Skip to content

Segmentation fault, possibly due to a GC issue (tp_subclasses) #135552

Open
@fxeqxmulfx

Description

@fxeqxmulfx

Crash report

What happened?

from typing import Union


class BaseNode:
    next: Union["BaseNode", None] = None

    @staticmethod
    def add(node: "BaseNode") -> None:
        if BaseNode.next is None:
            BaseNode.next = node
            return
        current = BaseNode.next
        while current.next is not None:
            current = current.next
        current.next = node

    @staticmethod
    def remove(node: "BaseNode") -> None:
        if BaseNode.next is None:
            return
        current = BaseNode.next
        prev = BaseNode
        while True:
            if current is None:
                return
            if current == node:
                if current.next is not None:
                    prev.next = current.next
                else:
                    prev.next = None
                return
            prev = current
            current = current.next


class Node(BaseNode):
    def __init__(self) -> None:
        self.next = None
        BaseNode.add(self)

    def __del__(self) -> None:
        BaseNode.remove(self)


def main() -> None:
    Node()
    Node()


if __name__ == "__main__":
    main()

(Edited by @ZeroIntensity) Shortened repro:

class BaseNode:
    next = None


class Node(BaseNode):
    def __init__(self) -> None:
        if BaseNode.next is None:
            BaseNode.next = self
            return
        BaseNode.next.next = self

    def __del__(self) -> None:
        BaseNode.next = BaseNode.next.next


Node()
Node()

(Edited by @fxeqxmulfx) Use after free example:

class BaseNode:
    def __del__(self):
        print("next", BaseNode.next)
        print("del", self)


BaseNode.next = BaseNode()
BaseNode.next.next = BaseNode()
next <__main__.BaseNode object at 0x717fb2d23a10>
del <__main__.BaseNode object at 0x717fb2d23a10>
next <__main__.BaseNode object at 0x717fb2d23a10> use after free
del <__main__.BaseNode object at 0x717fb2d23a50>

CPython versions tested on:

3.14

Operating systems tested on:

Linux

Output from running 'python -VV' on the command line:

Python 3.14.0b2 (main, Jun 12 2025, 12:41:01) [Clang 20.1.4 ]

Linked PRs

Metadata

Metadata

Assignees

No one assigned

    Labels

    3.13bugs and security fixes3.14bugs and security fixes3.15new features, bugs and security fixesinterpreter-core(Objects, Python, Grammar, and Parser dirs)type-crashA hard crash of the interpreter, possibly with a core dump

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions

      pFad - Phonifier reborn

      Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

      Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


      Alternative Proxies:

      Alternative Proxy

      pFad Proxy

      pFad v3 Proxy

      pFad v4 Proxy