Segfault with 3.14.2t and trio

Crash report

What happened?

import trio

async def main() -> None:
    task = trio.lowlevel.current_task()
    task._schedule_points = "hello!"  # type: ignore
    await trio.lowlevel.checkpoint()

trio.run(main)

I reproduced using trio from source, but the version from PyPI (tested with v0.32.0) will work as well.

Note that using non-free-threading builds does not cause segfaults. This same reproducer used to segfault in #133932 but this new version doesn't even need GC to do so.

CPython versions tested on:

3.14

Operating systems tested on:

macOS

Output from running 'python -VV' on the command line:

Python 3.14.2 free-threading build (main, Dec 5 2025, 21:11:07) [Clang 21.1.4 ]

For the record, here's the output I see with faulthandler:

(314venv) a5rocks@whimsy ~/D/trio> python -X faulthandler repro.py
Traceback (most recent call last):
  File "/Users/a5rocks/Documents/trio/314venv/lib/python3.14t/site-packages/trio/_core/_run.py", line 2901, in unrolled_run
    task._schedule_points += 1
TypeError: can only concatenate str (not "int") to str

The above exception was the direct cause of the following exception:

Traceback (most recent call last):
  File "/Users/a5rocks/Documents/trio/repro.py", line 8, in <module>
    trio.run(main)
    ~~~~~~~~^^^^^^
  File "/Users/a5rocks/Documents/trio/314venv/lib/python3.14t/site-packages/trio/_core/_run.py", line 2538, in run
    timeout = gen.send(next_send)
  File "/Users/a5rocks/Documents/trio/314venv/lib/python3.14t/site-packages/trio/_core/_run.py", line 2951, in unrolled_run
    raise TrioInternalError("internal error in Trio - please file a bug!") from exc
trio.TrioInternalError: internal error in Trio - please file a bug!
Exception ignored while calling deallocator <function Nursery.__del__ at 0x29eb52d7d40>:
Traceback (most recent call last):
  File "/Users/a5rocks/Documents/trio/314venv/lib/python3.14t/site-packages/trio/_core/_run.py", line 1486, in __del__
AssertionError:
Exception ignored while calling deallocator <function Nursery.__del__ at 0x29eb52d7d40>:
Traceback (most recent call last):
  File "/Users/a5rocks/Documents/trio/314venv/lib/python3.14t/site-packages/trio/_core/_run.py", line 1486, in __del__
AssertionError:
Exception ignored while closing generator <coroutine object Runner.init at 0x29eb5698880>:
RuntimeError: coroutine ignored GeneratorExit
<sys>:0: RuntimeWarning: coroutine 'EntryQueue.task' was never awaited
Fatal Python error: Segmentation fault

<Cannot show all threads while the GIL is disabled>
Stack (most recent call first):
  <no Python frame>

