Skip to content

Class-scope comprehension with lambda raises SystemError #150700

Closed

Description

@steve-s

Bug report

Bug description:

class D:
    vals = [(lambda: __class__)() for _ in range(1)]

gives

SystemError: compiler_lookup_arg(name='__class__') with reftype=5 failed in D; freevars of code <lambda>: ('__class__',)

tested on main (f4bda4d) and on 3.12.8 (debug build). Issue #149806 looks related, but I tried that example on #149806 and it's not fixed by it.

CPython versions tested on:

CPython main branch

Operating systems tested on:

Linux

Linked PRs

Activity

  1. added
    type-bugAn unexpected behavior, bug, or error
    on Jun 1, 2026
  2. changed the title [-]Class-scope inlined comprehensions can crash the compiler when a nested function captures class[/-] [+]Class-scope comprehension with lambda raises SystemError[/+] on Jun 1, 2026
  3. terryjreedy commented on Jun 1, 2026

    @terryjreedy
    Member

    Same on Windows back to 3.12. In 3.11, "NameError: cannot access free variable 'class' where it is not associated with a value in enclosing scope".

  4. StanFromIreland commented on Jun 1, 2026

    @StanFromIreland
    Member

    Out of curiosity, how was this found? I'm asking because it seems quite like our other OSS-Fuzz things (like the one you linked), and I'm wondering if we missed a finding?

  5. steve-s commented on Jun 1, 2026

    @steve-s
    ContributorAuthor

    As part of implementation of PEP 709 in GraalPy done by my colleague @msimacek, during review I asked Codex to look for corner cases and gaps around the code handling the name resolution and it came up with this (manifested by different internal error). Then we realized it is also not working on CPython.

  6. added
    3.14bugs and security fixes
    3.15bugs and security fixes
    3.16new features, bugs and security fixes
    on Jun 1, 2026
  7. self-assigned this
    on Jun 1, 2026
  8. johnslavik commented on Jun 1, 2026

    @johnslavik
    Member

    MREs: class C: [lambda: __class__ for () in ()], class C: [lambda: super() for () in ()]

  9. StanFromIreland commented on Jun 1, 2026

    @StanFromIreland
    Member

    Also don't forget __classdict__ and __conditional_annotations__ (which I suppose I technically broke some time ago), they can also be dropped.

  10. johnslavik commented on Jun 1, 2026

    @johnslavik
    Member

    Also don't forget __classdict__ and __conditional_annotations__ (which I suppose I technically broke some time ago), they can also be dropped.

    I was just about to mention them, yes. class C: [lambda: __conditional_annotations__ for () in ()], class C: [lambda: __classdict__ for () in ()] reproduce too.

  11. johnslavik commented on Jun 1, 2026

    @johnslavik
    Member

    #149806 is unrelated because it fixes annotation visiting code and the issue here lies in inline_comprehension.
    This is an edge case of #120295 (which is the likely cause of regression).

    In inline_comprehension(), when __class__ / __classdict__ / __conditional_annotations__ appears as FREE in a comprehension's symbol table because a nested scope captured it (e.g. these lambdas), this name is still discarded from comp_free unconditionally. This prevents drop_class_free() from seeing it, so the appropriate ste_needs_(...) flag is never set on the enclosing class. That leads to codegen_make_closure() throwing SystemError when it couldn't find __class__ / __classdict__ / __conditional_annotations__ in the class's cellvars.

    We could just only discard from comp_free when no child scope (e.g. a lambda) still needs the name as FREE. When a child scope does need it, keep it in comp_free so drop_class_free() can set the appropriate flag and the class creates the implicit cell.

  12. added a commit that references this issue on Jun 1, 2026
  13. added 3 commits that reference this issue on Jun 9, 2026
  14. added a commit that references this issue on Jun 17, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

3.14bugs and security fixes3.15bugs and security fixes3.16new features, bugs and security fixesinterpreter-core(Objects, Python, Grammar, and Parser dirs)type-bugAn unexpected behavior, bug, or error

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions