Crash on deallocator of type 'time.struct_time' during finalizing for free-threaded Python

Crash report

What happened?

A simple standalone file:

# test1.py

import time

obj = time.struct_time(range(1, 10))

$ pyenv install 3.14t-dev --debug
$ pyenv local 3.14t-dev-debug
$ python3 -VV
Python 3.14.0a0 experimental free-threading build (heads/main:bd3d31f, Aug  1 2024, 01:22:33) [Clang 15.0.0 (clang-1500.3.9.4)]
$ python3 test1.py
Fatal Python error: _Py_Dealloc: Deallocator of type 'time.struct_time' raised an exception
Python runtime state: finalizing (tstate=0x00000001018ca548)
Exception ignored in the internal traceback machinery:
ImportError: sys.meta_path is None, Python is likely shutting down
TypeError: Missed attribute 'n_fields' of type time.struct_time

Current thread 0x00000001fff70c00 (most recent call first):
  Garbage-collecting
  <no Python frame>
[1]    89377 abort      python3 test1.py
$ python3 -c 'import test1'
Fatal Python error: _Py_Dealloc: Deallocator of type 'time.struct_time' raised an exception
Python runtime state: finalizing (tstate=0x00000001040a2548)
Exception ignored in the internal traceback machinery:
ImportError: sys.meta_path is None, Python is likely shutting down
TypeError: Missed attribute 'n_fields' of type time.struct_time

Current thread 0x00000001fff70c00 (most recent call first):
  Garbage-collecting
  <no Python frame>
[1]    89737 abort      python3 -c 'import test1'

If I remove the assignment for obj, the program can exit successfully.

# test2.py

import time

time.struct_time(range(1, 10))

$ python3 test2.py           # no output
$ python3 -c 'import test2'  # no output

CPython versions tested on:

CPython main branch, CPython 3.13t, CPython 3.14t

Operating systems tested on:

Linux, macOS

Output from running 'python -VV' on the command line:

Python 3.14.0a0 experimental free-threading build (heads/main:bd3d31f, Aug 1 2024, 01:22:33) [Clang 15.0.0 (clang-1500.3.9.4)]

Linked PRs

Thanks for the report!
Confirmed on current main.

Bisected to:

4ad8f09 (gh-117376: Partial implementation of deferred reference counting #117696)

(oops)

The problem is in structseq_dealloc, the REAL_SIZE() call fails:

cpython/Objects/structseq.c

Lines 116 to 131 in 8844197

    
           static void 
        
           structseq_dealloc(PyStructSequence *obj) 
        
           { 
        
               Py_ssize_t i, size; 
        
               PyObject_GC_UnTrack(obj); 
        
               PyTypeObject *tp = Py_TYPE(obj); 
        
               size = REAL_SIZE(obj); 
        
               for (i = 0; i < size; ++i) { 
        
                   Py_XDECREF(obj->ob_item[i]); 
        
               } 
        
               PyObject_GC_Del(obj); 
        
               if (_PyType_HasFeature(tp, Py_TPFLAGS_HEAPTYPE)) { 
        
                   Py_DECREF(tp); 
        
               } 
        
           }

REAL_SIZE is a macro that expands to:

PyDict_GetItemWithError(_PyType_GetDict(Py_TYPE(self)), _Py_ID(n_fields))

The GC is clearing the type's dictionary (i.e., _PyType_GetDict) before the structseq instances is freed, so the REAL_SIZE call fails. We're also not handling that failure, which leads to a crash.

The default build works because the GC happens to free the structseq instance first before calling tp_clear() on the type's dictionary, but I don't think the GC guarantees any ordering of tp_clear() calls.

You can trigger a similar crash in the default build with some weirder code:

import time
obj = time.struct_time(range(1, 10))
type(obj).obj = obj

pythongh-122527: Fix a crash on deallocation of `PyStructSequence`

gh-122527: Fix a crash on deallocation of `PyStructSequence` (GH-122577)

pythongh-122527: Fix a crash on deallocation of `PyStructSequence` (p…

[3.13] gh-122527: Fix a crash on deallocation of `PyStructSequence` (G…

[3.12] gh-122527: Fix a crash on deallocation of `PyStructSequence` (G…

Navigation Menu

Repository navigation

Crash on deallocator of type 'time.struct_time' during finalizing for free-threaded Python #122527

Crash report

What happened?

CPython versions tested on:

Operating systems tested on:

Output from running 'python -VV' on the command line:

Linked PRs

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

	static void
	structseq_dealloc(PyStructSequence *obj)
	{
	Py_ssize_t i, size;
	PyObject_GC_UnTrack(obj);

	PyTypeObject *tp = Py_TYPE(obj);
	size = REAL_SIZE(obj);
	for (i = 0; i < size; ++i) {
	Py_XDECREF(obj->ob_item[i]);
	}
	PyObject_GC_Del(obj);
	if (_PyType_HasFeature(tp, Py_TPFLAGS_HEAPTYPE)) {
	Py_DECREF(tp);
	}
	}

Crash on deallocator of type 'time.struct_time' during finalizing for free-threaded Python #122527

Description

Crash report

What happened?

CPython versions tested on:

Operating systems tested on:

Output from running 'python -VV' on the command line:

Linked PRs

Activity

Eclips4 commented on Jul 31, 2024

colesbury commented on Jul 31, 2024

colesbury commented on Jul 31, 2024

colesbury commented on Jul 31, 2024

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions