Skip to content

test_dataclasses fails with a segfault in hunt refleaks mode #123185

Closed
Closed
test_dataclasses fails with a segfault in hunt refleaks mode#123185
Assignees
markshannon
Labels
3.14bugs and security fixestype-bugAn unexpected behavior, bug, or errortype-crashA hard crash of the interpreter, possibly with a core dump

Description

@Eclips4
Eclips4
opened on Aug 20, 2024

Bug report

Bug description:

eclips4@nixos ~/p/p/cpython (main)> ./python -m test -R 3:3 test_dataclasses
Using random seed: 315532800
0:00:00 load avg: 0.96 Run 1 test sequentially in a single process
0:00:00 load avg: 0.96 [1/1] test_dataclasses
beginning 6 repetitions. Showing number of leaks (. for 0 or less, X for 10 or more)
123:456
XFatal Python error: Segmentation fault

Current thread 0x00007f14a8f07b80 (most recent call first):
  File "/home/eclips4/programming/programming-languages/cpython/Lib/test/test_dataclasses/__init__.py", line 2217 in test_dataclasses_qualnames
  File "/home/eclips4/programming/programming-languages/cpython/Lib/unittest/case.py", line 606 in _callTestMethod
  File "/home/eclips4/programming/programming-languages/cpython/Lib/unittest/case.py", line 660 in run
  File "/home/eclips4/programming/programming-languages/cpython/Lib/unittest/case.py", line 716 in __call__
  File "/home/eclips4/programming/programming-languages/cpython/Lib/unittest/suite.py", line 122 in run
  File "/home/eclips4/programming/programming-languages/cpython/Lib/unittest/suite.py", line 84 in __call__
  File "/home/eclips4/programming/programming-languages/cpython/Lib/unittest/suite.py", line 122 in run
  File "/home/eclips4/programming/programming-languages/cpython/Lib/unittest/suite.py", line 84 in __call__
  File "/home/eclips4/programming/programming-languages/cpython/Lib/test/libregrtest/testresult.py", line 148 in run
  File "/home/eclips4/programming/programming-languages/cpython/Lib/test/libregrtest/single.py", line 57 in _run_suite
  File "/home/eclips4/programming/programming-languages/cpython/Lib/test/libregrtest/single.py", line 37 in run_unittest
  File "/home/eclips4/programming/programming-languages/cpython/Lib/test/libregrtest/single.py", line 135 in test_func
  File "/home/eclips4/programming/programming-languages/cpython/Lib/test/libregrtest/refleak.py", line 132 in runtest_refleak
  File "/home/eclips4/programming/programming-languages/cpython/Lib/test/libregrtest/single.py", line 87 in regrtest_runner
  File "/home/eclips4/programming/programming-languages/cpython/Lib/test/libregrtest/single.py", line 138 in _load_run_test
  File "/home/eclips4/programming/programming-languages/cpython/Lib/test/libregrtest/single.py", line 181 in _runtest_env_changed_exc
  File "/home/eclips4/programming/programming-languages/cpython/Lib/test/libregrtest/single.py", line 281 in _runtest
  File "/home/eclips4/programming/programming-languages/cpython/Lib/test/libregrtest/single.py", line 310 in run_single_test
  File "/home/eclips4/programming/programming-languages/cpython/Lib/test/libregrtest/main.py", line 363 in run_test
  File "/home/eclips4/programming/programming-languages/cpython/Lib/test/libregrtest/main.py", line 397 in run_tests_sequentially
  File "/home/eclips4/programming/programming-languages/cpython/Lib/test/libregrtest/main.py", line 541 in _run_tests
  File "/home/eclips4/programming/programming-languages/cpython/Lib/test/libregrtest/main.py", line 576 in run_tests
  File "/home/eclips4/programming/programming-languages/cpython/Lib/test/libregrtest/main.py", line 739 in main
  File "/home/eclips4/programming/programming-languages/cpython/Lib/test/libregrtest/main.py", line 747 in main
  File "/home/eclips4/programming/programming-languages/cpython/Lib/test/__main__.py", line 2 in <module>
  File "/home/eclips4/programming/programming-languages/cpython/Lib/runpy.py", line 88 in _run_code
  File "/home/eclips4/programming/programming-languages/cpython/Lib/runpy.py", line 198 in _run_module_as_main

Extension modules: _testinternalcapi (total: 1)
fish: Job 1, './python -m test -R 3:3 test_da…' terminated by signal SIGSEGV (Address boundary error)

CPython versions tested on:

CPython main branch

Operating systems tested on:

Linux

Linked PRs

Activity

  1. Eclips4
    added
    type-bugAn unexpected behavior, bug, or error
    type-crashA hard crash of the interpreter, possibly with a core dump
    on Aug 20, 2024

  2. Eclips4 commented on Aug 20, 2024

    @Eclips4
    Eclips4
    on Aug 20, 2024
    MemberAuthor

    Bisected to bb1d303
    cc @markshannon

  3. zware commented on Aug 20, 2024

    @zware
    zware
    on Aug 20, 2024
    Member

    Bisected to bb1d303

    Corroborated by the PPC64LE RHEL8 Refleaks 3.x builder (370/478 other tests passed as of right now, the build is not yet finished).

