René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Deadlock when `__len__` re-enters `__length_hint__` via list iterator","articleBody":"### What happened?\n\n`iterator.__length_hint__` holds its internal `PyMutex` while calling the sequence’s `__len__`. A user `__len__` can call back into the same `__length_hint__`, which immediately blocks on the already-held mutex and deadlocks the interpreter instead of raising an error or progressing the iterator.\n\n**Proof of Concept:**\n```python\nit = None\n\nclass Evil:\n    def __getitem__(self, index):\n        if index == 0:\n            return 0\n        raise IndexError\n\n    def __len__(self):\n        it.__length_hint__()\n        return 1\n\nobj = Evil()\nit = iter(obj)\nit.__length_hint__()\n```\n\n\n\u003cdetails\u003e\n\u003csummary\u003e\u003cstrong\u003eAffected Versions\u003c/strong\u003e\u003c/summary\u003e\n\n| RustPython Version | Status | Exit Code |\n|---|---|---|\n| `Python 3.13.0alpha (heads/main-dirty:21300f689, Dec 13 2025, 22:16:49)  [RustPython 0.4.0 with rustc 1.90.0-nightly (11ad40bb8 2025-06-28)]` | Deadlock | 124 |\n\u003c/details\u003e\n\n\u003cdetails\u003e\n\u003csummary\u003e\u003cstrong\u003eVulnerable Code\u003c/strong\u003e\u003c/summary\u003e\n\n```c\n#[pymethod]\nfn __length_hint__(\u0026self, vm: \u0026VirtualMachine) -\u003e PyObjectRef {\n    let internal = self.internal.lock(); // holds PyMutex across user callbacks\n    if let IterStatus::Active(obj) = \u0026internal.status {\n        let seq = PySequence { obj, methods: self.seq_methods };\n        seq.length(vm) // invokes user __len__. PoC calls iterator.__length_hint__ again while lock is held\n            .map(|x| PyInt::from(x).into_pyobject(vm))\n            .unwrap_or_else(|_| vm.ctx.not_implemented())\n    } else {\n        PyInt::from(0).into_pyobject(vm)\n    }\n}\n// Inner __length_hint__ call tries to lock the same mutex again, blocking forever → deadlock.\n```\n\u003c/details\u003e\n\n\u003cdetails\u003e\n\u003csummary\u003e\u003cstrong\u003eRust Output\u003c/strong\u003e\u003c/summary\u003e\n\n```\nProgram hangs forever\n```\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003e\u003cstrong\u003eCPython Output\u003c/strong\u003e\u003c/summary\u003e\n\n```\nTraceback (most recent call last):\n  File \"\u003cstring\u003e\", line 15, in \u003cmodule\u003e\n  File \"\u003cstring\u003e\", line 10, in __len__\n  File \"\u003cstring\u003e\", line 10, in __len__\n  File \"\u003cstring\u003e\", line 10, in __len__\n  [Previous line repeated 496 more times]\nRecursionError: maximum recursion depth exceeded\n\n```\n\u003c/details\u003e\n\n","author":{"url":"https://github.com/jackfromeast","@type":"Person","name":"jackfromeast"},"datePublished":"2025-12-30T04:55:58.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":0},"url":"https://github.com/6590/RustPython/issues/6590"}