René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Segfault when cleaning up after a MemoryError with deeply nested objects","articleBody":"# Crash report\n\n### What happened?\n\nWhen in memory-constrained situations, the following code generates a segfault on main:\n\n```python\nb = 9\nwhile True:\n    b = (b, None)\n```\n\nClearly, b grows to be an unbounded nested tuple, which eventually exhausts the memory.\nA MemoryError is correctly thrown, but during unwind, python tries to clean up the object, and this triggers a stack overflow.\n\n\u003cdetails\u003e\n\u003csummary\u003eExample stack\u003c/summary\u003e\n\n```\nProcess 369 stopped\n\nThread 1 \"fuzz_python\" stop reason = signal SIGSEGV\n  frame #0: frame #0: 0x0000aaaaaea31648 fuzz_python`tuple_dealloc(self=0x0000ffff9fa045e0) at tupleobject.c:256\n  frame #1: frame #1: 0x0000aaaaae9ccd54 fuzz_python`_Py_Dealloc(op=0x0000ffff9fa045e0) at object.c:3303:5\n  frame #2: frame #2: 0x0000aaaaaea3182c fuzz_python`Py_DECREF(op=\u003cunavailable\u003e) at refcount.h:427:9 [inlined]\n  frame #3: frame #3: 0x0000aaaaaea3180c fuzz_python`Py_XDECREF(op=\u003cunavailable\u003e) at refcount.h:520:9 [inlined]\n  frame #4: frame #4: 0x0000aaaaaea31804 fuzz_python`tuple_dealloc(self=0x0000ffff9fa04630) at tupleobject.c:277:9\n  frame #5: frame #5: 0x0000aaaaae9ccd54 fuzz_python`_Py_Dealloc(op=0x0000ffff9fa04630) at object.c:3303:5\n  frame #6: frame #6: 0x0000aaaaaea3182c fuzz_python`Py_DECREF(op=\u003cunavailable\u003e) at refcount.h:427:9 [inlined]\n  frame #7: frame #7: 0x0000aaaaaea3180c fuzz_python`Py_XDECREF(op=\u003cunavailable\u003e) at refcount.h:520:9 [inlined]\n...\n  frame #2709: frame #2709: 0x0000aaaaae9ccd54 fuzz_python`_Py_Dealloc(op=0x0000ffff9fa11cd0) at object.c:3303:5\n  frame #2710: frame #2710: 0x0000aaaaaea3182c fuzz_python`Py_DECREF(op=\u003cunavailable\u003e) at refcount.h:427:9 [inlined]\n  frame #2711: frame #2711: 0x0000aaaaaea3180c fuzz_python`Py_XDECREF(op=\u003cunavailable\u003e) at refcount.h:520:9 [inlined]\n  frame #2712: frame #2712: 0x0000aaaaaea31804 fuzz_python`tuple_dealloc(self=0x0000ffff9fa11d20) at tupleobject.c:277:9\n  frame #2713: frame #2713: 0x0000aaaaae9ccd54 fuzz_python`_Py_Dealloc(op=0x0000ffff9fa11d20) at object.c:3303:5\n  frame #2714: frame #2714: 0x0000aaaaaea3182c fuzz_python`Py_DECREF(op=\u003cunavailable\u003e) at refcount.h:427:9 [inlined]\n  frame #2715: frame #2715: 0x0000aaaaaea3180c fuzz_python`Py_XDECREF(op=\u003cunavailable\u003e) at refcount.h:520:9 [inlined]\n  frame #2716: frame #2716: 0x0000aaaaaea31804 fuzz_python`tuple_dealloc(self=0x0000ffff9fa11d70) at tupleobject.c:277:9\n  frame #2717: frame #2717: 0x0000aaaaae9ccd54 fuzz_python`_Py_Dealloc(op=0x0000ffff9fa11d70) at object.c:3303:5\n  frame #2718: frame #2718: 0x0000aaaaaea3182c fuzz_python`Py_DECREF(op=\u003cunavailable\u003e) at refcount.h:427:9 [inlined]\n  frame #2719: frame #2719: 0x0000aaaaaea3180c fuzz_python`Py_XDECREF(op=\u003cunavailable\u003e) at refcount.h:520:9 [inlined]\n  frame #2720: frame #2720: 0x0000aaaaaea31804 fuzz_python`tuple_dealloc(self=0x0000ffff9fa11dc0) at tupleobject.c:277:9\n  frame #2721: frame #2721: 0x0000aaaaae9ccd54 fuzz_python`_Py_Dealloc(op=0x0000ffff9fa11dc0) at