    Edit: a couple of other refleak builders have finished and also crashed on test.test_dataclasses.TestCase.test_dataclasses_qualnames with no other issues.

  4. JelleZijlstra commented on Aug 20, 2024

    @JelleZijlstra
    JelleZijlstra
    on Aug 20, 2024
    Member

    Stack trace:

    Details 
    (lldb) bt
* thread #1, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x8)
  * frame #0: 0x00000001001d8fe8 python.exe`_PyEval_EvalFrameDefault(tstate=<unavailable>, frame=0x0000000100a11400, throwflag=0) at generated_cases.c.h:1038:17 [opt]
    frame #1: 0x00000001000965e8 python.exe`_PyObject_VectorcallTstate(tstate=0x00000001005e1a00, callable=0x000000010103a210, args=0x000000016fdfd910, nargsf=2, kwnames=0x0000000000000000) at pycore_call.h:167:11 [opt]
    frame #2: 0x0000000100095614 python.exe`method_vectorcall(method=<unavailable>, args=0x0000000101c35f08, nargsf=<unavailable>, kwnames=0x0000000000000000) at classobject.c:92:18 [opt]
    frame #3: 0x00000001001da7a8 python.exe`_PyEval_EvalFrameDefault(tstate=<unavailable>, frame=<unavailable>, throwflag=0) at generated_cases.c.h:1623:30 [opt]
    frame #4: 0x0000000100091fc8 python.exe`_PyObject_VectorcallDictTstate(tstate=0x00000001005e1a00, callable=0x000000010103a450, args=0x000000016fdfdc00, nargsf=2, kwargs=0x0000000000000000) at call.c:135:15 [opt]
    frame #5: 0x000000010009317c python.exe`_PyObject_Call_Prepend(tstate=0x00000001005e1a00, callable=0x000000010103a450, obj=0x0000000101bc2610, args=0x0000000101c34640, kwargs=0x0000000000000000) at call.c:504:24 [opt]
    frame #6: 0x0000000100133f64 python.exe`slot_tp_call(self=0x0000000101bc2610, args=0x0000000101c34640, kwds=0x0000000000000000) at typeobject.c:9753:15 [opt]
    frame #7: 0x000000010009222c python.exe`_PyObject_MakeTpCall(tstate=0x00000001005e1a00, callable=0x0000000101bc2610, args=0x0000000100a111e0, nargs=4305523168, keywords=0x0000000000000000) at call.c:242:18 [opt]
    frame #8: 0x0000000100091e40 python.exe`_PyObject_VectorcallTstate(tstate=<unavailable>, callable=<unavailable>, args=<unavailable>, nargsf=<unavailable>, kwnames=<unavailable>) at pycore_call.h:165:16 [opt] [artificial]
    frame #9: 0x0000000100092ca8 python.exe`PyObject_Vectorcall(callable=<unavailable>, args=<unavailable>, nargsf=<unavailable>, kwnames=<unavailable>) at call.c:327:12 [opt] [artificial]
    frame #10: 0x00000001001dd50c python.exe`_PyEval_EvalFrameDefault(tstate=<unavailable>, frame=0x0000000100a11148, throwflag=0) at generated_cases.c.h:2569:35 [opt]
    frame #11: 0x00000001000965e8 python.exe`_PyObject_VectorcallTstate(tstate=0x00000001005e1a00, callable=0x000000010104dcd0, args=0x000000016fdfdf90, nargsf=2, kwnames=0x0000000000000000) at pycore_call.h:167:11 [opt]
    frame #12: 0x0000000100095614 python.exe`method_vectorcall(method=<unavailable>, args=0x0000000101c36908, nargsf=<unavailable>, kwnames=0x0000000000000000) at classobject.c:92:18 [opt]
    frame #13: 0x00000001001da7a8 python.exe`_PyEval_EvalFrameDefault(tstate=<unavailable>, frame=<unavailable>, throwflag=0) at generated_cases.c.h:1623:30 [opt]
    frame #14: 0x0000000100091fc8 python.exe`_PyObject_VectorcallDictTstate(tstate=0x00000001005e1a00, callable=0x000000010104db50, args=0x000000016fdfe280, nargsf=2, kwargs=0x0000000000000000) at call.c:135:15 [opt]
    frame #15: 0x000000010009317c python.exe`_PyObject_Call_Prepend(tstate=0x00000001005e1a00, callable=0x000000010104db50, obj=0x0000000101a83ea0, args=0x0000000101c34e10, kwargs=0x0000000000000000) at call.c:504:24 [opt]
    frame #16: 0x0000000100133f64 python.exe`slot_tp_call(self=0x0000000101a83ea0, args=0x0000000101c34e10, kwds=0x0000000000000000) at typeobject.c:9753:15 [opt]
    frame #17: 0x000000010009222c python.exe`_PyObject_MakeTpCall(tstate=0x00000001005e1a00, callable=0x0000000101a83ea0, args=0x0000000100a110a0, nargs=4305522848, keywords=0x0000000000000000) at call.c:242:18 [opt]
    frame #18: 0x0000000100091e40 python.exe`_PyObject_VectorcallTstate(tstate=<unavailable>, callable=<unavailable>, args=<unavailable>, nargsf=<unavailable>, kwnames=<unavailable>) at pycore_call.h:165:16 [opt] [artificial]
    frame #19: 0x0000000100092ca8 python.exe`PyObject_Vectorcall(callable=<unavailable>, args=<unavailable>, nargsf=<unavailable>, kwnames=<unavailable>) at call.c:327:12 [opt] [artificial]
