GC crash in subtype_dealloc when inherting from _multiprocessing.SemLock

[kumaraditya303]

Crash report

GC crash in subtype_dealloc when inherting from _multiprocessing.SemLock.

Reproducer (read carefully before running!):

from _multiprocessing import SemLock
class S(SemLock):
    pass


s = S(1, 1, 2, 'foo', 1)

Error messages

@kumaraditya303 ➜ /workspaces/cpython (main ✗) $ ./python main.py 
Segmentation fault (core dumped)

GDB backtrace:

#0  _PyObject_GC_UNTRACK (op=<S() at remote 0x7ffff778d480>, lineno=2242, 
    filename=0x5555559ae5dc "Modules/gcmodule.c") at ./Include/internal/pycore_object.h:174
#1  PyObject_GC_UnTrack (op_raw=0x7ffff778d480) at Modules/gcmodule.c:2242
#2  0x0000555555760e71 in subtype_dealloc (self=<S() at remote 0x7ffff778d480>)
    at Objects/typeobject.c:1368
#3  0x0000555555742e85 in _Py_Dealloc (op=<optimized out>) at Objects/object.c:2382
#4  0x0000555555726b1b in Py_DECREF (op=<optimized out>, lineno=609, 
    filename=0x55555591d5dd "./Include/object.h") at ./Include/object.h:533
#5  Py_XDECREF (op=<optimized out>) at ./Include/object.h:609
#6  free_keys_object (keys=keys@entry=0x7ffff777cf70) at Objects/dictobject.c:664
#7  0x0000555555727258 in dictkeys_decref (dk=0x7ffff777cf70) at Objects/dictobject.c:324
#8  dict_dealloc (mp=0x7ffff772d490) at Objects/dictobject.c:2378
#9  0x0000555555742e85 in _Py_Dealloc (op=<optimized out>) at Objects/object.c:2382
#10 0x000055555573f7e9 in Py_DECREF (op=<optimized out>, lineno=609, 
    filename=0x55555591d5dd "./Include/object.h") at ./Include/object.h:533
#11 Py_XDECREF (op=<optimized out>) at ./Include/object.h:609
#12 module_dealloc (m=0x7ffff772da30) at Objects/moduleobject.c:699
#13 0x0000555555742e85 in _Py_Dealloc (op=<optimized out>) at Objects/object.c:2382
#14 0x000055555572bca7 in Py_DECREF (op=<optimized out>, lineno=609, 

Your environment

• CPython versions tested on: Python 3.12.0a0 da71751, Python 3.11.0b3+ f3212b1 on linux
• Operating system and architecture: Linux 5.4.0-1074-azure x86_64

cc @pablogsal

[encukou]

Whoah, is the rm -rf /dev/shm/* necessary to reproduce? I've added a warning to the reproducer, since this can break more than Python.

Not that this shouldn't be fixed if it's easy to fix, but a crash is just what I'd expect when messing around with shared memory files directly.

[pablogsal]

@kumaraditya303 Thanks a lot for raising the issue :)

One small note: please, don't mark everything as release blocker just because it crashes. In this case, the reproducer involves non standard actions (deleting the shared memory segment) so is not that critical to block releases.

Also, as this issue affects old versions it should not block 3.11.

[kumaraditya303]

Whoah, is the rm -rf /dev/shm/* necessary to reproduce?

It makes debugging easier otherwise you would have change the name of semlock everytime as the interpreter crashes to avoid OSErrors, removed now.

[kumaraditya303]

One small note: please, don't mark everything as release blocker just because it crashes. In this case, the reproducer involves non standard actions (deleting the shared memory segment) so is not that critical to block releases.

Deleting the shared memory segment isn't necessary it was just to aid debugging which I removed now. Regarding release blocker, this issue was part of a bigger problem which I haven't been able to create a minimal reproducer for involving Py_TPFLAGS_MANAGED_DICT not creating dictionary properly but I was getting this segfault. It's up to you to consider this release blocker or not as I am not the release manager :)

[kumaraditya303]

See #94738