Errors during array module import result in double-DECREF

Crash report

What happened?

In DEBUG build:

import collections.abc

del collections.abc.MutableSequence
import array

or:

sys.setrecursionlimit(25)
import array

generates a double DECREF on the array ArrayType object due to poisoned module state:

Python/gc.c:96: gc_decref: Assertion "gc_get_refs(g) > 0" failed: refcount is too small
object type name: type
object repr     : <class 'array.array'>
Fatal Python error: _PyObject_AssertFailed: _PyObject_AssertFailed

Analysis

So, array_modexec creates the ArrayType and assigns it to array state:

cpython/Modules/arraymodule.c

Line 3400 in 836b206

CREATE_TYPE(m, state->ArrayType, &array_spec);

It then goes on to do some other setup tasks, and if any of these fail, it DECREF's state->ArrayType but leaves the type object on the state struct:

cpython/Modules/arraymodule.c

Lines 3409 to 3421 in 836b206

    
           PyObject *mutablesequence = PyImport_ImportModuleAttrString( 
        
                   "collections.abc", "MutableSequence"); 
        
           if (!mutablesequence) { 
        
               Py_DECREF((PyObject *)state->ArrayType); 
        
               return -1; 
        
           } 
        
           PyObject *res = PyObject_CallMethod(mutablesequence, "register", "O", 
        
                                               (PyObject *)state->ArrayType); 
        
           Py_DECREF(mutablesequence); 
        
           if (!res) { 
        
               Py_DECREF((PyObject *)state->ArrayType); 
        
               return -1; 
        
           }

Returning -1 error code.

PyModule_ExecDef passes the -1 up the chain:

cpython/Objects/moduleobject.c

Line 793 in 0514489

return -1;

which ends up with an exception in _bootstrap.py:

cpython/Lib/importlib/_bootstrap.py

Lines 910 to 915 in 0514489

    
           except: 
        
               try: 
        
                   del sys.modules[spec.name] 
        
               except KeyError: 
        
                   pass 
        
               raise

At this point, the array module refcount falls and it's cleaned up, and array_clear calls:

cpython/Modules/arraymodule.c

Line 3346 in 2d7a74e

Py_CLEAR(state->ArrayType);

because the ArrayType pointer is still in the module state, this generates the double DECREF

CPython versions tested on:

CPython main branch

Operating systems tested on:

Linux

Output from running 'python -VV' on the command line:

Python 3.16.0a0 (heads/main-dirty:1034e73, Jul 6 2026, 11:11:46) [Clang 22.1.6 ]

Linked PRs

Indeed, I also found several other problems with the setup. I will send a PR, thanks for the report! 👍

@sobolevn

@sobolevn Haha, we got there at the same time :), I'll withdraw mine

gh-153210: Fix `array` module import crash under a memory pressure (#…

[3.13] gh-153210: Fix `array` module import crash under a memory pres…

@sobolevn

@sobolevn I'm seeing failures with from array import ArrayType: https://github.com/coveragepy/coveragepy/actions/runs/28859740335

It also happens with newly built main:

% /usr/local/cpython/bin/python3.16
Python 3.16.0a0 (heads/main:2cd5b79284d, Jul  7 2026, 07:09:41) [Clang 21.0.0 (clang-2100.1.1.101)] on darwin
Type "help", "copyright", "credits" or "license" for more information.
>>> from array import ArrayType
Traceback (most recent call last):
  File "<python-input-0>", line 1, in <module>
    from array import ArrayType
ImportError: cannot import name 'ArrayType' from 'array' (/usr/local/cpython/lib/python3.16/lib-dynload/array.cpython-316-darwin.so)

Building from the commit before this fix:

% /usr/local/cpython/bin/python3.16
Python 3.16.0a0 (tags/v3.15.0b1-901-g35c6779c7b5:35c6779c7b5, Jul  7 2026, 07:35:22) [Clang 21.0.0 (clang-2100.1.1.101)] on darwin
Type "help", "copyright", "credits" or "license" for more information.
>>> from array import ArrayType
>>>

@nedbat

@nedbat thanks for the report! on it :)

[3.14] gh-153210: Fix `array` module import crash under a memory pres…

[3.15] gh-153210: Fix `array` module import crash under a memory pres…

gh-153210: Restore accidental `array.ArrayType` removal (#153261)

[3.14] gh-153210: Restore accidental `array.ArrayType` removal (GH-15…

[3.15] gh-153210: Restore accidental `array.ArrayType` removal (GH-15…

[3.13] gh-153210: Restore accidental `array.ArrayType` removal (GH-15…

Navigation Menu

Repository navigation

Errors during `array` module import result in double-DECREF #153210

Crash report

What happened?

Analysis

CPython versions tested on:

Operating systems tested on:

Output from running 'python -VV' on the command line:

Linked PRs

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

	PyObject *mutablesequence = PyImport_ImportModuleAttrString(
	"collections.abc", "MutableSequence");
	if (!mutablesequence) {
	Py_DECREF((PyObject *)state->ArrayType);
	return -1;
	}
	PyObject *res = PyObject_CallMethod(mutablesequence, "register", "O",
	(PyObject *)state->ArrayType);
	Py_DECREF(mutablesequence);
	if (!res) {
	Py_DECREF((PyObject *)state->ArrayType);
	return -1;
	}

	except:
	try:
	del sys.modules[spec.name]
	except KeyError:
	pass
	raise

Errors during array module import result in double-DECREF #153210

Description

Crash report

What happened?

Analysis

CPython versions tested on:

Operating systems tested on:

Output from running 'python -VV' on the command line:

Linked PRs

Activity

sobolevn commented on Jul 6, 2026

stestagg commented on Jul 6, 2026

nedbat commented on Jul 7, 2026

nedbat commented on Jul 7, 2026

sobolevn commented on Jul 7, 2026

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions

Errors during `array` module import result in double-DECREF #153210