Description
Crash report
What happened?
Stack trace:
#0 tstate_delete_common.constprop.0 (tstate=tstate@entry=0x555555666ca0, release_gil=0) at ../Python/pystate.c:1854
#1 0x00007ffff78cd341 in zapthreads (interp=0x7ffff74c8010) at ../Python/pystate.c:1915
#2 PyInterpreterState_Delete (interp=0x7ffff74c8010) at ../Python/pystate.c:1016
#3 0x00005555555552ef in main () at repro.c:16
(note the address passed to tstate_delete_common is definitely corrupt, and not the address of any PyThreadState created in this program)
This was triggered by creating a new PyThreeadState for the interpreter, switching to it, deleting an old thread state for the same interpreter, and then calling Py_EndInterpreter (on the new thread state).
repro.c:
#include <Python.h>
int main()
{
Py_Initialize();
PyThreadState *orig = NULL;
PyInterpreterConfig cfg = _PyInterpreterConfig_INIT;
Py_NewInterpreterFromConfig(&orig, &cfg);
PyThreadState *temp = PyThreadState_New(orig->interp);
PyThreadState_Swap(temp);
PyThreadState_Clear(orig);
PyThreadState_Delete(orig);
Py_EndInterpreter(temp);
Py_Finalize();
}
Compiled with $ gcc -O1 -ggdb repro.cpp -I/usr/include/python3.14 -lpython3.14
CPython versions tested on:
3.14
Operating systems tested on:
Linux
Output from running 'python -VV' on the command line:
Python 3.14.0b1 (main, May 8 2025, 08:57:13) [GCC 13.3.0]
Linked PRs
Metadata
Metadata
Assignees
Labels
Projects
Status
Activity
ZeroIntensity commentedon May 17, 2025
@ericsnowcurrently This is the
zapthreads
problem that I was talking about yesterday.I'm pretty sure #128640 will fix this.
b-pass commentedon May 17, 2025
I updated the example code to a complete compilable description, this crashes for me. Using deadsnakes repo on ubuntu 24.04, which is 3.14.b1.
ZeroIntensity commentedon May 17, 2025
Huh, that repro looks wrong.
PyThreadState_Delete
cannot be called with a thread state that is attached.b-pass commentedon May 17, 2025
Does the PyThreadState_Swap not detach it?
ZeroIntensity commentedon May 17, 2025
Oh wait, I see that you delete
orig
, nottemp
.b-pass commentedon May 18, 2025
If it matters, the reason I am doing it this way is that in 3.12 you can't actually delete (via PyThreadState_Delete) the first PyThreadState of the interpreter ... it looks to me like it never gets zero'd out (because it is the one that has storage inside the interpreterstate) so it causes an abort when it is subsequently reallocated. :( So you have to leave that one allocated. This is fixed in 3.13+
6 remaining items