Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Crash in Objects/typeobject.c #88398

Closed
felixxm mannequin opened this issue May 25, 2021 · 7 comments
Closed

Crash in Objects/typeobject.c #88398

felixxm mannequin opened this issue May 25, 2021 · 7 comments
Labels
3.10 only security fixes 3.11 only security fixes interpreter-core (Objects, Python, Grammar, and Parser dirs) type-crash A hard crash of the interpreter, possibly with a core dump

Comments

@felixxm
Copy link
Mannequin

felixxm mannequin commented May 25, 2021

BPO 44232
Nosy @vstinner, @pablogsal, @miss-islington, @felixxm, @Fidget-Spinner
PRs
  • bpo-44232: Fix type_new crash caused by AssertionError #26358
  • bpo-44232: Fix type_new() error reporting #26359
  • [3.10] bpo-44232: Fix type_new() error reporting (GH-26359) #26365
    		•

    Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.

    Show more details

    GitHub fields:

    assignee = None
closed_at = <Date 2021-05-26.10:23:18.580>
created_at = <Date 2021-05-25.11:39:15.184>
labels = ['interpreter-core', '3.10', 'type-crash', '3.11']
title = 'Crash in Objects/typeobject.c'
updated_at = <Date 2021-05-26.10:23:18.579>
user = 'https://github.com/felixxm'

    bugs.python.org fields:

    activity = <Date 2021-05-26.10:23:18.579>
actor = 'vstinner'
assignee = 'none'
closed = True
closed_date = <Date 2021-05-26.10:23:18.580>
closer = 'vstinner'
components = ['Interpreter Core']
creation = <Date 2021-05-25.11:39:15.184>
creator = 'felixxm'
dependencies = []
files = []
hgrepos = []
issue_num = 44232
keywords = ['patch']
message_count = 7.0
messages = ['394330', '394350', '394371', '394375', '394393', '394426', '394428']
nosy_count = 5.0
nosy_names = ['vstinner', 'pablogsal', 'miss-islington', 'felixxm', 'kj']
pr_nums = ['26358', '26359', '26365']
priority = None
resolution = 'fixed'
stage = 'resolved'
status = 'closed'
superseder = None
type = 'crash'
url = 'https://bugs.python.org/issue44232'
versions = ['Python 3.10', 'Python 3.11']
    @felixxm
    Copy link
    Mannequin Author

    felixxm mannequin commented May 25, 2021

    We noticed a behavior change in [1]. One of our tests apps.tests.AppsTests.test_model_clash()[2] crashes with:

    python: Objects/typeobject.c:3219: type_new: Assertion `type != NULL' failed.
    Fatal Python error: Aborted

    Current thread 0x00007ffa6951a280 (most recent call first):
    File "django/tests/apps/tests.py", line 301 in test_model_clash
    File "cpython/Lib/unittest/case.py", line 549 in _callTestMethod
    File "cpython/Lib/unittest/case.py", line 592 in run
    File "cpython/Lib/unittest/case.py", line 652 in __call__
    File "django/django/test/testcases.py", line 283 in _setup_and_call
    File "django/django/test/testcases.py", line 247 in __call__
    File "cpython/Lib/unittest/suite.py", line 122 in run
    File "cpython/Lib/unittest/suite.py", line 84 in __call__
    File "cpython/Lib/unittest/runner.py", line 176 in run
    File "django/django/test/runner.py", line 705 in run_suite
    File "django/django/test/runner.py", line 772 in run_tests
    File "django/tests/./runtests.py", line 332 in django_tests
    File "django/tests/./runtests.py", line 596 in <module>
    Aborted (core dumped)

    This can be an issue is our test which is quite tricky. I will try to investigate it.

    [1] ecf14e6
    [2] https://github.com/django/django/blob/7e51893911237dfca9294e3ca12163ff813fb656/tests/apps/tests.py#L274-L309

    @felixxm felixxm mannequin added 3.10 only security fixes 3.11 only security fixes interpreter-core (Objects, Python, Grammar, and Parser dirs) type-crash A hard crash of the interpreter, possibly with a core dump labels May 25, 2021
    @Fidget-Spinner
    Copy link
    Member

    Can you please try removing the assert(type != NULL); line at https://github.com/python/cpython/blob/main/Objects/typeobject.c#L3313 and see if it works for you? I suspect that winner->tp_new() may sometimes fail and should return NULL to indicate that in those cases, so the assert may not always hold.

    @Fidget-Spinner
    Copy link
    Member

    Alright, I got a minimum reproducible example:

    class XBase(type):
    def __new__(cls, name, bases, attrs, **kwargs):
        attrs.pop('__module__')
        return super().__new__(cls, name, bases, attrs, **kwargs)

class X(metaclass=XBase): ...

    type('A', (X, ), {})

    This triggers it, sending patch soon.

    @vstinner
    Copy link
    Member

    We noticed a behavior change in [1].

    Hey, well done bisection, you're right, it's a regression of my large type_new() refactoring in bpo-43770.

    I wrote PR 26359 to fix it.

    @vstinner
    Copy link
    Member

    New changeset bd199e7 by Victor Stinner in branch 'main':
    bpo-44232: Fix type_new() error reporting (GH-26359)
    bd199e7

    @vstinner
    Copy link
    Member

    New changeset 7b3b698 by Miss Islington (bot) in branch '3.10':
    bpo-44232: Fix type_new() error reporting (GH-26359) (GH-26365)
    7b3b698

    @vstinner
    Copy link
    Member

    Ok, it's now fixed in 3.10 and main branches. Thanks for the bug report, and thanks Ken Jin for your PR ;-)

    @ezio-melotti ezio-melotti transferred this issue from another repository Apr 10, 2022
    Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
    Assignees
    No one assigned
    Labels
    3.10 only security fixes 3.11 only security fixes interpreter-core (Objects, Python, Grammar, and Parser dirs) type-crash A hard crash of the interpreter, possibly with a core dump
    Projects
    None yet
    Milestone
    No milestone
    Development

    No branches or pull requests
    3 participants
    @vstinner @pablogsal @Fidget-Spinner