René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Segfault from _PyDict_NewKeysForClass under memory pressure","articleBody":"# Crash report\n\n### What happened?\n\n```python\nimport _testcapi\n\ndef make_class():\n    class C:\n        def f(self):\n            self.x = 1\n\n    return C\n\nfor start in range(100):\n    _testcapi.set_nomemory(start, start + 1)\n    try:\n        x = make_class()\n    except MemoryError:\n        pass\n```\n\n```\nfish: Job 1, './python.exe staticattrs.py' terminated by signal SIGSEGV (Address boundary error)\n```\n\nIf an allocation failure happens when defining a class that has a non-empty `__static_attributes__`, then you can get a null pointer deref.\n\n### Root cause\n\nEarly during the class build process, `__static_attributes__` is correctly populated with the list of detected static attributes.\n\nThen later during PyType_Ready(): `type_ready_managed_dict` is called to make the shared key cache.\nThis calls `_PyDict_NewKeysForClass` and this line:\nhttps://github.com/python/cpython/blob/9f9787d83462f5b44cb59e3c69e7c1799612a33f/Objects/dictobject.c#L7219\n\nTries to allocate a keys object, and if that allocation fails, just clears the `MemoryError` and continues, skipping out some keys setup steps.\n\nHowever, later on in that `_PyDict_NewKeysForClass` it fetches the `__static_attributes__` tuple and tries to populate them into the keys object:\nhttps://github.com/python/cpython/blob/9f9787d83462f5b44cb59e3c69e7c1799612a33f/Objects/dictobject.c#L7232-L7238\n\nAnd `insert_split_key` reasonably assumes that `keys` is a valid Keys object, resulting in a relative pointer from NULL dereferenec.\n\n\n### Stacktrace\n\n```text\nframe #0  _DK_ENTRIES(dk=\u003cunavailable\u003e) at pycore_dict.h:269\nframe #1  do_lookup(mp=0x0, dk=0x0, ...) at dictobject.c:1090\nframe #2  unicodekeys_lookup_unicode(dk=0x0, ...) at dictobject.c:1183\nframe #3  insert_split_key(keys=0x0, ...) at dictobject.c:1931\nframe #4  _PyDict_NewKeysForClass(cls=0x0000aaaaabfffa70) at dictobject.c:7236\nframe #5  type_ready_managed_dict(type=0x0000aaaaabfffa70) at typeobject.c:9473\nframe #6  type_ready(...) at typeobject.c:9578\nframe #7  PyType_Ready(...) at typeobject.c:9622\n```\n\nInterestingly bisect failed here, because before this change, there was a different allocation failure segfault from class definition, so either this one is shadowing the other on (I'll check separately) or the other issue has already/accidentally been fixed.\n\n### Suggested fix.\n\nGiven that _PyDict_NewKeysForClass returns `keys` at the end anyway, it seems reasonable to just return NULL from the `keys == NULL` branch here:\nhttps://github.com/python/cpython/blob/9f9787d83462f5b44cb59e3c69e7c1799612a33f/Objects/dictobject.c#L7220-L7222\n\n\n### CPython versions tested on:\n\nCPython main branch\n\n### Operating systems tested on:\n\nLinux\n\n### Output from running 'python -VV' on the command line:\n\nPython 3.16.0a0 (heads/main-dirty:639a552, Jul  4 2026, 21:13:52) [Clang 22.1.6 ]\n\n\u003c!-- gh-linked-prs --\u003e\n### Linked PRs\n* gh-153183\n\u003c!-- /gh-linked-prs --\u003e\n","author":{"url":"https://github.com/stestagg","@type":"Person","name":"stestagg"},"datePublished":"2026-07-06T10:13:17.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":1},"url":"https://github.com/153182/cpython/issues/153182"}