Current thread's C stack trace (most recent call first):
  Binary file "/Users/a5rocks/.local/share/uv/python/cpython-3.14.2+freethreaded-macos-aarch64-none/lib/libpython3.14t.dylib", at _Py_DumpStack+0x44 [0x106b23e64]
  Binary file "/Users/a5rocks/.local/share/uv/python/cpython-3.14.2+freethreaded-macos-aarch64-none/lib/libpython3.14t.dylib", at faulthandler_dump_c_stack+0x54 [0x106ba497c]
  Binary file "/Users/a5rocks/.local/share/uv/python/cpython-3.14.2+freethreaded-macos-aarch64-none/lib/libpython3.14t.dylib", at faulthandler_fatal_error+0x168 [0x106ba47d8]
  Binary file "/usr/lib/system/libsystem_platform.dylib", at _sigtramp+0x38 [0x197017744]
  Binary file "/Users/a5rocks/.local/share/uv/python/cpython-3.14.2+freethreaded-macos-aarch64-none/lib/libpython3.14t.dylib", at _PyFrame_ClearExceptCode+0xd0 [0x1062c3020]
  Binary file "/Users/a5rocks/.local/share/uv/python/cpython-3.14.2+freethreaded-macos-aarch64-none/lib/libpython3.14t.dylib", at gen_dealloc+0x230 [0x1064e48a0]
  Binary file "/Users/a5rocks/.local/share/uv/python/cpython-3.14.2+freethreaded-macos-aarch64-none/lib/libpython3.14t.dylib", at _Py_DecRefShared+0xd8 [0x106258044]
  Binary file "/Users/a5rocks/.local/share/uv/python/cpython-3.14.2+freethreaded-macos-aarch64-none/lib/libpython3.14t.dylib", at gc_collect_main.llvm.13496483152696758370+0x1084 [0x106257b54]
  Binary file "/Users/a5rocks/.local/share/uv/python/cpython-3.14.2+freethreaded-macos-aarch64-none/lib/libpython3.14t.dylib", at finalize_modules+0x1138 [0x10648ed00]
  Binary file "/Users/a5rocks/.local/share/uv/python/cpython-3.14.2+freethreaded-macos-aarch64-none/lib/libpython3.14t.dylib", at _Py_Finalize.llvm.5044709651631156071+0x1e0 [0x106461298]
  Binary file "/Users/a5rocks/.local/share/uv/python/cpython-3.14.2+freethreaded-macos-aarch64-none/lib/libpython3.14t.dylib", at Py_RunMain+0x1f4 [0x106460654]
  Binary file "/Users/a5rocks/.local/share/uv/python/cpython-3.14.2+freethreaded-macos-aarch64-none/lib/libpython3.14t.dylib", at pymain_main+0x1d4 [0x10641fd84]
  Binary file "/Users/a5rocks/.local/share/uv/python/cpython-3.14.2+freethreaded-macos-aarch64-none/lib/libpython3.14t.dylib", at Py_BytesMain+0x24 [0x10641fba4]
  Binary file "/usr/lib/dyld", at start+0x1c10 [0x196c45d54]
fish: Job 1, 'python -X faulthandler repro.py' terminated by signal SIGSEGV (Address boundary error)

I am not able to reproduce the segfault on macOS (or Linux). I get the following error. I also see similar errors for other versions of Python:

> uv run -p 3.14.2t --with git+https://github.com/python-trio/trio python issue142421.py

Traceback (most recent call last):
  File "/Users/sgross/.cache/uv/archive-v0/i8vlkNofx20G1Rc-pY56W/lib/python3.14t/site-packages/trio/_core/_run.py", line 2901, in unrolled_run
    task._schedule_points += 1
TypeError: can only concatenate str (not "int") to str

The above exception was the direct cause of the following exception:

