René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Assertion failure when func_repr is called on an already tp_clear-ed object","articleBody":"\u003c!--\n  Use this template for hard crashes of the interpreter, segmentation faults, failed C-level assertions, and similar.\n  Do not submit this form if you encounter an exception being unexpectedly raised from a Python function.\n  Most of the time, these should be filed as bugs, rather than crashes.\n\n  The CPython interpreter is itself written in a different programming language, C.\n  For CPython, a \"crash\" is when Python itself fails, leading to a traceback in the C stack.\n--\u003e\n\n**Crash report**\n\nIt is possible to resurrect a `tp_clear`-ed object using pure python. The following piece of code illustrates how:\n\n```python\nimport gc, weakref\n\n\nclass LateFin:\n    __slots__ = ('ref',)\n\n    def __del__(self):\n        # 8. Now `latefin`'s finalizer is called. Here we obtain a reference to\n        # `func`, which is currently undergoing `tp_clear`.\n        global func\n        func = self.ref()\n\n\nclass Cyclic(tuple):\n    __slots__ = ()\n\n    # 4. The finalizers of all garbage objects are called. In this case this is\n    # only us as `func` doesn't have a finalizer.\n    def __del__(self):\n        # 5. Create a weakref to `func` now. If we had created it earlier, it\n        # would have been cleared by the garbage collector before calling the\n        # finalizers.\n        self[1].ref = weakref.ref(self[0])\n        # 6. Drop the global reference to `latefin`. The only remaining\n        # reference is the one we have.\n        global latefin\n        del latefin\n    # 7. Now `func` is `tp_clear`-ed. This drops the last reference to `Cyclic`,\n    # which gets `tp_dealloc`-ed. This drops the last reference to `latefin`.\n\n\nlatefin = LateFin()\nfunc = lambda: None\ncyc = tuple.__new__(Cyclic, (func, latefin))\n\n# 1. Create a reference cycle of `cyc` and `func`.\nfunc.__module__ = cyc\n\n# 2. Make the cycle unreachable, but keep the global reference to `latefin` so\n# that it isn't detected as garbage. This way its finalizer will not be called\n# immediately.\ndel func, cyc\n\n# 3. Invoke garbage collection, which will find `cyc` and `func` as garbage.\ngc.set_debug(gc.DEBUG_COLLECTABLE)\ngc.collect()\ngc.set_debug(0)\n\n# 9. Call `repr()`, which will try to use the NULL `func_qualname`.\nrepr(func)\n```\n\n```\n#5  0x00007ffff7d0a596 in __GI___assert_fail (assertion=assertion@entry=0x697e93 \"obj \u0026\u0026 _PyUnicode_CHECK(obj)\", file=file@entry=0x696a92 \"Objects/unicodeobject.c\", line=line@entry=3000, \n    function=function@entry=0x69e110 \u003c__PRETTY_FUNCTION__.299\u003e \"unicode_fromformat_arg\") at assert.c:101\n#6  0x0000000000538d8e in unicode_fromformat_arg (writer=writer@entry=0x7fffffffd9f0, f=0x682bf1 \"U at %p\u003e\", f@entry=0x682bf0 \"%U at %p\u003e\", vargs=vargs@entry=0x7fffffffda28)\n    at Objects/unicodeobject.c:3000\n#7  0x0000000000539098 in PyUnicode_FromFormatV (format=\u003coptimized out\u003e, vargs=vargs@entry=0x7fffffffda68) at Objects/unicodeobject.c:3109\n#8  0x00000000005391ab in PyUnicode_FromFormat (format=format@entry=0x682be6 \"\u003cfunction %U at %p\u003e\") at Objects/unicodeobject.c:3161\n#9  0x00000000004c2c7b in func_repr (op=\u003coptimized out\u003e) at Objects/funcobject.c:710\n#10 0x00000000004ea437 in PyObject_Repr (v=0x91d650) at Objects/object.c:434\n#11 0x0000000000571932 in builtin_repr (module=\u003coptimized out\u003e, obj=\u003coptimized out\u003e) at Python/bltinmodule.c:2252\n#12 0x00000000004e6c82 in cfunction_vectorcall_O (func=0x9a10f0, args=\u003coptimized out\u003e, nargsf=\u003coptimized