Segmentation fault, possibly due to a GC issue (tp_subclasses) #135552
Description
Crash report
What happened?
from typing import Union
class BaseNode:
next: Union["BaseNode", None] = None
@staticmethod
def add(node: "BaseNode") -> None:
if BaseNode.next is None:
BaseNode.next = node
return
current = BaseNode.next
while current.next is not None:
current = current.next
current.next = node
@staticmethod
def remove(node: "BaseNode") -> None:
if BaseNode.next is None:
return
current = BaseNode.next
prev = BaseNode
while True:
if current is None:
return
if current == node:
if current.next is not None:
prev.next = current.next
else:
prev.next = None
return
prev = current
current = current.next
class Node(BaseNode):
def __init__(self) -> None:
self.next = None
BaseNode.add(self)
def __del__(self) -> None:
BaseNode.remove(self)
def main() -> None:
Node()
Node()
if __name__ == "__main__":
main()(Edited by @ZeroIntensity) Shortened repro:
class BaseNode:
next = None
class Node(BaseNode):
def __init__(self) -> None:
if BaseNode.next is None:
BaseNode.next = self
return
BaseNode.next.next = self
def __del__(self) -> None:
BaseNode.next = BaseNode.next.next
Node()
Node()(Edited by @fxeqxmulfx) Use after free example:
class BaseNode:
def __del__(self):
print("next", BaseNode.next)
print("del", self)
BaseNode.next = BaseNode()
BaseNode.next.next = BaseNode()next <__main__.BaseNode object at 0x717fb2d23a10>
del <__main__.BaseNode object at 0x717fb2d23a10>
next <__main__.BaseNode object at 0x717fb2d23a10> use after free
del <__main__.BaseNode object at 0x717fb2d23a50>
CPython versions tested on:
3.14
Operating systems tested on:
Linux
Output from running 'python -VV' on the command line:
Python 3.14.0b2 (main, Jun 12 2025, 12:41:01) [Clang 20.1.4 ]
Linked PRs
- gh-135552: Clear weakrefs to types in GC after garbage finalization not before #135728
- gh-135552: Skip clearing of tp_subclasses weakrefs in GC #136147
- gh-135552: Don't clear weakref if wr_object is a type. #136151
- gh-135552: Make the GC clear weakrefs later #136189
- gh-135552: Add tests that check if weakref for tp_subclasses cleared after finalization #136304