object.c:3303:5\n  frame #2722: frame #2722: 0x0000aaaaae98f290 fuzz_python`Py_DECREF(op=\u003cunavailable\u003e) at refcount.h:427:9 [inlined]\n  frame #2723: frame #2723: 0x0000aaaaae98f26c fuzz_python`Py_XDECREF(op=\u003cunavailable\u003e) at refcount.h:520:9 [inlined]\n  frame #2724: frame #2724: 0x0000aaaaae98f26c fuzz_python`dictkeys_decref(dk=0x0000ffffbe045210, use_qsbr=false) at dictobject.c:495:17\n  frame #2725: frame #2725: 0x0000aaaaae98630c fuzz_python`dict_dealloc(self=0x0000ffffbe055f40) at dictobject.c:0\n  frame #2726: frame #2726: 0x0000aaaaae9ccd54 fuzz_python`_Py_Dealloc(op=0x0000ffffbe055f40) at object.c:3303:5\n  frame #2727: frame #2727: 0x0000aaaaae7ecb8c fuzz_python`Py_DECREF(op=0x0000ffffbe055f40) at refcount.h:427:9 [inlined]\n  frame #2728: frame #2728: 0x0000aaaaae7ecb58 fuzz_python`main(argc=1, argv=0x0000fffff67f4238) at fuzz_python.c:226:17\n  frame #2729: frame #2729: 0x0000ffffbe1e1f9c ld-musl-aarch64.so.1`libc_start_main_stage2(main=(fuzz_python`main at fuzz_python.c:71), argc=1, argv=0x0000fffff67f4238) at __libc_start_main.c:95:2\n```\n\n\u003c/details\u003e\n\nThe following dockerfile reliably reproduces it for me:\n\n\u003cdetails\u003e\n\u003csummary\u003eDockerfile\u003c/summary\u003e\n\n```\nFROM alpine:latest\n\nRUN apk add --no-cache \\\n    git build-base linux-headers openssl-dev zlib-dev bzip2-dev \\\n    xz-dev sqlite-dev readline-dev libffi-dev ncurses-dev gdbm-dev \\\n    tcl-dev tk-dev\n\nWORKDIR /src\nRUN git clone --depth=1 https://github.com/python/cpython.git\nWORKDIR /src/cpython\nRUN ./configure \u0026\u0026 make -j2\n\nRUN cat \u003e /tc.py \u003c\u003c'PY'\nb = 9\nwhile True:\n    b = (b, None)\nPY\n\nRUN cat \u003e /entrypoint.sh \u003c\u003c'SH'\n#!/bin/sh\n\necho \"Running test\"\n# 512 MiB virtual memory limit\nulimit -v 524288\n\n/src/cpython/python /tc.py\necho \"Python process exited with code $?\"\nSH\n\nRUN chmod +x /entrypoint.sh\nENTRYPOINT [\"/entrypoint.sh\"]\n```\n\n\u003c/details\u003e\n\nGives me:\n```\n\u003edocker run --rm -it 29apr\nRunning test\nTraceback (most recent call last):\n  File \"/tc.py\", line 3, in \u003cmodule\u003e\nobject address  : 0xffffae809fc0\nobject refcount : 3\nobject type     : 0xaaaad32175a8\nobject type name: MemoryError\nobject repr     : MemoryError()\nlost sys.stderr\nSegmentation fault\nPython process exited with code 139\n```\n\nISTR that stack overflows from recursive objects were at least considered low priority, if not 'not worth fixing' before, but I can't recall where I read that, it was a while ago, so apologies if this isn't a useful report!\n\n\n\n### CPython versions tested on:\n\nCPython main branch\n\n### Operating systems tested on:\n\nLinux\n\n### Output from running 'python -VV' on the command line:\n\nPython 3.15.0a8+ (heads/main:d4eee16, Apr 29 2026, 11:03:26) [GCC 15.2.0]\n\n\u003c!-- gh-linked-prs --\u003e\n### Linked PRs\n* gh-151595\n\u003c!-- /gh-linked-prs --\u003e\n","author":{"url":"https://github.com/stestagg","@type":"Person","name":"stestagg"},"datePublished":"2026-04-29T11:14:31.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":10},"url":"https://github.com/149146/cpython/issues/149146"}