The following crashes the interpreter in Python 3.11, and works fine in older versions:

# --- script.py 
import types

class MyModule (types.ModuleType):
    __slots__ = (
        "_MyModule__a",
        "_MyModule__b",
    )

    def __init__(self, name):
        super().__init__(name)

m = MyModule("name")
# -- end of file

The key in this is the ``__slots__`` definition: The script does not crash without ``__slots__``, or with a slots tuple with 1 item.

This is a reproducer based on code in PyObjC.

This is with python 3.11 alpha 5 using the installer for macOS.

The crash itself happens during garbage collection:

% python3.11 -Xdev t.py                                                                                                                               (master)pyobjc-8
Fatal Python error: Segmentation fault

Current thread 0x0000000104ce0580 (most recent call first):
  Garbage-collecting
  <no Python frame>


And when using a debug build and -Xdev:

../Modules/gcmodule.c:2187: visit_validate: Assertion failed: PyObject_GC_Track() object is not valid
Enable tracemalloc to get the memory block allocation traceback

object address  : 0x101a5f690
object refcount : 1
object type     : 0x15503f230
object type name: MyModule
object repr     : <module '?'>

Fatal Python error: _PyObject_AssertFailed: _PyObject_AssertFailed
Python runtime state: initialized

Current thread 0x00000001019c0580 (most recent call first):
  File "/Users/ronald/Projects/Forks/cpython/build/t.py", line 12 in <module>
zsh: abort      ./python.exe -Xdev t.py

The debug build seems to indicate that slot memory is not initiated properly, a stack trace (note the argument to visit_validate at frame #7):


  * frame #0: 0x000000019b60d9b8 libsystem_kernel.dylib`__pthread_kill + 8
    frame #1: 0x000000019b640eb0 libsystem_pthread.dylib`pthread_kill + 288
    frame #2: 0x000000019b57e314 libsystem_c.dylib`abort + 164
    frame #3: 0x000000010030c4f4 python.exe`fatal_error_exit(status=-1) at pylifecycle.c:2624:9
    frame #4: 0x000000010030c3cc python.exe`fatal_error(fd=2, header=1, prefix="_PyObject_AssertFailed", msg="_PyObject_AssertFailed", status=-1) at pylifecycle.c:2805:5
    frame #5: 0x000000010030be20 python.exe`_Py_FatalErrorFunc(func="_PyObject_AssertFailed", msg="_PyObject_AssertFailed") at pylifecycle.c:2821:5
    frame #6: 0x0000000100169fe0 python.exe`_PyObject_AssertFailed(obj=0x0000000100d63690, expr=0x0000000000000000, msg="PyObject_GC_Track() object is not valid", file="../Modules/gcmodule.c", line=2187, function="visit_validate") at object.c:2293:5
    frame #7: 0x0000000100351184 python.exe`visit_validate(op=0xcdcdcdcdcdcdcdcd, parent_raw=0x0000000100d63690) at gcmodule.c:2186:9
    frame #8: 0x000000010019845c python.exe`traverse_slots(type=0x0000000101813230, self=0x0000000100d63690, visit=(python.exe`visit_validate at gcmodule.c:2183), arg=0x0000000100d63690) at typeobject.c:1207:27
    frame #9: 0x0000000100197fe8 python.exe`subtype_traverse(self=0x0000000100d63690, visit=(python.exe`visit_validate at gcmodule.c:2183), arg=0x0000000100d63690) at typeobject.c:1228:23
    frame #10: 0x0000000100350fdc python.exe`PyObject_GC_Track(op_raw=0x0000000100d63690) at gcmodule.c:2212:11

Bisected to here:

c3f52b4d707a78eb342372a2be00f3eb846a05b9 is the first bad commit
commit c3f52b4d707a78eb342372a2be00f3eb846a05b9
Author: Mark Shannon <mark@hotpy.org>
Date:   Wed Jun 23 10:00:43 2021 +0100

    bpo-44486: Make sure that modules always have a dictionary. (GH-26847)

    * Make sure that modules always have a dictionary.

@Pablo: this is a possible release blocker, hard crash for code that works in earlier releases. 

That said, I have a workaround on my end and IMHO a fix could wait for the next alpha.

Marking this as release blocker.

Dennis, thanks for bisecting this.

I don't feel qualified to review the PR, but can confirm that this PR fixes this issue as well as the crash in PyObjC that I extracted my reproducer from.

New changeset 751c9ed801ad1189272ca10f0749bfc9d49b5038 by Mark Shannon in branch 'main':
bpo-46891: Fix creating a new instance of a module subclass with slots (GH-31643)
https://github.com/python/cpython/commit/751c9ed801ad1189272ca10f0749bfc9d49b5038