    frame #20: 0x00000001001dd50c python.exe`_PyEval_EvalFrameDefault(tstate=<unavailable>, frame=0x0000000100a11008, throwflag=0) at generated_cases.c.h:2569:35 [opt]
    frame #21: 0x00000001000965e8 python.exe`_PyObject_VectorcallTstate(tstate=0x00000001005e1a00, callable=0x000000010104dcd0, args=0x000000016fdfe610, nargsf=2, kwnames=0x0000000000000000) at pycore_call.h:167:11 [opt]
    frame #22: 0x0000000100095614 python.exe`method_vectorcall(method=<unavailable>, args=0x0000000101617268, nargsf=<unavailable>, kwnames=0x0000000000000000) at classobject.c:92:18 [opt]
    frame #23: 0x00000001001da7a8 python.exe`_PyEval_EvalFrameDefault(tstate=<unavailable>, frame=<unavailable>, throwflag=0) at generated_cases.c.h:1623:30 [opt]
    frame #24: 0x0000000100091fc8 python.exe`_PyObject_VectorcallDictTstate(tstate=0x00000001005e1a00, callable=0x000000010104db50, args=0x000000016fdfe900, nargsf=2, kwargs=0x0000000000000000) at call.c:135:15 [opt]
    frame #25: 0x000000010009317c python.exe`_PyObject_Call_Prepend(tstate=0x00000001005e1a00, callable=0x000000010104db50, obj=0x0000000101bc4f40, args=0x0000000101a07c50, kwargs=0x0000000000000000) at call.c:504:24 [opt]
    frame #26: 0x0000000100133f64 python.exe`slot_tp_call(self=0x0000000101bc4f40, args=0x0000000101a07c50, kwds=0x0000000000000000) at typeobject.c:9753:15 [opt]
    frame #27: 0x000000010009222c python.exe`_PyObject_MakeTpCall(tstate=0x00000001005e1a00, callable=0x0000000101bc4f40, args=0x0000000100a10f70, nargs=4305522544, keywords=0x0000000000000000) at call.c:242:18 [opt]
    frame #28: 0x0000000100091e40 python.exe`_PyObject_VectorcallTstate(tstate=<unavailable>, callable=<unavailable>, args=<unavailable>, nargsf=<unavailable>, kwnames=<unavailable>) at pycore_call.h:165:16 [opt] [artificial]
    frame #29: 0x0000000100092ca8 python.exe`PyObject_Vectorcall(callable=<unavailable>, args=<unavailable>, nargsf=<unavailable>, kwnames=<unavailable>) at call.c:327:12 [opt] [artificial]
    frame #30: 0x00000001001dd50c python.exe`_PyEval_EvalFrameDefault(tstate=<unavailable>, frame=0x0000000100a10f00, throwflag=0) at generated_cases.c.h:2569:35 [opt]
    frame #31: 0x00000001001d5374 python.exe`PyEval_EvalCode [inlined] _PyEval_EvalFrame(tstate=0x00000001005e1a00, frame=<unavailable>, throwflag=0) at pycore_ceval.h:119:16 [opt]
    frame #32: 0x00000001001d533c python.exe`PyEval_EvalCode [inlined] _PyEval_Vector(tstate=0x00000001005e1a00, func=0x0000000100a72390, locals=0x0000000100a6fcb0, args=0x0000000000000000, argcount=0, kwnames=0x0000000000000000) at ceval.c:1819:12 [opt]
    frame #33: 0x00000001001d52e8 python.exe`PyEval_EvalCode(co=0x0000000100a99690, globals=0x0000000100a6fcb0, locals=0x0000000100a6fcb0) at ceval.c:618:21 [opt]
    frame #34: 0x00000001001d0bc4 python.exe`builtin_exec at bltinmodule.c:1145:17 [opt]
    frame #35: 0x00000001001d0944 python.exe`builtin_exec(module=<unavailable>, args=<unavailable>, nargs=<unavailable>, kwnames=<unavailable>) at bltinmodule.c.h:556:20 [opt]
    frame #36: 0x00000001000f1550 python.exe`cfunction_vectorcall_FASTCALL_KEYWORDS(func=0x00000001009cd1f0, args=0x0000000100a10190, nargsf=9223372036854775810, kwnames=0x0000000000000000) at methodobject.c:441:24 [opt]
    frame #37: 0x0000000100091dd0 python.exe`_PyObject_VectorcallTstate(tstate=0x00000001005e1a00, callable=0x00000001009cd1f0, args=0x0000000100a10190, nargsf=9223372036854775810, kwnames=0x0000000000000000) at pycore_call.h:167:11 [opt]
    frame #38: 0x0000000100092ca8 python.exe`PyObject_Vectorcall(callable=<unavailable>, args=<unavailable>, nargsf=<unavailable>, kwnames=<unavailable>) at call.c:327:12 [opt] [artificial]
    frame #39: 0x00000001001d8a0c python.exe`_PyEval_EvalFrameDefault(tstate=<unavailable>, frame=<unavailable>, throwflag=0) at generated_cases.c.h:916:35 [opt]
    frame #40: 0x00000001002989a4 python.exe`pymain_run_module(modname=<unavailable>, set_argv0=1) at main.c:349:14 [opt]
    frame #41: 0x0000000100297dc0 python.exe`Py_RunMain [inlined] pymain_run_python(exitcode=0x000000016fdff074) at main.c:0 [opt]
    frame #42: 0x00000001002979dc python.exe`Py_RunMain at main.c:775:5 [opt]
    frame #43: 0x0000000100298830 python.exe`pymain_main(args=0x000000016fdff408) at main.c:805:12 [opt]
    frame #44: 0x00000001002988a4 python.exe`Py_BytesMain(argc=<unavailable>, argv=<unavailable>) at main.c:829:12 [opt]
    frame #45: 0x00000001945020e0 dyld`start + 2360

