This issue tracker has been migrated to GitHub, and is currently read-only.
For more information, see the GitHub FAQs in the Python's Developer Guide.

Author Dennis Sweeney
Recipients Dennis Sweeney, rhettinger
Date 2022-02-02.18:01:22
SpamBayes Score -1.0
Marked as misclassified Yes
Message-id <1643824882.75.0.278611227582.issue46615@roundup.psfhosted.org>
In-reply-to
Content
Maybe related to https://bugs.python.org/issue8420

Somewhat obscure, but using only standard Python, and no frame- or gc-hacks, it looks like we can get a use-after-free:

from random import random

BADNESS = 0.0

class Bad:
    def __eq__(self, other):
        if random() < BADNESS:
            set1.clear()
        if random() < BADNESS:
            set2.clear()
        return True
    def __hash__(self):
        return 42

SIZE = 100
TRIALS = 10_000

ops = [
    "|", "|=",
    "==", "!=",
    "<", "<=",
    ">", ">=",
    # "&",  # crash!
    # "&=", # crash!
    "^",
    # "^=", # crash
    # "-", # crash
    "-=",
]

for op in ops:
    stmt = f"set1 {op} set2"
    print(stmt, "...")
    for _ in range(TRIALS):
        BADNESS = 0.00
        set1 = {Bad() for _ in range(SIZE)}
        set2 = {Bad() for _ in range(SIZE)}
        BADNESS = 0.02
        exec(stmt)
    print("ok.")
History
Date User Action Args
2022-02-02 18:01:22Dennis Sweeneysetrecipients: + Dennis Sweeney, rhettinger
2022-02-02 18:01:22Dennis Sweeneysetmessageid: <1643824882.75.0.278611227582.issue46615@roundup.psfhosted.org>
2022-02-02 18:01:22Dennis Sweeneylinkissue46615 messages
2022-02-02 18:01:22Dennis Sweeneycreate