Traceback (most recent call last):
  File "/Users/sgross/issue142421.py", line 8, in <module>
    trio.run(main)
    ~~~~~~~~^^^^^^
  File "/Users/sgross/.cache/uv/archive-v0/i8vlkNofx20G1Rc-pY56W/lib/python3.14t/site-packages/trio/_core/_run.py", line 2538, in run
    timeout = gen.send(next_send)
  File "/Users/sgross/.cache/uv/archive-v0/i8vlkNofx20G1Rc-pY56W/lib/python3.14t/site-packages/trio/_core/_run.py", line 2951, in unrolled_run
    raise TrioInternalError("internal error in Trio - please file a bug!") from exc
trio.TrioInternalError: internal error in Trio - please file a bug!
Exception ignored while calling deallocator <function Nursery.__del__ at 0x548d7357440>:
Traceback (most recent call last):
  File "/Users/sgross/.cache/uv/archive-v0/i8vlkNofx20G1Rc-pY56W/lib/python3.14t/site-packages/trio/_core/_run.py", line 1486, in __del__
AssertionError:
Exception ignored while calling deallocator <function Nursery.__del__ at 0x548d7357440>:
Traceback (most recent call last):
  File "/Users/sgross/.cache/uv/archive-v0/i8vlkNofx20G1Rc-pY56W/lib/python3.14t/site-packages/trio/_core/_run.py", line 1486, in __del__
AssertionError:
Exception ignored while closing generator <coroutine object Runner.init at 0x548d77ea500>:
Traceback (most recent call last):
  File "/Users/sgross/.cache/uv/archive-v0/i8vlkNofx20G1Rc-pY56W/lib/python3.14t/site-packages/trio/_core/_run.py", line 2156, in init
  File "/Users/sgross/.cache/uv/archive-v0/i8vlkNofx20G1Rc-pY56W/lib/python3.14t/site-packages/trio/_core/_run.py", line 1112, in __aexit__
  File "/Users/sgross/.cache/uv/archive-v0/i8vlkNofx20G1Rc-pY56W/lib/python3.14t/site-packages/trio/_core/_run.py", line 1288, in _nested_child_finished
  File "/Users/sgross/.cache/uv/archive-v0/i8vlkNofx20G1Rc-pY56W/lib/python3.14t/site-packages/trio/_core/_run.py", line 1252, in _add_exc
  File "/Users/sgross/.cache/uv/archive-v0/i8vlkNofx20G1Rc-pY56W/lib/python3.14t/site-packages/trio/_core/_run.py", line 933, in _cancel
  File "/Users/sgross/.cache/uv/archive-v0/i8vlkNofx20G1Rc-pY56W/lib/python3.14t/site-packages/trio/_core/_run.py", line 501, in recalculate
  File "/Users/sgross/.cache/uv/archive-v0/i8vlkNofx20G1Rc-pY56W/lib/python3.14t/site-packages/trio/_core/_run.py", line 1671, in _attempt_delivery_of_any_pending_cancel
  File "/Users/sgross/.cache/uv/archive-v0/i8vlkNofx20G1Rc-pY56W/lib/python3.14t/site-packages/trio/_core/_run.py", line 1644, in _attempt_abort
  File "/Users/sgross/.cache/uv/archive-v0/i8vlkNofx20G1Rc-pY56W/lib/python3.14t/site-packages/trio/_core/_io_kqueue.py", line 162, in abort
  File "/Users/sgross/.cache/uv/archive-v0/i8vlkNofx20G1Rc-pY56W/lib/python3.14t/site-packages/trio/_core/_io_kqueue.py", line 184, in abort
ValueError: I/O operation on closed kqueue object

@A5rocks

@A5rocks - since I'm having trouble reproducing the segfault, can you provide some more details:

What version of macOS are you using? ARM (Apple Silicon) or Intel?
Does this crash every time or only some of the time?
Does it segfault with the debug build uv run -p 3.14.2.td (and if so, is there any more detailed info)?
Does the 3.14.2 (GIL-enabled) build segfault?

Also, does it crash in 3.14.1t or 3.14.0t for you? It wasn't clear to me from the title if those versions don't crash or just haven't been tested.

I'm able to reproduce this on linux using debug builds of 3.14.{0,1,2} but only in the free-threaded build. The repro from the original issue also segfaults on debug builds of 3.14.{0,1,2} but again only in the free-threaded build. Here's the C stacktrace for the new repro:

