigned To: Nosy List: brett.cannon, dino.viehland, iritkatriel, jeethu
Priority: high Keywords:

Created on 2018-01-17 15:35 by jeethu, last changed 2022-04-11 14:58 by admin.

Messages (3)
msg310191 - (view) Author: Jeethu Rao (jeethu) * Date: 2018-01-17 15:35
In one of patches I'm building, (yet another attempt at caching LOAD_GLOBALS)[1], I'm using the private APIs from PEP 523 to store an array with every code object. I'm calling _PyEval_RequestCodeExtraIndex with PyMem_Free for the freefunc argument. While running  the cpython testsuite, I found that test_embed case crashes with a segfault. The gdb backtrace[2] seems to indicate that PyInterpreterState::co_extra_freefuncs is uninitialized, while it should be a pointer to the PyMem_Free function. 

One way to work around this is to set the array as a member on the PyCodeObject struct and use it directly. And I've verified that it works. Am I using the PEP 523 private api correctly? Also, on Linux, this consistently crashes while on OSX, it occasionally doesn't crash which makes me wonder if it's some kind of a race condition involving Sub-interpreters. The attached gist[2] has steps for repro.

[1]: https://github.com/python/cpython/compare/master...jeethu:py3.7_load_global_cache
[2]: https://gist.github.com/jeethu/6d92185ca97dd692e7fadcd105e0ef70
msg321638 - (view) Author: Brett Cannon (brett.cannon) * (Python committer) Date: 2018-07-13 22:42
co_extra_freefuncs is an array of pointers, so there's no way for it to be uninitialized unless you didn't initialize the interpreter state (https://github.com/python/cpython/blob/b193fa996a746111252156f11fb14c12fd6267e6/Include/pystate.h#L155). And looking at your gdb session it shows the memory wipeout pattern which means you're accessing an interpreter state that has already been freed itself. IOW I don't think this is a PEP 523 issue specifically.
msg404146 - (view) Author: Irit Katriel (iritkatriel) * (Python committer) Date: 2021-10-17 21:25
Is there anything left to do on this issue? It seems like a question more than a bug report.
History
Date User Action Args
2022-04-11 14:58:56adminsetgithub: 76765
2021-10-17 21:25:35iritkatrielsetnosy: + iritkatriel
messages: + msg404146
2018-07-13 22:42:22brett.cannonsetmessages: + msg321638
2018-06-03 18:53:10brett.cannonsetnosy: + dino.viehland
2018-06-03 10:09:29serhiy.storchakasetpriority: normal -> high
nosy: + brett.cannon

versions: + Python 3.6, Python 3.8
2018-01-17 15:35:04jeethucreate