René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"iter `__reduce__` can segfault if accessing `__builtins__.__dict__['iter']` mutates the iter object","articleBody":"# Crash report\r\n\r\nExample from @chilaxan\r\n```python\r\ncorrupt = iter(lambda:0, 0)\r\n\r\nclass Cstr:\r\n    def __hash__(self):\r\n        return hash('iter')\r\n    def __eq__(self, other):\r\n        [*corrupt]\r\n        return other == 'iter'\r\n\r\nbuiltins = __builtins__.__dict__ if hasattr(__builtins__, '__dict__') else __builtins__\r\noiter = builtins['iter']\r\ndel builtins['iter']\r\nbuiltins[Cstr()] = oiter\r\n\r\nprint(corrupt.__reduce__())\r\n```\r\n\r\n# Expected result\r\nThis should return a valid `__reduce__` tuple of the exhausted iterator. Instead behavior is inconsistent between segmentation faults, SystemErrors, and sometimes returning the iterator without being exhausted.\r\n\r\n# Error messages\r\n\r\n- 3.11, windows, `PYTHONMALLOC=debug`\r\n- 3.12.0a4, windows, `PYTHONMALLOC=debug`\r\n```py\r\nWindows fatal exception: access violation\r\n\u003e exit code -1073741819 (0xC0000005)\r\n```\r\n\r\n- 3.12.04a4, windows, compiled with debug mode\r\n```py\r\n    print(corrupt.__reduce__())\r\n          ^^^^^^^^^^^^^^^^^^^^\r\nSystemError: NULL object passed to Py_BuildValue\r\n```\r\n\r\n- 3.11, ubuntu\r\n```py\r\n(\u003cbuilt-in function iter\u003e, (\u003cfunction  at 0x7fb772c3c4a0\u003e, 0))\r\n\u003e terminated by signal SIGSEGV (Address boundary error)\r\n```\r\n- 3.12.0a4, ubuntu\r\n```py\r\n(\u003cbuilt-in function iter\u003e, (\u003cfunction  at 0x7f3480d71f80\u003e, 0))\r\n```\r\n- 3.12.0a4, ubuntu, `PYTHONMALLOC=debug`\r\n```py\r\nFatal Python error: Segmentation fault\r\n```\r\n\n\n\u003c!-- gh-linked-prs --\u003e\n### Linked PRs\n* gh-101769\n* gh-102228\n* gh-102229\n* gh-102265\n* gh-102268\n* gh-102269\n* gh-102283\n* gh-102285\n* gh-102286\n\u003c!-- /gh-linked-prs --\u003e\n","author":{"url":"https://github.com/ionite34","@type":"Person","name":"ionite34"},"datePublished":"2023-02-09T22:04:14.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":1},"url":"https://github.com/101765/cpython/issues/101765"}