Skip to content

Python 3.13.13 & 3.14.4 segfault crash (10 lines reproducer included) #148732

Closed as duplicate
Closed as duplicate
Python 3.13.13 & 3.14.4 segfault crash (10 lines reproducer included)#148732
Labels
3.13only security fixes3.14bugs and security fixespendingThe issue will be closed if no feedback is providedtype-crashA hard crash of the interpreter, possibly with a core dump

Description

@desbma
desbma
opened on Apr 18, 2026

Crash report

What happened?

I have a 100% reproducible segfault crash in one of my scripts, on Arch Linux.

I had Amp Code write me a minimal reproducer, it crashes consistently on Python 3.13 and 3.14:

import gc
from datetime import timedelta

class Poisoned:
    def __del__(self):
        timedelta(seconds=1)

obj = Poisoned()

cycle = [obj]
cycle.append(cycle)
del obj

gc.disable()

More information available on demand.

CPython versions tested on:

3.14

Operating systems tested on:

Linux

Output from running 'python -VV' on the command line:

Python 3.14.4 (main, Apr 8 2026, 17:48:49) [GCC 15.2.1 20260209]

Activity

  1. desbma
    added
    type-crashA hard crash of the interpreter, possibly with a core dump
    on Apr 18, 2026

  2. desbma commented on Apr 18, 2026

    @desbma
    desbma
    on Apr 18, 2026
    ContributorAuthor

    Crash backtrace with debug symbols:

    #0  delta_new (type=0x7f7e38730380 <PyDateTime_DeltaType.lto_priv.0>, args=<optimized out>, kw=<optimized out>) at ./Modules/_datetimemodule.c:2835
#0  delta_new (type=0x7f7e38730380 <PyDateTime_DeltaType.lto_priv.0>, args=<optimized out>, kw=<optimized out>) at ./Modules/_datetimemodule.c:2835
#1  0x00007f7e3836fb8a in type_call (self=0x7f7e38730380 <PyDateTime_DeltaType.lto_priv.0>, args=0x7f7e387633b0 <_PyRuntime+90640>, kwds=0x7f7e35e7b8c0) at Objects/typeobject.c:2372
#2  _PyObject_MakeTpCall (tstate=0x7f7e3879a2a8 <_PyRuntime+315656>, callable=0x7f7e38730380 <PyDateTime_DeltaType.lto_priv.0>, args=<optimized out>, nargs=<optimized out>, keywords=<optimized out>) at Objects/call.c:242
#3  0x00007f7e3838bfff in _PyEval_EvalFrameDefault (tstate=0x7f7e3879a2a8 <_PyRuntime+315656>, frame=0x7f7e38836268, throwflag=904955088) at Python/generated_cases.c.h:3229
#4  0x00007f7e383b54cc in _PyEval_EvalFrame (tstate=0x7f7e3879a2a8 <_PyRuntime+315656>, frame=0x7f7e38836020, throwflag=0) at ./Include/internal/pycore_ceval.h:120
#5  _PyEval_Vector (tstate=0x7f7e3879a2a8 <_PyRuntime+315656>, func=<optimized out>, locals=0x0, args=<optimized out>, argcount=1, kwnames=<optimized out>) at Python/ceval.c:2110
#6  _PyFunction_Vectorcall (func=<optimized out>, stack=<optimized out>, nargsf=<optimized out>, kwnames=<optimized out>) at Objects/call.c:413
#7  0x00007f7e383bae66 in _PyObject_VectorcallTstate (tstate=0x7f7e3879a2a8 <_PyRuntime+315656>, callable=0x7f7e35ed3320, args=0x7ffc2972cee8, nargsf=9223372036854775809, kwnames=0x0) at ./Include/internal/pycore_call.h:177
#8  PyObject_CallOneArg (func=0x7f7e35ed3320, arg=<optimized out>) at Objects/call.c:395
#9  0x00007f7e384ccad5 in call_unbound_noarg (unbound=<optimized out>, func=0x7f7e35ed3320, self=0x7f7e36fc8980) at Objects/typeobject.c:2964
#10 slot_tp_finalize (self=0x7f7e36fc8980) at Objects/typeobject.c:10599
#11 0x00007f7e3841c808 in finalize_garbage (tstate=0x7f7e3879a2a8 <_PyRuntime+315656>, collectable=0x7ffc2972cf90) at Python/gc.c:1117
#12 gc_collect_region (tstate=0x7f7e3879a2a8 <_PyRuntime+315656>, from=<optimized out>, to=0x7f7e38765158 <_PyRuntime+98232>, stats=0x7ffc2972d080) at Python/gc.c:1759
#13 0x00007f7e3846ff8d in gc_collect_full (tstate=0x7f7e3879a2a8 <_PyRuntime+315656>, stats=0x7ffc2972d080) at Python/gc.c:1692
#14 _PyGC_Collect (tstate=0x7f7e3879a2a8 <_PyRuntime+315656>, generation=2, reason=<optimized out>) at Python/gc.c:2064
#15 0x00007f7e384b55c8 in finalize_modules (tstate=0x7f7e3879a2a8 <_PyRuntime+315656>) at Python/pylifecycle.c:1749
#16 0x00007f7e38493819 in _Py_Finalize.constprop.0 (runtime=<optimized out>) at Python/pylifecycle.c:2144
#17 0x00007f7e38461e5a in Py_RunMain () at Modules/main.c:778
#18 0x00007f7e3845b52b in Py_BytesMain (argc=<optimized out>, argv=<optimized out>) at Modules/main.c:830
#19 0x00007f7e380366c1 in __libc_start_call_main (main=main@entry=0x5588fe4cb120 <main>, argc=argc@entry=9, argv=argv@entry=0x7ffc2972d528) at ../sysdeps/nptl/libc_start_call_main.h:59
#20 0x00007f7e380367f9 in __libc_start_main_impl (main=0x5588fe4cb120 <main>, argc=9, argv=0x7ffc2972d528, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7ffc2972d518) at ../csu/libc-start.c:360
#21 0x00005588fe4cb045 in _start ()

  3. StanFromIreland commented on Apr 18, 2026

    @StanFromIreland
    StanFromIreland
    on Apr 18, 2026
    Member

    This is fixed on main, and I believe a duplicate of #135552.

  4. StanFromIreland
    added
    pendingThe issue will be closed if no feedback is provided
    3.13only security fixes
    3.14bugs and security fixes
    on Apr 18, 2026

  5. desbma commented on Apr 18, 2026

    @desbma
    desbma
    on Apr 18, 2026
    ContributorAuthor

    Also maybe #132413

    I can confirm that the crash is reproducible on the most recent 3.13 and 3.14 but not 3.15a8 / main

  6. StanFromIreland
    closed this as a duplicateof SIGSEV in datetime.timedelta (possibly from datetime's C delta_new) #132413 on Apr 19, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    3.13only security fixes3.14bugs and security fixespendingThe issue will be closed if no feedback is providedtype-crashA hard crash of the interpreter, possibly with a core dump

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions