René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"PEP 709 segfault with nested comprehensions plus lambdas","articleBody":"This is another crasher related to PEP 709.\r\n\r\n```python\r\ndef f():\r\n    [([lambda: x for x in range(4)], lambda: x) for x in range(3)]\r\n```\r\n\r\nStack trace:\r\n\r\n\u003cdetails\u003e\r\n\r\n```\r\n(lldb) bt\r\n* thread #1, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x8)\r\n  * frame #0: 0x00000001001662f0 python.exe`Py_TYPE(ob=0x0000000000000000) at object.h:204:16 [opt]\r\n    frame #1: 0x000000010015d4e0 python.exe`_PyEval_EvalFrameDefault(tstate=\u003cunavailable\u003e, frame=0x0000000100a60020, throwflag=\u003cunavailable\u003e) at bytecodes.c:1398:31 [opt]\r\n    frame #2: 0x0000000100157c00 python.exe`_PyEval_EvalFrame(tstate=\u003cunavailable\u003e, frame=\u003cunavailable\u003e, throwflag=\u003cunavailable\u003e) at pycore_ceval.h:87:16 [opt]\r\n    frame #3: 0x0000000100157b20 python.exe`_PyEval_Vector(tstate=0x0000000100567f50, func=0x0000000100e19910, locals=0x0000000100e2cd70, args=0x0000000000000000, argcount=0, kwnames=0x0000000000000000) at ceval.c:1576:12 [opt]\r\n    frame #4: 0x0000000100157a0c python.exe`PyEval_EvalCode(co=0x0000000100e7a110, globals=0x0000000100e2cd70, locals=0x0000000100e2cd70) at ceval.c:567:21 [opt]\r\n    frame #5: 0x00000001001bcce0 python.exe`run_eval_code_obj(tstate=0x0000000100567f50, co=0x0000000100e7a110, globals=0x0000000100e2cd70, locals=0x0000000100e2cd70) at pythonrun.c:1695:9 [opt]\r\n    frame #6: 0x00000001001bae50 python.exe`run_mod(mod=\u003cunavailable\u003e, filename=\u003cunavailable\u003e, globals=0x0000000100e2cd70, locals=0x0000000100e2cd70, flags=\u003cunavailable\u003e, arena=\u003cunavailable\u003e) at pythonrun.c:1716:19 [opt]\r\n    frame #7: 0x00000001001ba42c python.exe`pyrun_file(fp=0x0000000209e4cd10, filename=0x0000000100e89b60, start=\u003cunavailable\u003e, globals=0x0000000100e2cd70, locals=0x0000000100e2cd70, closeit=1, flags=0x000000016fdff478) at pythonrun.c:1616:15 [opt]\r\n    frame #8: 0x00000001001b99dc python.exe`_PyRun_SimpleFileObject(fp=0x0000000209e4cd10, filename=0x0000000100e89b60, closeit=1, flags=0x000000016fdff478) at pythonrun.c:433:13 [opt]\r\n    frame #9: 0x00000001001b96cc python.exe`_PyRun_AnyFileObject(fp=0x0000000209e4cd10, filename=0x0000000100e89b60, closeit=1, flags=0x000000016fdff478) at pythonrun.c:78:15 [opt]\r\n    frame #10: 0x00000001001d9094 python.exe`pymain_run_file_obj(program_name=0x0000000100e89bd0, filename=0x0000000100e89b60, skip_source_first_line=0) at main.c:360:15 [opt]\r\n    frame #11: 0x00000001001d8c64 python.exe`pymain_run_file(config=0x000000010054a2c0) at main.c:379:15 [opt]\r\n    frame #12: 0x00000001001d8418 python.exe`pymain_run_python(exitcode=0x000000016fdff5dc) at main.c:610:21 [opt]\r\n    frame #13: 0x00000001001d82a0 python.exe`Py_RunMain at main.c:689:5 [opt]\r\n    frame #14: 0x00000001001d8518 python.exe`pymain_main(args=0x000000016fdff640) at main.c:719:12 [opt]\r\n    frame #15: 0x00000001001d855c python.exe`Py_BytesMain(argc=\u003cunavailable\u003e, argv=\u003cunavailable\u003e) at main.c:743:12 [opt]\r\n    frame #16: 0x0000000100003de4 python.exe`main(argc=\u003cunavailable\u003e, argv=\u003cunavailable\u003e) at python.c:15:12 [opt]\r\n    frame #17: 0x000000010086108c dyld`start + 520\r\n```\r\n\r\n\u003c/details\u003e\r\n\r\nInterestingly, this is an interpreter crash, not a compiler crash, even though we never call the function. The crash happens inside `COPY_FREE_VARS`, because the function's `func_closure` is NULL.\r\n\r\nWhen we disassemble it we can see why:\r\n\r\n```\r\n\u003e\u003e\u003e dis.dis(\"\"\"\r\n... def f():\r\n...     [([lambda: x for x in range(4)], lambda: x) for x in range(3)]\r\n... \"\"\")\r\n              0 COPY_FREE_VARS           1\r\n\r\n  0           2 RESUME                   0\r\n\r\n  2           4 LOAD_CONST               0 (\u003ccode object f at 0x104d2b740, file \"\u003cdis\u003e\", line 2\u003e)\r\n              6 MAKE_FUNCTION            0\r\n              8 STORE_NAME               0 (f)\r\n             10 RETURN_CONST             1 (None)\r\n\r\nDisassembly of \u003ccode object f at 0x104d2b740, file \"\u003cdis\u003e\", line 2\u003e:\r\n\u003csnip\u003e\r\n```\r\n\r\nThere is a `COPY_FREE_VARS` at the module scope, but there is no closure to copy at that level.\r\n\r\nStill reproduces with the fix from #104394 applied. cc @carljm \r\n\n\n\u003c!-- gh-linked-prs --\u003e\n### Linked PRs\n* gh-104442\n\u003c!-- /gh-linked-prs --\u003e\n","author":{"url":"https://github.com/JelleZijlstra","@type":"Person","name":"JelleZijlstra"},"datePublished":"2023-05-11T22:36:15.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":1},"url":"https://github.com/104404/cpython/issues/104404"}