GeezerVison is showing github.com — redundant decref on the eval stack value in LOAD_FROM_DICT_OR_DEREF in error path · Issue #111654 · python/cpython
redundant decref on the eval stack value in LOAD_FROM_DICT_OR_DEREF in error path #111654DescriptionCrash report
What happened?
With these codes bellow, a NameError will be raised as expected, but there will be a runtime crash when GC happens.
def xxx():
class MyComplex:
MyComplex
xxx()Error logs:
Traceback (most recent call last):
File "C:\Users\xxxxx\Source\cpython\a.py", line 71, in <module>
xxx()
File "C:\Users\xxxxx\Source\cpython\a.py", line 66, in xxx
class MyComplex:
File "C:\Users\xxxxx\Source\cpython\a.py", line 67, in MyComplex
MyComplex
NameError: cannot access free variable 'MyComplex' where it is not associated with a value in enclosing scope. Did you mean: 'complex'?
C:\Users\xxxxx\Source\cpython\Objects\frameobject.c:889: _Py_NegativeRefcount: Assertion failed: object has negative ref count
<object at 00000150D0CDA990 is freed>
Fatal Python error: _PyObject_AssertFailed: _PyObject_AssertFailed
Python runtime state: finalizing (tstate=0x00007ffc567001f8)
Current thread 0x00003564 (most recent call first):
<no Python frame>
CPython versions tested on:
3.12, CPython main branch
Operating systems tested on:
No response
Output from running 'python -VV' on the command line:
No response
Linked PRs
ActivityJelleZijlstra commented on Nov 2, 2023 aisk commented on Nov 2, 2023 @JelleZijlstra Yes, I tried to figure it out from your PR #109123 as reference , I think it's the same issue in another OP code. terryjreedy commented on Nov 2, 2023 I get the same crash in freshly compiled 'main', plus a few pages of garbage before 'Fatal Python error'. With released 3.13.0a1, the traceback but no crash. aisk commented on Nov 3, 2023 @terryjreedy I get the same crash on v3.13.0a1, maybe there are some compile cache mechanisms? JelleZijlstra commented on Nov 3, 2023 Errors due to use-after-free can be highly dependent on, well, lots of things, because memory may either get reused immediately or kept around, and you don't know what other objects get put in the same place later. It's not surprising that the same underlying bug that causes a use-after-free can manifest in wildly different ways. JelleZijlstra commented on Nov 3, 2023 Thanks for the report and fix!
MetadataMetadataDevelopmentNo branches or pull requestsIssue actions
|