René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Deadlock when sentinel equality re-enters iterator via `iter(callable, sentinel)`","articleBody":"### What happened?\n\n`PyCallableIterator::next` keeps an upgradable read lock while comparing the callable result to the sentinel with `vm.bool_eq`. If the sentinel’s `__eq__` calls `next()` on the same iterator (as in the PoC), the re-entrant `next` blocks on the same lock, hanging the interpreter instead of finishing iteration.\n\n**Proof of Concept:**\n```python\nclass Evil:\n    def __init__(self):\n        self.it = None\n    def __eq__(self, other):\n        next(self.it)\n        return True\n\nevil = Evil()\nitr = iter(lambda: evil, evil)\nevil.it = itr\nnext(itr)\n```\n\n\n\u003cdetails\u003e\n\u003csummary\u003e\u003cstrong\u003eAffected Versions\u003c/strong\u003e\u003c/summary\u003e\n\n| RustPython Version | Status | Exit Code |\n|---|---|---|\n| `Python 3.13.0alpha (heads/main-dirty:21300f689, Dec 13 2025, 22:16:49)  [RustPython 0.4.0 with rustc 1.90.0-nightly (11ad40bb8 2025-06-28)]` | Deadlock | 124 |\n\u003c/details\u003e\n\n\u003cdetails\u003e\n\u003csummary\u003e\u003cstrong\u003eVulnerable Code\u003c/strong\u003e\u003c/summary\u003e\n\n```c\nfn next(zelf: \u0026Py\u003cSelf\u003e, vm: \u0026VirtualMachine) -\u003e PyResult\u003cPyIterReturn\u003e {\n    let status = zelf.status.upgradable_read(); // holds the lock across user comparisons\n    let next = if let IterStatus::Active(callable) = \u0026*status {\n        let ret = callable.invoke((), vm)?; // user callable returns a value that may be sentinel\n        if vm.bool_eq(\u0026ret, \u0026zelf.sentinel)? { // runs sentinel.__eq__, which can call next() again\n            *PyRwLockUpgradableReadGuard::upgrade(status) = IterStatus::Exhausted;\n            PyIterReturn::StopIteration(None)\n        } else {\n            PyIterReturn::Return(ret)\n        }\n    } else {\n        PyIterReturn::StopIteration(None)\n    };\n    Ok(next) // re-entrant next() blocks on the upgradable_read above, causing deadlock\n}\n```\n\u003c/details\u003e\n\n\u003cdetails\u003e\n\u003csummary\u003e\u003cstrong\u003eRust Output\u003c/strong\u003e\u003c/summary\u003e\n\n```\nError: Execution timed out\n```\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003e\u003cstrong\u003eCPython Output\u003c/strong\u003e\u003c/summary\u003e\n\n```\nTraceback (most recent call last):\n  File \"\u003cstring\u003e\", line 11, in \u003cmodule\u003e\nStopIteration\n\n```\n\u003c/details\u003e\n\n","author":{"url":"https://github.com/jackfromeast","@type":"Person","name":"jackfromeast"},"datePublished":"2025-12-30T04:55:44.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":0},"url":"https://github.com/6589/RustPython/issues/6589"}