René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"use-after-free: functools partial","articleBody":"# Bug report\n\n### Bug description:\n\nSimilar to https://github.com/python/cpython/issues/144475 although this is a use after free gap. \n\n```\ndef test_call_safety_against_reentrant_mutation(self):\n        partial = self.partial\n\n        def original(*args, **kwargs):\n            return \"original\"\n\n        def replacement(*args, **kwargs):\n            return \"replacement\"\n\n        g = None\n\n        class EvilKey(str):\n            armed = False\n            def __hash__(self):\n                if EvilKey.armed and g is not None:\n                    EvilKey.armed = False\n                    # Reset g, freeing the old (uniquely referenced) args\n                    # tuple.  New args of a different length avoid recycling\n                    # that freed block, so any dangling read hits freed memory.\n                    g.__setstate__((replacement, (), {\"k\": 1}, None))\n                    gc.collect()\n                return str.__hash__(self)\n            def __eq__(self, other):\n                return str.__eq__(self, other)\n\n        # Stored positionals (non-trivial pto->args) plus a stored keyword so\n        # the keyword-merge path -- which hashes the call keywords -- runs.\n        stored = tuple(object() for _ in range(5))\n        g = partial(original, *stored, k=0)\n        del stored\n\n        ek = EvilKey(\"zzz\")\n        kwargs = {ek: 2}          # hashed here while disarmed: no re-entrancy\n        EvilKey.armed = True\n        # Must not crash (use-after-free in the C partial before the fix).\n        g(**kwargs)\n        self.assertFalse(EvilKey.armed)  # the re-entrant __setstate__ ran\n```\n\nInside of `partial_vectorcall` we store a raw pointer of `pto->args` in `pto_args`, however with the EvilKey we can reset `pto->args` causing a UAF gap. \n\nUnsure how much of an issue this is though.\n\n\u003cdetails>\n./python.exe -m test test_functools -v -m test_call_safety_against_reentrant_mutation\n== CPython 3.16.0a0 free-threading build (heads/find-memory-leaks-dirty:69d44f80b5, Jul 19 2026, 20:02:27) [Clang 21.0.0 (clang-2100.0.123.102)]\n== macOS-26.3.2-arm64-arm-64bit-Mach-O little-endian\n== Python build: free_threading debug TSAN\n== cwd: /Users/johng/repos/cpython/build/test_python_worker_6548æ\n== CPU count: 18\n== encodings: locale=UTF-8 FS=utf-8\n== resources: all test resources are disabled, use -u option to unskip tests\n== sanitizers: thread\n\nUsing random seed: 952320050\n0:00:00 load avg: 4.25 mem: 131.7 MiB Run 1 test sequentially in a single process\n0:00:00 load avg: 4.25 mem: 131.7 MiB [1/1] test_functools\ntest_call_safety_against_reentrant_mutation (test.test_functools.TestPartialC.test_call_safety_against_reentrant_mutation) ... Fatal Python error: Segmentation fault\n\n\u003cCannot show all threads while the GIL is disabled>\nStack (most recent call first):\n  File \"/Users/johng/repos/cpython/Lib/test/test_functools.py\", line 622 in