Incorrect callable object crashes Python 3.11.0a0

[xxm]

BPO	44719
Nosy	@sweeneyde

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = None
closed_at = <Date 2021-07-26.23:14:56.507>
created_at = <Date 2021-07-23.04:27:09.849>
labels = ['interpreter-core', 'type-crash', '3.11']
title = 'Incorrect callable object crashes Python 3.11.0a0'
updated_at = <Date 2021-07-26.23:14:56.506>
user = 'https://bugs.python.org/xxm'

bugs.python.org fields:

activity = <Date 2021-07-26.23:14:56.506>
actor = 'Dennis Sweeney'
assignee = 'none'
closed = True
closed_date = <Date 2021-07-26.23:14:56.507>
closer = 'Dennis Sweeney'
components = ['Interpreter Core']
creation = <Date 2021-07-23.04:27:09.849>
creator = 'xxm'
dependencies = []
files = []
hgrepos = []
issue_num = 44719
keywords = []
message_count = 4.0
messages = ['398028', '398088', '398115', '398269']
nosy_count = 2.0
nosy_names = ['Dennis Sweeney', 'xxm']
pr_nums = []
priority = 'normal'
resolution = 'fixed'
stage = 'resolved'
status = 'closed'
superseder = None
type = 'crash'
url = 'https://bugs.python.org/issue44719'
versions = ['Python 3.11']

[xxm]

This program can trigger "Aborted (core dumped)" on Python 3.9.0, Python 3.8.0, Python3.10.0a2. It trigger " segmentation fault" on the master (Python 3.11.0a0).

==================================

import weakref

class Object:
    def __init__(self, arg):
        self.arg = arg

def test_set_callback_attribute():
    x = Object(1)
    callback = lambda ref: None
    callback = weakref.ref(callback, x)
    with test_set_callback_attribute():
        pass

test_set_callback_attribute()

==================================

Crashes on the master (Python 3.11.0a0)
------------------------------------------------------------

.....
Traceback (most recent call last):
  File "/home/xxm/Desktop/IFuzzer/bugs/CPython/IFuzzer/test_weakref/test_set_callback_attribute__1.py", line 26, in test_set_callback_attribute
    callback = weakref.ref(callback, x)
    ^^^^^^^^
TypeError: 'Object' object is not callable
Exception ignored in: <__main__.Object object at 0x7f3e2d56ca90>
Traceback (most recent call last):
  File "/home/xxm/Desktop/IFuzzer/bugs/CPython/IFuzzer/test_weakref/test_set_callback_attribute__1.py", line 26, in test_set_callback_attribute
Segmentation fault (core dumped)

---

Crashes on the older version of Python
-----------------------------------------------------------
File "/home/xxm/Desktop/IFuzzer/bugs/CPython/IFuzzer/test_weakref/test_set_callback_attribute__1.py", line 27 in test_set_callback_attribute
File "/home/xxm/Desktop/IFuzzer/bugs/CPython/IFuzzer/test_weakref/test_set_callback_attribute__1.py", line 27 in test_set_callback_attribute
File "/home/xxm/Desktop/IFuzzer/bugs/CPython/IFuzzer/test_weakref/test_set_callback_attribute__1.py", line 27 in test_set_callback_attribute
File "/home/xxm/Desktop/IFuzzer/bugs/CPython/IFuzzer/test_weakref/test_set_callback_attribute__1.py", line 27 in test_set_callback_attribute
File "/home/xxm/Desktop/IFuzzer/bugs/CPython/IFuzzer/test_weakref/test_set_callback_attribute__1.py", line 27 in test_set_callback_attribute
File "/home/xxm/Desktop/IFuzzer/bugs/CPython/IFuzzer/test_weakref/test_set_callback_attribute__1.py", line 27 in test_set_callback_attribute
File "/home/xxm/Desktop/IFuzzer/bugs/CPython/IFuzzer/test_weakref/test_set_callback_attribute__1.py", line 27 in test_set_callback_attribute
...
Aborted (core dumped)
---------------------------------------------------------------

System: Ubuntu 16.04

[sweeneyde]

### Simplified crasher

from weakref import ref

def f():
    ref(lambda: 0, [])
    f()

f()

########################

Running this in debug mode, I got a failed assertion at traceback.c,
line 746, assert(source_line);.
If that assertion is commented out, a null pointer is dereferenced in
_PyPegen_byte_offset_to_character_offset()

[sweeneyde]

I think #71500 will fix this

[sweeneyde]

Indeed, I got no crash on main after #71500.

I also got no crash on 3.10 after #67756. Its backport to 3.9 (GH-24501) would have fixed this, but broke the stable ABI and was reverted. This was related to bpo-42500.

I'm closing this "fixed". Feel free to re-open if you still see an issue.