out\u003e, kwnames=\u003coptimized out\u003e) at Objects/methodobject.c:514\n#13 0x00000000004a5700 in _PyObject_VectorcallTstate (tstate=0x915430 \u003c_PyRuntime+166000\u003e, callable=callable@entry=0x9a10f0, args=args@entry=0x9a4f98, nargsf=9223372036854775809, \n    kwnames=kwnames@entry=0x0) at ./Include/internal/pycore_call.h:92\n#14 0x00000000004a57cb in PyObject_Vectorcall (callable=callable@entry=0x9a10f0, args=args@entry=0x9a4f98, nargsf=\u003coptimized out\u003e, kwnames=kwnames@entry=0x0) at Objects/call.c:299\n#15 0x0000000000586b4b in _PyEval_EvalFrameDefault (tstate=0x915430 \u003c_PyRuntime+166000\u003e, frame=0x9a4f40, throwflag=\u003coptimized out\u003e) at Python/ceval.c:4765\n#16 0x000000000058af91 in _PyEval_EvalFrame (tstate=tstate@entry=0x915430 \u003c_PyRuntime+166000\u003e, frame=frame@entry=0x9a4f40, throwflag=throwflag@entry=0)\n    at ./Include/internal/pycore_ceval.h:66\n#17 0x000000000058b09c in _PyEval_Vector (tstate=tstate@entry=0x915430 \u003c_PyRuntime+166000\u003e, func=func@entry=0xa41dd0, locals=locals@entry=0xa5ca80, args=args@entry=0x0, \n    argcount=argcount@entry=0, kwnames=kwnames@entry=0x0) at Python/ceval.c:6387\n#18 0x000000000058b190 in PyEval_EvalCode (co=co@entry=0xaa0e70, globals=globals@entry=0xa5ca80, locals=locals@entry=0xa5ca80) at Python/ceval.c:1157\n#19 0x00000000005cb444 in run_eval_code_obj (tstate=tstate@entry=0x915430 \u003c_PyRuntime+166000\u003e, co=co@entry=0xaa0e70, globals=globals@entry=0xa5ca80, locals=locals@entry=0xa5ca80)\n    at Python/pythonrun.c:1713\n#20 0x00000000005cb4fb in run_mod (mod=mod@entry=0xaafda0, filename=filename@entry=0xa8dad0, globals=globals@entry=0xa5ca80, locals=locals@entry=0xa5ca80, flags=flags@entry=0x7fffffffdf08, \n    arena=arena@entry=0xa8dc20) at Python/pythonrun.c:1734\n#21 0x00000000005cb5bf in pyrun_file (fp=fp@entry=0x9c8d20, filename=filename@entry=0xa8dad0, start=start@entry=257, globals=globals@entry=0xa5ca80, locals=locals@entry=0xa5ca80, \n    closeit=closeit@entry=1, flags=0x7fffffffdf08) at Python/pythonrun.c:1629\n#22 0x00000000005cded0 in _PyRun_SimpleFileObject (fp=fp@entry=0x9c8d20, filename=filename@entry=0xa8dad0, closeit=closeit@entry=1, flags=flags@entry=0x7fffffffdf08)\n    at Python/pythonrun.c:439\n#23 0x00000000005ce078 in _PyRun_AnyFileObject (fp=fp@entry=0x9c8d20, filename=filename@entry=0xa8dad0, closeit=closeit@entry=1, flags=flags@entry=0x7fffffffdf08) at Python/pythonrun.c:78\n#24 0x00000000005e9d4b in pymain_run_file_obj (program_name=program_name@entry=0xa02210, filename=filename@entry=0xa8dad0, skip_source_first_line=0) at Modules/main.c:353\n#25 0x00000000005e9e49 in pymain_run_file (config=config@entry=0x8fb490 \u003c_PyRuntime+59600\u003e) at Modules/main.c:372\n#26 0x00000000005ea4e8 in pymain_run_python (exitcode=exitcode@entry=0x7fffffffe05c) at Modules/main.c:592\n#27 0x00000000005ea735 in Py_RunMain () at Modules/main.c:671\n#28 0x00000000005ea78a in pymain_main (args=args@entry=0x7fffffffe0a0) at Modules/main.c:701\n#29 0x00000000005ea80f in Py_BytesMain (argc=\u003coptimized out\u003e, argv=\u003coptimized out\u003e) at Modules/main.c:725\n#30 0x000000000041d70f in main (argc=\u003coptimized out\u003e, argv=\u003coptimized out\u003e) at ./Programs/python.c:15\n```\n\n**Your environment**\n\n- CPython versions tested on: 3.10.4, 3.11.0a7+\n- Operating system and architecture: x86_64\n\n\u003c!-- gh-linked-prs --\u003e\n### Linked PRs\n* gh-136401\n* gh-141993\n* gh-142152\n\u003c!-- /gh-linked-prs --\u003e\n","author":{"url":"https://github.com/hvenev","@type":"Person","name":"hvenev"},"datePublished":"2022-04-17T15:50:57.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":13},"url":"https://github.com/91636/cpython/issues/91636"}