Description

XuehaiPan

opened on Jul 31, 2024

Issue body actions

Crash report

What happened?

A simple standalone file:

# test1.py

import time

obj = time.struct_time(range(1, 10))

$ pyenv install 3.14t-dev --debug
$ pyenv local 3.14t-dev-debug
$ python3 -VV
Python 3.14.0a0 experimental free-threading build (heads/main:bd3d31f, Aug  1 2024, 01:22:33) [Clang 15.0.0 (clang-1500.3.9.4)]
$ python3 test1.py
Fatal Python error: _Py_Dealloc: Deallocator of type 'time.struct_time' raised an exception
Python runtime state: finalizing (tstate=0x00000001018ca548)
Exception ignored in the internal traceback machinery:
ImportError: sys.meta_path is None, Python is likely shutting down
TypeError: Missed attribute 'n_fields' of type time.struct_time

Current thread 0x00000001fff70c00 (most recent call first):
  Garbage-collecting
  <no Python frame>
[1]    89377 abort      python3 test1.py
$ python3 -c 'import test1'
Fatal Python error: _Py_Dealloc: Deallocator of type 'time.struct_time' raised an exception
Python runtime state: finalizing (tstate=0x00000001040a2548)
Exception ignored in the internal traceback machinery:
ImportError: sys.meta_path is None, Python is likely shutting down
TypeError: Missed attribute 'n_fields' of type time.struct_time

Current thread 0x00000001fff70c00 (most recent call first):
  Garbage-collecting
  <no Python frame>
[1]    89737 abort      python3 -c 'import test1'

If I remove the assignment for obj, the program can exit successfully.

# test2.py

import time

time.struct_time(range(1, 10))

$ python3 test2.py           # no output
$ python3 -c 'import test2'  # no output

CPython versions tested on:

CPython main branch, CPython 3.13t, CPython 3.14t

Operating systems tested on:

Linux, macOS

Output from running 'python -VV' on the command line:

Python 3.14.0a0 experimental free-threading build (heads/main:bd3d31f, Aug 1 2024, 01:22:33) [Clang 15.0.0 (clang-1500.3.9.4)]

Linked PRs

• gh-122527: Fix a crash on deallocation of PyStructSequence #122577
• [3.13] gh-122527: Fix a crash on deallocation of PyStructSequence (GH-122577) #122625
• [3.12] gh-122527: Fix a crash on deallocation of PyStructSequence (GH-122577) #122626

Activity

1. XuehaiPan

   added

   type-crashA hard crash of the interpreter, possibly with a core dumpA hard crash of the interpreter, possibly with a core dump

   on Jul 31, 2024
2. Eclips4 commented on Jul 31, 2024

   

   Eclips4

   on Jul 31, 2024

   Member

   More actions

   Thanks for the report!
   Confirmed on current main.
3. Eclips4

   added

   topic-free-threading

   on Jul 31, 2024
4. colesbury

   self-assigned this

   on Jul 31, 2024
5. colesbury

   added

   3.13only security fixesonly security fixes

   3.14bugs and security fixesbugs and security fixes

   on Jul 31, 2024
6. colesbury commented on Jul 31, 2024

   

   colesbury

   on Jul 31, 2024

   Contributor

   More actions

   Bisected to:

   • 4ad8f09 (gh-117376: Partial implementation of deferred reference counting #117696)

   (oops)
7. colesbury commented on Jul 31, 2024

   

   colesbury

   on Jul 31, 2024

   Contributor

   More actions

   The problem is in structseq_dealloc, the REAL_SIZE() call fails:

   cpython/Objects/structseq.c

   Lines 116 to 131 in 8844197

   	static void
   	structseq_dealloc(PyStructSequence *obj)
   	{
   	Py_ssize_t i, size;
   	PyObject_GC_UnTrack(obj);
   	PyTypeObject *tp = Py_TYPE(obj);
   	size = REAL_SIZE(obj);
   	for (i = 0; i < size; ++i) {
   	Py_XDECREF(obj->ob_item[i]);
   	}
   	PyObject_GC_Del(obj);
   	if (_PyType_HasFeature(tp, Py_TPFLAGS_HEAPTYPE)) {
   	Py_DECREF(tp);
   	}
   	}

   REAL_SIZE is a macro that expands to:

   PyDict_GetItemWithError(_PyType_GetDict(Py_TYPE(self)), _Py_ID(n_fields))
   

   The GC is clearing the type's dictionary (i.e., _PyType_GetDict) before the structseq instances is freed, so the REAL_SIZE call fails. We're also not handling that failure, which leads to a crash.

   The default build works because the GC happens to free the structseq instance first before calling tp_clear() on the type's dictionary, but I don't think the GC guarantees any ordering of tp_clear() calls.

   Reacted by Xuehai Pan
8. colesbury commented on Jul 31, 2024

   

   colesbury

   on Jul 31, 2024

   Contributor

   More actions

   You can trigger a similar crash in the default build with some weirder code:

   import time
   obj = time.struct_time(range(1, 10))
   type(obj).obj = obj
   
9. colesbury

   added a commit that references this issue on Aug 1, 2024

   pythongh-122527: Fix a crash on deallocation of `PyStructSequence`

   e677b27
10. encukou

    added a commit that references this issue on Aug 2, 2024

    gh-122527: Fix a crash on deallocation of `PyStructSequence` (GH-122577)

    4b63cd1
11. miss-islington

    added a commit that references this issue on Aug 2, 2024

    pythongh-122527: Fix a crash on deallocation of `PyStructSequence` (p…

    5ff87cc
12. brandtbucher

    added a commit that references this issue on Aug 7, 2024

    pythongh-122527: Fix a crash on deallocation of `PyStructSequence` (p…

    2657042
13. blhsing

    added a commit that references this issue on Aug 22, 2024

    pythongh-122527: Fix a crash on deallocation of `PyStructSequence` (p…

    adf8322
14. Yhg1s

    added a commit that references this issue on Sep 2, 2024

    [3.13] gh-122527: Fix a crash on deallocation of `PyStructSequence` (G…

    57ba3b0
15. ambv

    added a commit that references this issue on Sep 6, 2024

    [3.12] gh-122527: Fix a crash on deallocation of `PyStructSequence` (G…

    1bfb58c
16. ambv

    closed this as completedon Sep 6, 2024
17. StanFromIreland

    marked time.strptime() with lambda/function call triggers GC finalization error in Python 3.12 (struct_time n_fields missing in tp_clear) #148551 as a duplicate of this issue on Apr 14, 2026

Issue actions