This issue tracker has been migrated to GitHub, and is currently read-only.
For more information, see the GitHub FAQs in the Python's Developer Guide.

classification
Title: Incorrect callable object crashes Python 3.11.0a0
Type: crash Stage: resolved
Components: Interpreter Core Versions: Python 3.11
process
Status: closed Resolution: fixed
Dependencies: Superseder:
Assigned To: Nosy List: Dennis Sweeney, xxm
Priority: normal Keywords:

Created on 2021-07-23 04:27 by xxm, last changed 2022-04-11 14:59 by admin. This issue is now closed.

Messages (4)
msg398028 - (view) Author: Xinmeng Xia (xxm) Date: 2021-07-23 04:27
This program can trigger "Aborted (core dumped)" on Python 3.9.0, Python 3.8.0, Python3.10.0a2.  It trigger " segmentation fault" on the master (Python 3.11.0a0).

==================================
import weakref

class Object:
    def __init__(self, arg):
        self.arg = arg

def test_set_callback_attribute():
    x = Object(1)
    callback = lambda ref: None
    callback = weakref.ref(callback, x)
    with test_set_callback_attribute():
        pass

test_set_callback_attribute()
==================================

Crashes on the master (Python 3.11.0a0)
------------------------------------------------------------
.....
Traceback (most recent call last):
  File "/home/xxm/Desktop/IFuzzer/bugs/CPython/IFuzzer/test_weakref/test_set_callback_attribute__1.py", line 26, in test_set_callback_attribute
    callback = weakref.ref(callback, x)
    ^^^^^^^^
TypeError: 'Object' object is not callable
Exception ignored in: <__main__.Object object at 0x7f3e2d56ca90>
Traceback (most recent call last):
  File "/home/xxm/Desktop/IFuzzer/bugs/CPython/IFuzzer/test_weakref/test_set_callback_attribute__1.py", line 26, in test_set_callback_attribute
Segmentation fault (core dumped)
--------------------------------------------------------------


Crashes on the older version of Python
-----------------------------------------------------------
File "/home/xxm/Desktop/IFuzzer/bugs/CPython/IFuzzer/test_weakref/test_set_callback_attribute__1.py", line 27 in test_set_callback_attribute
File "/home/xxm/Desktop/IFuzzer/bugs/CPython/IFuzzer/test_weakref/test_set_callback_attribute__1.py", line 27 in test_set_callback_attribute
File "/home/xxm/Desktop/IFuzzer/bugs/CPython/IFuzzer/test_weakref/test_set_callback_attribute__1.py", line 27 in test_set_callback_attribute
File "/home/xxm/Desktop/IFuzzer/bugs/CPython/IFuzzer/test_weakref/test_set_callback_attribute__1.py", line 27 in test_set_callback_attribute
File "/home/xxm/Desktop/IFuzzer/bugs/CPython/IFuzzer/test_weakref/test_set_callback_attribute__1.py", line 27 in test_set_callback_attribute
File "/home/xxm/Desktop/IFuzzer/bugs/CPython/IFuzzer/test_weakref/test_set_callback_attribute__1.py", line 27 in test_set_callback_attribute
File "/home/xxm/Desktop/IFuzzer/bugs/CPython/IFuzzer/test_weakref/test_set_callback_attribute__1.py", line 27 in test_set_callback_attribute
...
Aborted (core dumped)
---------------------------------------------------------------

System: Ubuntu 16.04
msg398088 - (view) Author: Dennis Sweeney (Dennis Sweeney) * (Python committer) Date: 2021-07-23 18:57
### Simplified crasher

from weakref import ref

def f():
    ref(lambda: 0, [])
    f()

f()

########################


Running this in debug mode, I got a failed assertion at traceback.c,
line 746, `assert(source_line);`. 
If that assertion is commented out, a null pointer is dereferenced in
_PyPegen_byte_offset_to_character_offset()
msg398115 - (view) Author: Dennis Sweeney (Dennis Sweeney) * (Python committer) Date: 2021-07-24 02:30
I think GH-27313 will fix this
msg398269 - (view) Author: Dennis Sweeney (Dennis Sweeney) * (Python committer) Date: 2021-07-26 23:14
Indeed, I got no crash on main after GH-27313.

I also got no crash on 3.10 after GH-23568. Its backport to 3.9 (GH-24501) would have fixed this, but broke the stable ABI and was reverted. This was related to bpo-42500.

I'm closing this "fixed". Feel free to re-open if you still see an issue.
History
Date User Action Args
2022-04-11 14:59:47adminsetgithub: 88882
2021-07-26 23:14:56Dennis Sweeneysetstatus: open -> closed
resolution: fixed
messages: + msg398269

stage: resolved
2021-07-24 02:30:41Dennis Sweeneysetmessages: + msg398115
2021-07-23 18:57:03Dennis Sweeneysetnosy: + Dennis Sweeney
messages: + msg398088
2021-07-23 04:27:09xxmcreate