(gdb) bt
#0  _Py_atomic_load_uint32_relaxed (obj=0x7fa) at ./Include/cpython/pyatomic_gcc.h:367
#1  _Py_IsImmortal (op=0x7ee) at ./Include/refcount.h:128
#2  PyStackRef_IsHeapSafe (stackref=...) at ./Include/internal/pycore_stackref.h:328
#3  PyStackRef_MakeHeapSafe (stackref=...) at ./Include/internal/pycore_stackref.h:336
#4  _PyFrame_Copy (dest=0x200012ae8e8, src=0x200012acf68) at ./Include/internal/pycore_interpframe.h:153
#5  take_ownership (f=f@entry=0x200012ae890, frame=frame@entry=0x200012acf68) at Python/frame.c:54
#6  0x00000000006e632b in _PyFrame_ClearExceptCode (frame=frame@entry=0x200012acf68) at Python/frame.c:120
#7  0x00000000004eea72 in gen_clear_frame (gen=gen@entry=0x200012acf10) at Objects/genobject.c:154
#8  0x00000000004f0154 in gen_dealloc (self=self@entry=0x200012acf10) at Objects/genobject.c:182
#9  0x000000000054f948 in _Py_Dealloc (op=op@entry=0x200012acf10) at Objects/object.c:3072
#10 0x000000000054fb1f in _Py_DecRefSharedDebug (o=o@entry=0x200012acf10, filename=filename@entry=0x8d59b6 "Python/gc_free_threading.c", lineno=lineno@entry=1684)
    at Objects/object.c:423
#11 0x00000000006e91d9 in Py_DECREF (op=0x200012acf10, lineno=1684, filename=0x8d59b6 "Python/gc_free_threading.c") at ./Include/refcount.h:357
#12 delete_garbage (state=state@entry=0x7ffdebfdbaa0) at Python/gc_free_threading.c:1684
#13 0x00000000006eb9f4 in gc_collect_internal (interp=0xadcf00 <_PyRuntime+131648>, state=state@entry=0x7ffdebfdbaa0, generation=generation@entry=2)
    at Python/gc_free_threading.c:2257
#14 0x00000000006ebb32 in gc_collect_main (tstate=tstate@entry=0xb155c0 <_PyRuntime+362752>, generation=generation@entry=2, reason=reason@entry=_Py_GC_REASON_SHUTDOWN)
    at Python/gc_free_threading.c:2327
#15 0x00000000006ebe4e in _PyGC_CollectNoFail (tstate=tstate@entry=0xb155c0 <_PyRuntime+362752>) at Python/gc_free_threading.c:2642
#16 0x0000000000736a19 in finalize_modules (tstate=tstate@entry=0xb155c0 <_PyRuntime+362752>) at Python/pylifecycle.c:1788
#17 0x000000000073721e in _Py_Finalize (runtime=runtime@entry=0xabccc0 <_PyRuntime>) at Python/pylifecycle.c:2144
#18 0x00000000007372bc in Py_FinalizeEx () at Python/pylifecycle.c:2267
#19 0x0000000000777648 in Py_RunMain () at Modules/main.c:777
#20 0x0000000000777697 in pymain_main (args=args@entry=0x7ffdebfdbc40) at Modules/main.c:805
#21 0x000000000077770c in Py_BytesMain (argc=<optimized out>, argv=<optimized out>) at Modules/main.c:829
#22 0x000000000042092f in main (argc=<optimized out>, argv=<optimized out>) at ./Programs/python.c:15
(gdb)

I think the root cause is that the fix for the original issue was only applied to the default build.

@mpage

@mpage - do you want to make a PR or should I?

@colesbury

@colesbury - Can you put one up? If not, I should have some time tomorrow.

Going to mark this as a duplicate of #133932 because it's the same underlying problem. The PR will be associated with that issue.

Navigation Menu

Repository navigation

Segfault with 3.14.2t and trio #142421

Crash report

What happened?

CPython versions tested on:

Operating systems tested on:

Output from running 'python -VV' on the command line:

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Segfault with 3.14.2t and trio #142421

Description

Crash report

What happened?

CPython versions tested on:

Operating systems tested on:

Output from running 'python -VV' on the command line:

Activity

A5rocks commented on Dec 8, 2025

colesbury commented on Dec 8, 2025

colesbury commented on Dec 8, 2025

colesbury commented on Dec 8, 2025

mpage commented on Dec 8, 2025

colesbury commented on Dec 8, 2025

mpage commented on Dec 8, 2025

colesbury commented on Dec 8, 2025

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions