Skip to content

Segfault with async generator expressions #149122

Description

@stestagg

Crash report

What happened?

Running:

tuple(await 2 for _ in [])

on main causes a segfault:

backtrace
(lldb) bt
* thread #1, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x0)
  * frame #0: 0x0000000000000000
    frame #1: 0x00000001001b1e34 python.exe`_PyForIter_VirtualIteratorNext(tstate=0x00000001004df800, frame=0x0000000100678020, iter=<unavailable>, index_ptr=<unavailable>) at ceval.c:3717:22 [opt]
    frame #2: 0x00000001001aa02c python.exe`_PyEval_EvalFrameDefault(tstate=<unavailable>, frame=0x0000000100678020, throwflag=<unavailable>) at generated_cases.c.h:6093:36 [opt]
    frame #3: 0x00000001001a2ff4 python.exe`_PyEval_EvalFrame(tstate=0x00000001004df800, frame=<unavailable>, throwflag=0) at pycore_ceval.h:118:16 [opt] [inlined]
    frame #4: 0x00000001001a2fe8 python.exe`_PyEval_Vector(tstate=0x00000001004df800, func=0x000000010514b530, locals=0x000000010514e540, args=0x0000000000000000, argcount=0, kwnames=0x0000000000000000) at ceval.c:2124:12 [opt] [inlined]
    frame #5: 0x00000001001a2fe8 python.exe`PyEval_EvalCode(co=<unavailable>, globals=0x000000010514e540, locals=0x000000010514e540) at ceval.c:686:21 [opt]
    frame #6: 0x0000000100225080 python.exe`run_eval_code_obj(tstate=<unavailable>, co=<unavailable>, globals=<unavailable>, locals=<unavailable>) at pythonrun.c:1369:12 [opt] [artificial]
    frame #7: 0x0000000100224ec0 python.exe`run_mod(mod=0x00000008ec416678, filename=0x00000001050f68d0, globals=0x000000010514e540, locals=<unavailable>, flags=<unavailable>, arena=0x000000010503a2f0, interactive_src=<unavailable>, generate_new_source=<unavailable>) at pythonrun.c:1472:19 [opt]
    frame #8: 0x0000000100222108 python.exe`pyrun_file(fp=0x0000000203f788d0, filename=0x00000001050f68d0, start=257, globals=0x000000010514e540, locals=0x000000010514e540, closeit=1, flags=0x000000016fdfe7f8) at pythonrun.c:1296:15 [opt] [inlined]
    frame #9: 0x000000010022209c python.exe`_PyRun_SimpleFileObject(fp=0x0000000203f788d0, filename=0x00000001050f68d0, closeit=1, flags=0x000000016fdfe7f8) at pythonrun.c:518:13 [opt]
    frame #10: 0x0000000100221ad8 python.exe`_PyRun_AnyFileObject(fp=0x0000000203f788d0, filename=0x00000001050f68d0, closeit=1, flags=0x000000016fdfe7f8) at pythonrun.c:81:15 [opt]
    frame #11: 0x000000010024baf0 python.exe`pymain_run_file_obj(program_name=0x00000001050f69c0, filename=0x00000001050f68d0, skip_source_first_line=0) at main.c:411:15 [opt] [inlined]
    frame #12: 0x000000010024bab4 python.exe`pymain_run_file(config=0x00000001004aa820) at main.c:430:15 [opt]
    frame #13: 0x000000010024b34c python.exe`pymain_run_python(exitcode=0x000000016fdfe8d4) at main.c:715:21 [opt] [inlined]
    frame #14: 0x000000010024af2c python.exe`Py_RunMain at main.c:796:5 [opt]
    frame #15: 0x000000010024b644 python.exe`pymain_main(args=0x000000016fdfebe0) at main.c:826:12 [opt]
    frame #16: 0x000000010024b6e4 python.exe`Py_BytesMain(argc=<unavailable>, argv=<unavailable>) at main.c:850:12 [opt]
    frame #17: 0x00000001978e1d54 dyld`start + 7184
(lldb)

The regression was introduced by:
#131738: optimize builtin any/all/tuple calls with a generator expression arg (#131737)

I'm guessing the missing syntax check means we have an async iter inside the call, and the optimized path is assunming it's a sync iter? I'm not an expert here.

Reproducible on Macos and linux builds.

CPython versions tested on:

CPython main branch

Operating systems tested on:

Linux

Output from running 'python -VV' on the command line:

Python 3.14.3 (main, Feb 19 2026, 15:40:46) [Clang 17.0.0 (clang-1700.6.3.2)]

Linked PRs

Activity

  1. added
    type-crashA hard crash of the interpreter, possibly with a core dump
    on Apr 29, 2026
  2. stestagg commented on Apr 29, 2026

    @stestagg
    ContributorAuthor

    Tagging the commit author: @iritkatriel

  3. changed the title [-]Segfault with invalid await and inline-for in tuple()/any/all call gh-131738[/-] [+]Segfault with async generator expressions[/+] on Apr 29, 2026
  4. iritkatriel commented on Apr 29, 2026

    @iritkatriel
    Member

    Thank you @stestagg. I've submitted a fix.

  5. added
    3.14bugs and security fixes
    3.15bugs and security fixes
    and removed on Apr 29, 2026
  6. added 2 commits that reference this issue on Apr 29, 2026
  7. added a commit that references this issue on Apr 29, 2026
  8. encukou commented on Apr 30, 2026

    @encukou
    Member

    This introduced a refleak.

  9. added a commit that references this issue on Apr 30, 2026
  10. added a commit that references this issue on Apr 30, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    3.14bugs and security fixes3.15bugs and security fixesinterpreter-core(Objects, Python, Grammar, and Parser dirs)type-crashA hard crash of the interpreter, possibly with a core dump

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions