René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Deadlock when element `__repr__` mutates the list via list `__repr__`","articleBody":"### What happened?\n\n`list.__repr__` holds a read-lock on the backing vector while rendering elements. If any element's `__repr__` mutates the same list (e.g., `append`), the re-entrant call blocks on the write-lock while `__repr__` waits for the element to finish, producing a hard deadlock instead of a Python-level exception.\n\n**Proof of Concept:**\n```python\nclass Evil:\n    def __repr__(self):\n        lst.append(1)\n        return \"evil\"\n\nlst = [Evil()]\nprint(lst)\n```\n\n\n\u003cdetails\u003e\n\u003csummary\u003e\u003cstrong\u003eAffected Versions\u003c/strong\u003e\u003c/summary\u003e\n\n| RustPython Version | Status | Exit Code |\n|---|---|---|\n| `Python 3.13.0alpha (heads/main-dirty:21300f689, Dec 13 2025, 22:16:49)  [RustPython 0.4.0 with rustc 1.90.0-nightly (11ad40bb8 2025-06-28)]` | Deadlock | 124 |\n\u003c/details\u003e\n\n\u003cdetails\u003e\n\u003csummary\u003e\u003cstrong\u003eVulnerable Code\u003c/strong\u003e\u003c/summary\u003e\n\n```c\nfn repr_str(zelf: \u0026Py\u003cSelf\u003e, vm: \u0026VirtualMachine) -\u003e PyResult\u003cString\u003e {\n    if zelf.__len__() == 0 {\n        return Ok(\"[]\".to_owned());\n    }\n    if let Some(_guard) = ReprGuard::enter(vm, zelf.as_object()) {\n        let iter = zelf.borrow_vec().iter(); // holds a read lock on elements for the whole render\n        return collection_repr(None, \"[\", \"]\", iter, vm); // re-enters element __repr__ while lock is held\n    }\n    Ok(\"[...]\".to_owned())\n}\n\npub(crate) fn collection_repr\u003c'a, I\u003e(\n    class_name: Option\u003c\u0026str\u003e,\n    prefix: \u0026str,\n    suffix: \u0026str,\n    iter: I,\n    vm: \u0026VirtualMachine,\n) -\u003e PyResult\u003cString\u003e\nwhere\n    I: Iterator\u003cItem = \u0026'a PyObjectRef\u003e,\n{\n    let mut repr = String::new();\n    let mut parts_iter = iter.map(|o| o.repr(vm)); // re-enters Python-level __repr__ for each element\n    repr.push_str(\n        parts_iter\n            .next()\n            .transpose()?\n            .expect(\"this is not called for empty collection\")\n            .as_str(),\n    );\n    // ...\n}\n\n#[pymethod]\npub(crate) fn append(\u0026self, x: PyObjectRef) {\n    self.borrow_vec_mut().push(x); // attempts write lock while read lock from repr_str is held -\u003e deadlock\n}\n```\n\u003c/details\u003e\n\n\u003cdetails\u003e\n\u003csummary\u003e\u003cstrong\u003eRust Output\u003c/strong\u003e\u003c/summary\u003e\n\n```\nProgram hangs forever\n```\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003e\u003cstrong\u003eCPython Output\u003c/strong\u003e\u003c/summary\u003e\n\n```\n[evil, 1]\n\n```\n\u003c/details\u003e\n\n","author":{"url":"https://github.com/jackfromeast","@type":"Person","name":"jackfromeast"},"datePublished":"2025-12-30T04:56:12.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":0},"url":"https://github.com/6591/RustPython/issues/6591"}