test_call_safety_against_reentrant_mutation\n  File \"/Users/johng/repos/cpython/Lib/unittest/case.py\", line 637 in _callTestMethod\n  File \"/Users/johng/repos/cpython/Lib/unittest/case.py\", line 691 in run\n  File \"/Users/johng/repos/cpython/Lib/unittest/case.py\", line 747 in __call__\n  File \"/Users/johng/repos/cpython/Lib/unittest/suite.py\", line 122 in run\n  File \"/Users/johng/repos/cpython/Lib/unittest/suite.py\", line 84 in __call__\n  File \"/Users/johng/repos/cpython/Lib/unittest/suite.py\", line 122 in run\n  File \"/Users/johng/repos/cpython/Lib/unittest/suite.py\", line 84 in __call__\n  File \"/Users/johng/repos/cpython/Lib/unittest/runner.py\", line 256 in run\n  File \"/Users/johng/repos/cpython/Lib/test/libregrtest/single.py\", line 84 in _run_suite\n  File \"/Users/johng/repos/cpython/Lib/test/libregrtest/single.py\", line 42 in run_unittest\n  File \"/Users/johng/repos/cpython/Lib/test/libregrtest/single.py\", line 162 in test_func\n  File \"/Users/johng/repos/cpython/Lib/test/libregrtest/single.py\", line 118 in regrtest_runner\n  File \"/Users/johng/repos/cpython/Lib/test/libregrtest/single.py\", line 165 in _load_run_test\n  File \"/Users/johng/repos/cpython/Lib/test/libregrtest/single.py\", line 210 in _runtest_env_changed_exc\n  File \"/Users/johng/repos/cpython/Lib/test/libregrtest/single.py\", line 319 in _runtest\n  File \"/Users/johng/repos/cpython/Lib/test/libregrtest/single.py\", line 348 in run_single_test\n  File \"/Users/johng/repos/cpython/Lib/test/libregrtest/main.py\", line 390 in run_test\n  File \"/Users/johng/repos/cpython/Lib/test/libregrtest/main.py\", line 425 in run_tests_sequentially\n  File \"/Users/johng/repos/cpython/Lib/test/libregrtest/main.py\", line 565 in _run_tests\n  File \"/Users/johng/repos/cpython/Lib/test/libregrtest/main.py\", line 600 in run_tests\n  File \"/Users/johng/repos/cpython/Lib/test/libregrtest/main.py\", line 793 in main\n  File \"/Users/johng/repos/cpython/Lib/test/libregrtest/main.py\", line 801 in main\n  File \"/Users/johng/repos/cpython/Lib/test/__main__.py\", line 2 in \u003cmodule>\n  File \"/Users/johng/repos/cpython/Lib/runpy.py\", line 87 in _run_code\n  File \"/Users/johng/repos/cpython/Lib/runpy.py\", line 201 in _run_module_as_main\n\nCurrent thread's C stack trace (most recent call first):\n  Binary file \"/Users/johng/repos/cpython/python.exe\", at _Py_DumpStack+0x44 [0x102720a10]\n  Binary file \"/Users/johng/repos/cpython/python.exe\", at faulthandler_fatal_error+0x2c4 [0x10274efac]\n  Binary file \"/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/lib/clang/21/lib/darwin/libclang_rt.tsan_osx_dynamic.dylib\", at _ZN6__tsanL21CallUserSignalHandlerEPNS_11ThreadStateEbbiPN11__sanitizer23__sanitizer_siginfo_padEPv+0xfc [0x103405274]\n  Binary file \"/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/lib/clang/21/lib/darwin/libclang_rt.tsan_osx_dynamic.dylib\", at _Z10sighandleriPN11__sanitizer23__sanitizer_siginfo_padEPv+0x1cc [0x1034054d4]\n  Binary file \"/usr/lib/system/libsystem_platform.dylib\", at _sigtramp+0x38 [0x1963f1764]\n  Binary file \"/Users/johng/repos/cpython/python.exe\", at partial_vectorcall+0x370 [0x10282204c]\n  Binary file \"/Users/johng/repos/cpython/python.exe\", at partial_vectorcall+0x370 [0x10282204c]\n  Binary file \"/Users/johng/repos/cpython/python.exe\", at _PyVectorcall_Call+0xe4 [0x10247f7b0]\n  Binary file \"/Users/johng/repos/cpython/python.exe\", at _PyEval_EvalFrameDefault+0x837c [0x102628d40]\n  Binary file \"/Users/johng/repos/cpython/python.exe\", at _PyEval_Vector+0x350 [0x10261ec5c]\n  Binary file \"/Users/johng/repos/cpython/python.exe\", at _PyObject_VectorcallTstate+0x74 [0x10247e938]\n  Binary file \"/Users/johng/repos/cpython/python.exe\", at _PyObject_VectorcallPrepend+0x154 [0x102480b4c]\n  Binary file \"/Users/johng/repos/cpython/python.exe\", at _PyEval_EvalFrameDefault+0x837c [0x102628d40]\n  Binary file \"/Users/johng/repos/cpython/python.exe\", at _PyEval_Vector+0x350 [0x10261ec5c]\n  Binary file \"/Users/johng/repos/cpython/python.exe\", at _PyObject_VectorcallDictTstate+0x170 [0x10247eb30]\n  Binary file \"/Users/johng/repos/cpython/python.exe\", at _PyObject_Call_Prepend+0xd4 [0x10247fdb4]\n  Binary file \"/Users/johng/repos/cpython/python.exe\", at call_method+0x9c [0x10255c8c0]\n  Binary file \"/Users/johng/repos/cpython/python.exe\", at _PyObject_MakeTpCall+0x120 [0x10247ed18]\n  Binary file \"/Users/johng/repos/cpython/python.exe\", at _Py_VectorCall_StackRefSteal+0x118 [0x10261ee60]\n  Binary file \"/Users/johng/repos/cpython/python.exe\", at _PyEval_EvalFrameDefault+0xb8cc [0x10262c290]\n  Binary file \"/Users/johng/repos/cpython/python.exe\", at _PyEval_Vector+0x350 [0x10261ec5c]\n  Binary file \"/Users/johng/repos/cpython/python.exe\", at _PyObject_VectorcallTstate+0x74 [0x10247e938]\n  Binary file \"/Users/johng/repos/cpython/python.exe\", at _PyObject_VectorcallPrepend+0x154 [0x102480b4c]\n  Binary file \"/Users/johng/repos/cpython/python.exe\", at _PyEval_EvalFrameDefault+0x798c [0x102628350]\n  Binary file \"/Users/johng/repos/cpython/python.exe\", at _PyEval_Vector+0x350 [0x10261ec5c]\n  Binary file \"/Users/johng/repos/cpython/python.exe\", at _PyObject_VectorcallDictTstate+0x170 [0x10247eb30]\n  Binary file \"/Users/johng/repos/cpython/python.exe\", at _PyObject_Call_Prepend+0xd4 [0x10247fdb4]\n  Binary file \"/Users/johng/repos/cpython/python.exe\", at call_method+0x9c [0x10255c8c0]\n  Binary file \"/Users/johng/repos/cpython/python.exe\", at _PyObject_MakeTpCall+0x120 [0x10247ed18]\n  Binary file \"/Users/johng/repos/cpython/python.exe\", at _Py_VectorCall_StackRefSteal+0x118 [0x10261ee60]\n  Binary file \"/Users/johng/repos/cpython/python.exe\", at _PyEval_EvalFrameDefault+0xb8cc [0x10262c290]\n  Binary file \"/Users/johng/repos/cpython/python.exe\", at _PyEval_Vector+0x350 [0x10261ec5c]\n  \u003ctruncated rest of calls>\n\nExtension modules: _testcapi (total: 1)\nThreadSanitizer:DEADLYSIGNAL\n==6548==ERROR: ThreadSanitizer: SEGV on unknown address 0x000000000000 (pc 0x0001024eb61c bp 0x00016da153e0 sp 0x00016da153a0 T35112809)\n==6548==The signal is caused by a READ memory access.                                                                                                                                                                             \n==6548==Hint: address points to the zero page.\n    #0 _PyDict_Contains_KnownHash dictobject.c:5315 (python.exe:arm64+0x10010b61c)\n    #1 partial_vectorcall _functoolsmodule.c:460 (python.exe:arm64+0x100442048)\n    #2 _PyVectorcall_Call call.c:285 (python.exe:arm64+0x10009f7ac)\n    #3 _PyEval_EvalFrameDefault generated_cases.c.h:3161 (python.exe:arm64+0x100248d3c)\n    #4 _PyEval_Vector ceval.c:2172 (python.exe:arm64+0x10023ec58)\n    #5 _PyObject_VectorcallTstate pycore_call.h:144 (python.exe:arm64+0x10009e934)\n    #6 _PyObject_VectorcallPrepend call.c:877 (python.exe:arm64+0x1000a0b48)\n    #7 _PyEval_EvalFrameDefault generated_cases.c.h:3161 (python.exe:arm64+0x100248d3c)\n    #8 _PyEval_Vector ceval.c:2172 (python.exe:arm64+0x10023ec58)\n    #9 _PyObject_VectorcallDictTstate call.c:135 (python.exe:arm64+0x10009eb2c)\n    #10 _PyObject_Call_Prepend call.c:504 (python.exe:arm64+0x10009fdb0)\n    #11 call_method typeobject.c:3100 (python.exe:arm64+0x10017c8bc)\n    #12 _PyObject_MakeTpCall call.c:242 (python.exe:arm64+0x10009ed14)\n    #13 _Py_VectorCall_StackRefSteal ceval.c:726 (python.exe:arm64+0x10023ee5c)\n    #14 _PyEval_EvalFrameDefault generated_cases.c.h:4559 (python.exe:arm64+0x10024c28c)\n    #15 _PyEval_Vector ceval.c:2172 (python.exe:arm64+0x10023ec58)\n    #16 _PyObject_VectorcallTstate pycore_call.h:144 (python.exe:arm64+0x10009e934)\n    #17 _PyObject_VectorcallPrepend call.c:877 (python.exe:arm64+0x1000a0b48)\n    #18 _PyEval_EvalFrameDefault generated_cases.c.h:2831 (python.exe:arm64+0x10024834c)\n    #19 _PyEval_Vector ceval.c:2172 (python.exe:arm64+0x10023ec58)\n    #20 _PyObject_VectorcallDictTstate call.c:135 (python.exe:arm64+0x10009eb2c)\n    #21 _PyObject_Call_Prepend call.c:504 (python.exe:arm64+0x10009fdb0)\n    #22 call_method typeobject.c:3100 (python.exe:arm64+0x10017c8bc)\n    #23 _PyObject_MakeTpCall call.c:242 (python.exe:arm64+0x10009ed14)\n    #24 _Py_VectorCall_StackRefSteal ceval.c:726 (python.exe:arm64+0x10023ee5c)\n    #25 _PyEval_EvalFrameDefault generated_cases.c.h:4559 (python.exe:arm64+0x10024c28c)\n    #26 _PyEval_Vector ceval.c:2172 (python.exe:arm64+0x10023ec58)\n    #27 _PyObject_VectorcallTstate pycore_call.h:144 (python.exe:arm64+0x10009e934)\n    #28 _PyObject_VectorcallPrepend call.c:877 (python.exe:arm64+0x1000a0b48)\n    #29 _PyEval_EvalFrameDefault generated_cases.c.h:3161 (python.exe:arm64+0x100248d3c)\n    #30 _PyEval_Vector ceval.c:2172 (python.exe:arm64+0x10023ec58)\n    #31 _PyObject_VectorcallDictTstate call.c:135 (python.exe:arm64+0x10009eb2c)\n    #32 _PyObject_Call_Prepend call.c:504 (python.exe:arm64+0x10009fdb0)\n    #33 call_method typeobject.c:3100 (python.exe:arm64+0x10017c8bc)\n    #34 _PyObject_MakeTpCall call.c:242 (python.exe:arm64+0x10009ed14)\n    #35 _Py_VectorCallInstrumentation_StackRefSteal ceval.c:768 (python.exe:arm64+0x10023f3a8)\n    #36 _PyEval_EvalFrameDefault generated_cases.c.h:1906 (python.exe:arm64+0x1002462d0)\n    #37 _PyEval_Vector ceval.c:2172 (python.exe:arm64+0x10023ec58)\n    #38 PyEval_EvalCode ceval.c:679 (python.exe:arm64+0x10023e708)\n    #39 builtin_exec bltinmodule.c.h:676 (python.exe:arm64+0x1002382a0)\n    #40 cfunction_vectorcall_FASTCALL_KEYWORDS methodobject.c:465 (python.exe:arm64+0x100126060)\n    #41 _PyObject_VectorcallTstate pycore_call.h:144 (python.exe:arm64+0x10009e934)\n    #42 _Py_VectorCallInstrumentation_StackRefSteal ceval.c:768 (python.exe:arm64+0x10023f3a8)\n    #43 _PyEval_EvalFrameDefault generated_cases.c.h:1906 (python.exe:arm64+0x1002462d0)\n    #44 _PyEval_Vector ceval.c:2172 (python.exe:arm64+0x10023ec58)\n    #45 pymain_run_module main.c:420 (python.exe:arm64+0x100351668)\n    #46 Py_RunMain main.c:891 (python.exe:arm64+0x1003510e8)\n    #47 pymain_main main.c:921 (python.exe:arm64+0x100351560)\n    #48 Py_BytesMain main.c:945 (python.exe:arm64+0x1003515b0)\n    #49 start \u003cnull> (dyld:arm64e+0x8d50)\n\n==6548==Register values:\n x[0] = 0xdddddddddddddddd   x[1] = 0x0000000302c51520   x[2] = 0x87e87aa3ff897c45   x[3] = 0x00000003035f6a80  \n x[4] = 0x00000001033fc6d8   x[5] = 0x0000000000000063   x[6] = 0x0000000000000070   x[7] = 0x0000000102b31ca0  \n x[8] = 0x0000000000000000   x[9] = 0x72331224a8250b2b  x[10] = 0x011062c8e6dcd17b  x[11] = 0x0000000000000002  \nx[12] = 0x000000000001c5af  x[13] = 0x591cdb992c3f488c  x[14] = 0x000000008f01dca6  x[15] = 0x011562c8e6dcd17b  \nx[16] = 0x00000001963f10b0  x[17] = 0x0000000103480820  x[18] = 0x0000000000000000  x[19] = 0x0000000303bf1510  \nx[20] = 0x0000000302c51520  x[21] = 0x87e87aa3ff897c45  x[22] = 0x00000003020917e8  x[23] = 0x0000000000000000  \nx[24] = 0x0000000102ad60d8  x[25] = 0x8000000000000000  x[26] = 0x0000000303bf04c0  x[27] = 0x0000000303bf0490  \nx[28] = 0x0000000000000000     fp = 0x000000016da153e0     lr = 0x000000010282204c     sp = 0x000000016da153a0  \nThreadSanitizer can not provide additional info.\nSUMMARY: ThreadSanitizer: SEGV dictobject.c:5315 in _PyDict_Contains_KnownHash\n==6548==ABORTING\nFatal Python error: Aborted\n\n\u003cCannot show all threads while the GIL is disabled>\nStack (most recent call first):\n  File \"/Users/johng/repos/cpython/Lib/test/test_functools.py\", line 622 in test_call_safety_against_reentrant_mutation\n  File \"/Users/johng/repos/cpython/Lib/unittest/case.py\", line 637 in _callTestMethod\n  File \"/Users/johng/repos/cpython/Lib/unittest/case.py\", line 691 in run\n  File \"/Users/johng/repos/cpython/Lib/unittest/case.py\", line 747 in __call__\n  File \"/Users/johng/repos/cpython/Lib/unittest/suite.py\", line 122 in run\n  File \"/Users/johng/repos/cpython/Lib/unittest/suite.py\", line 84 in __call__\n  File \"/Users/johng/repos/cpython/Lib/unittest/suite.py\", line 122 in run\n  File \"/Users/johng/repos/cpython/Lib/unittest/suite.py\", line 84 in __call__\n  File \"/Users/johng/repos/cpython/Lib/unittest/runner.py\", line 256 in run\n  File \"/Users/johng/repos/cpython/Lib/test/libregrtest/single.py\", line 84 in _run_suite\n  File \"/Users/johng/repos/cpython/Lib/test/libregrtest/single.py\", line 42 in run_unittest\n  File \"/Users/johng/repos/cpython/Lib/test/libregrtest/single.py\", line 162 in test_func\n  File \"/Users/johng/repos/cpython/Lib/test/libregrtest/single.py\", line 118 in regrtest_runner\n  File \"/Users/johng/repos/cpython/Lib/test/libregrtest/single.py\", line 165 in _load_run_test\n  File \"/Users/johng/repos/cpython/Lib/test/libregrtest/single.py\", line 210 in _runtest_env_changed_exc\n  File \"/Users/johng/repos/cpython/Lib/test/libregrtest/single.py\", line 319 in _runtest\n  File \"/Users/johng/repos/cpython/Lib/test/libregrtest/single.py\", line 348 in run_single_test\n  File \"/Users/johng/repos/cpython/Lib/test/libregrtest/main.py\", line 390 in run_test\n  File \"/Users/johng/repos/cpython/Lib/test/libregrtest/main.py\", line 425 in run_tests_sequentially\n  File \"/Users/johng/repos/cpython/Lib/test/libregrtest/main.py\", line 565 in _run_tests\n  File \"/Users/johng/repos/cpython/Lib/test/libregrtest/main.py\", line 600 in run_tests\n  File \"/Users/johng/repos/cpython/Lib/test/libregrtest/main.py\", line 793 in main\n  File \"/Users/johng/repos/cpython/Lib/test/libregrtest/main.py\", line 801 in main\n  File \"/Users/johng/repos/cpython/Lib/test/__main__.py\", line 2 in \u003cmodule>\n  File \"/Users/johng/repos/cpython/Lib/runpy.py\", line 87 in _run_code\n  File \"/Users/johng/repos/cpython/Lib/runpy.py\", line 201 in _run_module_as_main\n\nCurrent thread's C stack trace (most recent call first):\n  Binary file \"/Users/johng/repos/cpython/python.exe\", at _Py_DumpStack+0x44 [0x102720a10]\n  Binary file \"/Users/johng/repos/cpython/python.exe\", at faulthandler_fatal_error+0x2c4 [0x10274efac]\n  Binary file \"/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/lib/clang/21/lib/darwin/libclang_rt.tsan_osx_dynamic.dylib\", at _ZN6__tsanL21CallUserSignalHandlerEPNS_11ThreadStateEbbiPN11__sanitizer23__sanitizer_siginfo_padEPv+0xfc [0x103405274]\n  Binary file \"/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/lib/clang/21/lib/darwin/libclang_rt.tsan_osx_dynamic.dylib\", at _Z10sighandleriPN11__sanitizer23__sanitizer_siginfo_padEPv+0x1cc [0x1034054d4]\n  Binary file \"/usr/lib/system/libsystem_platform.dylib\", at _sigtramp+0x38 [0x1963f1764]\n  Binary file \"/usr/lib/system/libsystem_pthread.dylib\", at pthread_kill+0x128 [0x1963e7888]\n  Binary file \"/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/lib/clang/21/lib/darwin/libclang_rt.tsan_osx_dynamic.dylib\", at wrap_pthread_kill+0x144 [0x103405bbc]\n  Binary file \"/usr/lib/system/libsystem_c.dylib\", at abort+0x7c [0x1962ec850]\n  Binary file \"/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/lib/clang/21/lib/darwin/libclang_rt.tsan_osx_dynamic.dylib\", at _ZN11__sanitizer6AtexitEPFvvE+0x0 [0x1033e5dd8]\n  Binary file \"/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/lib/clang/21/lib/darwin/libclang_rt.tsan_osx_dynamic.dylib\", at _ZN11__sanitizer3DieEv+0x6c [0x1033e53d0]\n  Binary file \"/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/lib/clang/21/lib/darwin/libclang_rt.tsan_osx_dynamic.dylib\", at _ZN11__sanitizer13SignalContextC1EPvS1_+0x0 [0x1033f2b1c]\n  Binary file \"/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/lib/clang/21/lib/darwin/libclang_rt.tsan_osx_dynamic.dylib\", at _ZN6__tsanL21CallUserSignalHandlerEPNS_11ThreadStateEbbiPN11__sanitizer23__sanitizer_siginfo_padEPv+0xfc [0x103405274]\n  Binary file \"/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/lib/clang/21/lib/darwin/libclang_rt.tsan_osx_dynamic.dylib\", at _Z10sighandleriPN11__sanitizer23__sanitizer_siginfo_padEPv+0x1cc [0x1034054d4]\n  Binary file \"/usr/lib/system/libsystem_platform.dylib\", at _sigtramp+0x38 [0x1963f1764]\n  Binary file \"/Users/johng/repos/cpython/python.exe\", at partial_vectorcall+0x370 [0x10282204c]\n  Binary file \"/Users/johng/repos/cpython/python.exe\", at partial_vectorcall+0x370 [0x10282204c]\n  Binary file \"/Users/johng/repos/cpython/python.exe\", at _PyVectorcall_Call+0xe4 [0x10247f7b0]\n  Binary file \"/Users/johng/repos/cpython/python.exe\", at _PyEval_EvalFrameDefault+0x837c [0x102628d40]\n  Binary file \"/Users/johng/repos/cpython/python.exe\", at _PyEval_Vector+0x350 [0x10261ec5c]\n  Binary file \"/Users/johng/repos/cpython/python.exe\", at _PyObject_VectorcallTstate+0x74 [0x10247e938]\n  Binary file \"/Users/johng/repos/cpython/python.exe\", at _PyObject_VectorcallPrepend+0x154 [0x102480b4c]\n  Binary file \"/Users/johng/repos/cpython/python.exe\", at _PyEval_EvalFrameDefault+0x837c [0x102628d40]\n  Binary file \"/Users/johng/repos/cpython/python.exe\", at _PyEval_Vector+0x350 [0x10261ec5c]\n  Binary file \"/Users/johng/repos/cpython/python.exe\", at _PyObject_VectorcallDictTstate+0x170 [0x10247eb30]\n  Binary file \"/Users/johng/repos/cpython/python.exe\", at _PyObject_Call_Prepend+0xd4 [0x10247fdb4]\n  Binary file \"/Users/johng/repos/cpython/python.exe\", at call_method+0x9c [0x10255c8c0]\n  Binary file \"/Users/johng/repos/cpython/python.exe\", at _PyObject_MakeTpCall+0x120 [0x10247ed18]\n  Binary file \"/Users/johng/repos/cpython/python.exe\", at _Py_VectorCall_StackRefSteal+0x118 [0x10261ee60]\n  Binary file \"/Users/johng/repos/cpython/python.exe\", at _PyEval_EvalFrameDefault+0xb8cc [0x10262c290]\n  Binary file \"/Users/johng/repos/cpython/python.exe\", at _PyEval_Vector+0x350 [0x10261ec5c]\n  Binary file \"/Users/johng/repos/cpython/python.exe\", at _PyObject_VectorcallTstate+0x74 [0x10247e938]\n  Binary file \"/Users/johng/repos/cpython/python.exe\", at _PyObject_VectorcallPrepend+0x154 [0x102480b4c]\n  \u003ctruncated rest of calls>\n\nExtension modules: _testcapi (total: 1)\n[1]    6548 abort      ./python.exe -m test test_functools -v -m \n\u003c/details\n\n### CPython versions tested on:\n\nCPython main branch\n\n### Operating systems tested on:\n\nmacOS\n\n\u003c!-- gh-linked-prs -->\n### Linked PRs\n* gh-154284\n* gh-154508\n* gh-154652\n\u003c!-- /gh-linked-prs -->\n","author":{"url":"https://github.com/johng","@type":"Person","name":"johng"},"datePublished":"2026-07-19T19:09:26Z","url":"https://github.com/python/cpython/issues/154189"}