3.13: Abort from failed assertion in `_PyEval_EvalFrameDefault`

[devdanzin]

Crash report

What happened?

It's possible to abort a 3.13 debug build running the following code:

import copy

class Node:
    def __init__(self):
        self._parents = {}

    def __getstate__(self):
        return {'_parents': {}}

    def __setstate__(self, data_dict):
        self.__dict__ = data_dict
        self._parents = {}

    def call_copy(self):
        copy.copy(super())

class D(dict): pass

obj = Node()
obj.call_copy()
obj.call_copy()
obj.__setstate__(D())

Backtrace:

python: Python/generated_cases.c.h:5594: _PyEval_EvalFrameDefault: Assertion `PyDict_CheckExact((PyObject *)dict)' failed.

#0  __pthread_kill_implementation (threadid=<optimized out>, signo=6, no_tid=0)
    at ./nptl/pthread_kill.c:44
#1  __pthread_kill_internal (threadid=<optimized out>, signo=6) at ./nptl/pthread_kill.c:78
#2  __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=6)
    at ./nptl/pthread_kill.c:89
#3  0x00007ffff7c4519e in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
#4  0x00007ffff7c28902 in __GI_abort () at ./stdlib/abort.c:79
#5  0x00007ffff7c2881e in __assert_fail_base (
    fmt=0x7ffff7dde2a0 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n",
    assertion=assertion@entry=0x55555590a6c0 "PyDict_CheckExact((PyObject *)dict)",
    file=file@entry=0x5555558cbb1f "Python/generated_cases.c.h", line=line@entry=5594,
    function=function@entry=0x555555964500 <__PRETTY_FUNCTION__.72> "_PyEval_EvalFrameDefault")
    at ./assert/assert.c:96
#6  0x00007ffff7c3b7c7 in __assert_fail (
    assertion=assertion@entry=0x55555590a6c0 "PyDict_CheckExact((PyObject *)dict)",
    file=file@entry=0x5555558cbb1f "Python/generated_cases.c.h", line=line@entry=5594,
    function=function@entry=0x555555964500 <__PRETTY_FUNCTION__.72> "_PyEval_EvalFrameDefault")
    at ./assert/assert.c:105
#7  0x00005555557b1e76 in _PyEval_EvalFrameDefault (tstate=0x555555b604c0 <_PyRuntime+299040>,
    frame=0x7ffff7fb0090, throwflag=0) at Python/generated_cases.c.h:5594
#8  0x00005555557b4b05 in _PyEval_EvalFrame (
    tstate=tstate@entry=0x555555b604c0 <_PyRuntime+299040>, frame=<optimized out>,
    throwflag=throwflag@entry=0) at ./Include/internal/pycore_ceval.h:119
#9  0x00005555557b4c34 in _PyEval_Vector (tstate=tstate@entry=0x555555b604c0 <_PyRuntime+299040>,
    func=func@entry=0x7ffff74674d0, locals=locals@entry=0x7ffff7463d70, args=args@entry=0x0,
    argcount=argcount@entry=0, kwnames=kwnames@entry=0x0) at Python/ceval.c:1816
#10 0x00005555557b4cf7 in PyEval_EvalCode (co=co@entry=0x7ffff7566d40,
    globals=globals@entry=0x7ffff7463d70, locals=locals@entry=0x7ffff7463d70)
    at Python/ceval.c:604
#11 0x00005555558225c5 in run_eval_code_obj (
    tstate=tstate@entry=0x555555b604c0 <_PyRuntime+299040>, co=co@entry=0x7ffff7566d40,
    globals=globals@entry=0x7ffff7463d70, locals=locals@entry=0x7ffff7463d70)
    at Python/pythonrun.c:1381

Found using fusil by @vstinner.

CPython versions tested on:

3.13

Operating systems tested on:

Linux

Output from running 'python -VV' on the command line:

Python 3.13.3+ (heads/3.13:fdcaaad1cc7, May 4 2025, 08:43:24) [GCC 14.2.0]

Linked PRs

• [3.13] gh-133441: Fix STORE_ATTR_WITH_HINT bytecode #133446

[vstinner]

I wrote a fix: #133446