René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Segfault from `repr()` of a corrupted set","articleBody":"# Crash report\n\n### What happened?\n\nIt's possible to segfault the interpreter by corrupting a set, then calling `repr()` on it.\n\nMRE:\n```python\ntasks = set()\n\nclass Dummy(object):\n    def __hash__(self):\n        return 0\n\nclass CorrupTrigger():\n    counter = 0\n    def __hash__(self):\n        return 0\n    def __eq__(self,other):\n        if self.counter \u003c 1:\n            self.counter += 1\n            tasks.add(self)\n        return False\n\ntasks.add(Dummy())\ntasks.add(Dummy())\ntasks.pop()\ntasks.add(CorrupTrigger())\nrepr(tasks)\n```\n\nBacktrace:\n```\nProgram received signal SIGSEGV, Segmentation fault.\n0x0000555555b5b1e7 in Py_INCREF (op=0x0) at ./Include/refcount.h:281\n281         PY_UINT32_T cur_refcnt = op-\u003eob_refcnt;\n(gdb) bt\n#0  0x0000555555b5b1e7 in Py_INCREF (op=0x0) at ./Include/refcount.h:281\n#1  _Py_NewRef (obj=0x0) at ./Include/refcount.h:529\n#2  list_repr_impl (v=0x7c6ff6e72f60) at Objects/listobject.c:598\n#3  list_repr (self=0x7c6ff6e72f60) at Objects/listobject.c:638\n#4  0x0000555555bea219 in PyObject_Repr (v=v@entry=0x7c6ff6e72f60) at Objects/object.c:779\n#5  0x0000555555c3c4b7 in set_repr_lock_held (so=0x7d0ff6eb17a0) at Objects/setobject.c:594\n#6  set_repr (self=0x7d0ff6eb17a0) at Objects/setobject.c:622\n#7  0x0000555555bea219 in PyObject_Repr (v=0x7d0ff6eb17a0) at Objects/object.c:779\n#8  0x0000555555bd9b13 in cfunction_vectorcall_O (func=func@entry=0x7c7ff6e35d40, args=args@entry=0x7bfff5f70208, nargsf=nargsf@entry=9223372036854775809, kwnames=kwnames@entry=0x0)\n    at Objects/methodobject.c:536\n#9  0x0000555555aba6a0 in _PyObject_VectorcallTstate (tstate=0x555556aebf00 \u003c_PyRuntime+358560\u003e, callable=0x7c7ff6e35d40, args=0x7bfff5f70208, nargsf=9223372036854775809, kwnames=0x0)\n    at ./Include/internal/pycore_call.h:169\n#10 0x0000555555e8cf61 in _PyEval_EvalFrameDefault (tstate=\u003coptimized out\u003e, frame=\u003coptimized out\u003e, throwflag=\u003coptimized out\u003e) at Python/generated_cases.c.h:1620\n#11 0x0000555555e4a67b in _PyEval_EvalFrame (tstate=0x555556aebf00 \u003c_PyRuntime+358560\u003e, frame=0x7e8ff6de5220, throwflag=0) at ./Include/internal/pycore_ceval.h:121\n```\n\nIt's also possible to get `set_pop_impl` into an infinite loop by changing the last code block to:\n```python\ntasks.add(Dummy())\ntasks.add(Dummy())\ntasks.pop()\ntasks.add(CorrupTrigger())\ntasks.pop()\ntasks.pop()\ntasks.pop()\n```\n\n\nFound when trying to simplify the MRE in https://github.com/python/cpython/issues/139071. \n\n### CPython versions tested on:\n\nCPython main branch\n\n### Operating systems tested on:\n\nLinux\n\n### Output from running 'python -VV' on the command line:\n\nPython 3.15.0a2+ (heads/main-dirty:41b9ad5b38e, Nov 20 2025, 11:03:41) [Clang 21.1.2 (2ubuntu6)]\n\n\u003c!-- gh-linked-prs --\u003e\n### Linked PRs\n* gh-142007\n* gh-143815\n* gh-143849\n* gh-143853\n\u003c!-- /gh-linked-prs --\u003e\n","author":{"url":"https://github.com/devdanzin","@type":"Person","name":"devdanzin"},"datePublished":"2025-11-20T21:04:54.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":7},"url":"https://github.com/141805/cpython/issues/141805"}