    Apparently new_frame is NULL here:

    cpython/Python/bytecodes.c

    Line 3475 in f88c14d

    assert(new_frame->previous == frame || new_frame->previous->previous == frame);

  5. Eclips4 commented on Aug 20, 2024

    @Eclips4
    Eclips4
    on Aug 20, 2024
    MemberAuthor

    Here's the minimal reproducible example without dataclasses:

    class Foo:
    def __init__(self, arg): pass

for _ in range(2):
    try:
        Foo()
    except:
        pass
  6. Eclips4
    added
    3.14bugs and security fixes
    on Aug 20, 2024

  7. markshannon commented on Aug 21, 2024

    @markshannon
    markshannon
    on Aug 21, 2024
    Member

    @Eclips4 thanks for the triaging. It looks like I accidentally removed an error check when refactoring.

  8. markshannon
    self-assigned this
    on Aug 21, 2024
  9. markshannon
    added a commit that references this issue on Aug 21, 2024

    GH-123185: Check for `NULL` after calling `_PyEvalFramePushAndInit` (G…

    1eba8ba

  10. JelleZijlstra commented on Aug 21, 2024

    @JelleZijlstra
    JelleZijlstra
    on Aug 21, 2024
    Member

    Thanks Mark for the fix!

  11. JelleZijlstra
    closed this as completedon Aug 21, 2024
  12. blhsing
    added a commit that references this issue on Aug 22, 2024

    pythonGH-123185: Check for `NULL` after calling `_PyEvalFramePushAndI…

    1edd433
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

3.14bugs and security fixestype-bugAn unexpected behavior, bug, or errortype-crashA hard crash of the interpreter, possibly with a core dump

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions