Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Appearance settings

Segmentation fault, possibly due to a GC issue (tp_subclasses) #135552

Copy link
Copy link

Description

@fxeqxmulfx
Issue body actions

Crash report

What happened?

from typing import Union


class BaseNode:
    next: Union["BaseNode", None] = None

    @staticmethod
    def add(node: "BaseNode") -> None:
        if BaseNode.next is None:
            BaseNode.next = node
            return
        current = BaseNode.next
        while current.next is not None:
            current = current.next
        current.next = node

    @staticmethod
    def remove(node: "BaseNode") -> None:
        if BaseNode.next is None:
            return
        current = BaseNode.next
        prev = BaseNode
        while True:
            if current is None:
                return
            if current == node:
                if current.next is not None:
                    prev.next = current.next
                else:
                    prev.next = None
                return
            prev = current
            current = current.next


class Node(BaseNode):
    def __init__(self) -> None:
        self.next = None
        BaseNode.add(self)

    def __del__(self) -> None:
        BaseNode.remove(self)


def main() -> None:
    Node()
    Node()


if __name__ == "__main__":
    main()

(Edited by @ZeroIntensity) Shortened repro:

class BaseNode:
    next = None


class Node(BaseNode):
    def __init__(self) -> None:
        if BaseNode.next is None:
            BaseNode.next = self
            return
        BaseNode.next.next = self

    def __del__(self) -> None:
        BaseNode.next = BaseNode.next.next


Node()
Node()

(Edited by @fxeqxmulfx) Use after free example:

class BaseNode:
    def __del__(self):
        print("next", BaseNode.next)
        print("del", self)


BaseNode.next = BaseNode()
BaseNode.next.next = BaseNode()
next <__main__.BaseNode object at 0x717fb2d23a10>
del <__main__.BaseNode object at 0x717fb2d23a10>
next <__main__.BaseNode object at 0x717fb2d23a10> use after free
del <__main__.BaseNode object at 0x717fb2d23a50>

CPython versions tested on:

3.14

Operating systems tested on:

Linux

Output from running 'python -VV' on the command line:

Python 3.14.0b2 (main, Jun 12 2025, 12:41:01) [Clang 20.1.4 ]

Linked PRs

Reactions are currently unavailable

Metadata

Metadata

Assignees

No one assigned

    Labels

    3.13bugs and security fixesbugs and security fixes3.14bugs and security fixesbugs and security fixes3.15pre-release feature fixes, bugs and security fixespre-release feature fixes, bugs and security fixesinterpreter-core(Objects, Python, Grammar, and Parser dirs)(Objects, Python, Grammar, and Parser dirs)type-crashA hard crash of the interpreter, possibly with a core dumpA hard crash of the interpreter, possibly with a core dump
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions

      Morty Proxy This is a proxified and sanitized view of the page, visit original site.