Destructing _datetime in sub-interpreters in the same time may crash the process

Crash report

What happened?

from concurrent.futures import InterpreterPoolExecutor


executor = InterpreterPoolExecutor()


def f():
    import _datetime
    print(_datetime)


executor.submit(f)
executor.submit(f)

executor.shutdown()

This code may lead to a interpreter crash:

PS C:\Users\xxxxx\Source\cpython> .\python.bat .\a.py
Running Debug|x64 interpreter...
<module '_datetime' (built-in)>
<module '_datetime' (built-in)>
Debug memory block at address p=000002340D505A70: API '?
    15987178197214944733 bytes originally requested
    The 7 pad bytes at p-7 are not all FORBIDDENBYTE (0xfd):
        at p-7: 0xdd *** OUCH
        at p-6: 0xdd *** OUCH
        at p-5: 0xdd *** OUCH
        at p-4: 0xdd *** OUCH
        at p-3: 0xdd *** OUCH
        at p-2: 0xdd *** OUCH
        at p-1: 0xdd *** OUCH
    Because memory is corrupted at the start, the count of bytes requested
       may be bogus, and checking the trailing pad bytes may segfault.
    The 8 pad bytes at tail=DDDDE011EB2E384D are

I think there is a double free here.

Please note that there is a similar issue may crash the interpreter but in the initializing phase: #136421

CPython versions tested on:

CPython main branch

Operating systems tested on:

macOS, Windows

Output from running 'python -VV' on the command line:

Python 3.15.0a0 (heads/main:ba9c1986305, Jul 8 2025, 22:13:18) [MSC v.1943 64 bit (AMD64)]

@ericsnowcurrently

cc @ericsnowcurrently

I encountered the same bug while using the C Python API.

It seems like Py_TPFLAGS_READY is cleared before managed_static_type_state_clear(), which conficts with _PyStaticType_InitForExtension() then crashes at _PyObject_ClearFreeLists().

cpython/Objects/typeobject.c

Lines 6606 to 6616 in db47f4d

    
               if (final) { 
        
                   BEGIN_TYPE_LOCK(); 
        
                   type_clear_flags(type, Py_TPFLAGS_READY); 
        
                   set_version_unlocked(type, 0); 
        
                   END_TYPE_LOCK(); 
        
               } 
        
               _PyStaticType_ClearWeakRefs(interp, type); 
        
               managed_static_type_state_clear(interp, type, isbuiltin, final); 
        
               /* We leave _Py_TPFLAGS_STATIC_BUILTIN set on tp_flags. */ 
        
           }

managed_static_type_state_clear() invokes:

cpython/Objects/typeobject.c

Lines 254 to 258 in db47f4d

    
           static inline void 
        
           managed_static_type_index_clear(PyTypeObject *self) 
        
           { 
        
               self->tp_subclasses = NULL; 
        
           }

So, a possible workaround only for this issue would be:

 int
 _PyStaticType_InitForExtension(PyInterpreterState *interp, PyTypeObject *self)
 {
-    return init_static_type(interp, self, 0, ((self->tp_flags & Py_TPFLAGS_READY) == 0));
+    return init_static_type(interp, self, 0, self->tp_subclasses == NULL);
 }

Fixed by #136583

Navigation Menu

Repository navigation

Destructing `_datetime` in sub-interpreters in the same time may crash the process #136423

Crash report

What happened?

CPython versions tested on:

Operating systems tested on:

Output from running 'python -VV' on the command line:

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

	if (final) {
	BEGIN_TYPE_LOCK();
	type_clear_flags(type, Py_TPFLAGS_READY);
	set_version_unlocked(type, 0);
	END_TYPE_LOCK();
	}

	_PyStaticType_ClearWeakRefs(interp, type);
	managed_static_type_state_clear(interp, type, isbuiltin, final);
	/* We leave _Py_TPFLAGS_STATIC_BUILTIN set on tp_flags. */
	}

	static inline void
	managed_static_type_index_clear(PyTypeObject *self)
	{
	self->tp_subclasses = NULL;
	}

Destructing _datetime in sub-interpreters in the same time may crash the process #136423

Description

Crash report

What happened?

CPython versions tested on:

Operating systems tested on:

Output from running 'python -VV' on the command line:

Activity

aisk commented on Jul 8, 2025

seuwebber commented on Jul 9, 2025

neonene commented on Jul 12, 2025

kumaraditya303 commented on Jul 21, 2025

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions

Destructing `_datetime` in sub-interpreters in the same time may crash the process #136423