Crash report
What happened?
Calling repr in many threads on a list containing a large typing.Union segfaults in a free-threaded build:
import abc import builtins import collections.abc import itertools import types import typing from functools import reduce from operator import or_ abc_types = [cls for cls in abc.__dict__.values() if isinstance(cls, type)] builtins_types = [cls for cls in builtins.__dict__.values() if isinstance(cls, type)] collections_abc_types = [cls for cls in collections.abc.__dict__.values() if isinstance(cls, type)] collections_types = [cls for cls in collections.__dict__.values() if isinstance(cls, type)] itertools_types = [cls for cls in itertools.__dict__.values() if isinstance(cls, type)] types_types = [cls for cls in types.__dict__.values() if isinstance(cls, type)] typing_types = [cls for cls in typing.__dict__.values() if isinstance(cls, type)] all_types = (abc_types + builtins_types + collections_abc_types + collections_types + itertools_types + types_types + typing_types) all_types = [t for t in all_types if not issubclass(t, BaseException)] BIG_UNION = reduce(or_, all_types, int) from threading import Thread from time import sleep for x in range(100): union_list = [int | BIG_UNION] * 17 def stress_list(): for x in range(3): try: union_list.pop() except Exception: pass repr(union_list) sleep(0.006) union_list.__getitem__(None, None) alive = [] for x in range(25): alive.append(Thread(target=stress_list, args=())) for t in alive: t.start()
Example segfault backtrace:
Thread 60 "Thread-59 (stre" received signal SIGSEGV, Segmentation fault.
0x0000555555d21751 in _Py_TYPE (ob=<unknown at remote 0xdddddddddddddddd>) at ./Include/object.h:270
270 return ob->ob_type;
#0 0x0000555555d21751 in _Py_TYPE (ob=<unknown at remote 0xdddddddddddddddd>) at ./Include/object.h:270
#1 union_repr (self=<optimized out>) at Objects/unionobject.c:296
#2 0x0000555555b8949a in PyObject_Repr (v=<unknown at remote 0x7fffb48464b0>) at Objects/object.c:776
#3 0x0000555555cc06a1 in PyUnicodeWriter_WriteRepr (writer=writer@entry=0x7fff660907f0,
obj=<unknown at remote 0x207c>) at Objects/unicodeobject.c:13951
#4 0x0000555555aeba03 in list_repr_impl (v=0x7fffb4a8dc90) at Objects/listobject.c:606
#5 list_repr (self=[]) at Objects/listobject.c:633
#6 0x0000555555b8949a in PyObject_Repr (v=[]) at Objects/object.c:776
#7 0x0000555555e07abf in _PyEval_EvalFrameDefault (tstate=<optimized out>, frame=<optimized out>,
throwflag=<optimized out>) at Python/generated_cases.c.h:2306
#8 0x0000555555ddcf53 in _PyEval_EvalFrame (tstate=0x529000325210, frame=0x529000384328, throwflag=0)
at ./Include/internal/pycore_ceval.h:119
#9 _PyEval_Vector (tstate=0x529000325210, func=0x7fffb4828dd0, locals=0x0, args=<optimized out>,
argcount=1, kwnames=0x0) at Python/ceval.c:1917
#10 0x0000555555a4f42b in _PyObject_VectorcallTstate (tstate=0x529000325210,
callable=<function at remote 0x7fffb4828dd0>, args=0x207c, nargsf=3, nargsf@entry=1,
kwnames=<unknown at remote 0x7fff66090450>, kwnames@entry=0x0) at ./Include/internal/pycore_call.h:169
#11 0x0000555555a4ccbf in method_vectorcall (method=<optimized out>, args=<optimized out>,
nargsf=<optimized out>, kwnames=<optimized out>) at Objects/classobject.c:72
#12 0x0000555555e8005b in _PyObject_VectorcallTstate (tstate=0x529000325210,
callable=<method at remote 0x7fff660c0eb0>, args=0x7fff93df06d8, nargsf=0, kwnames=0x0)
at ./Include/internal/pycore_call.h:169
#13 context_run (self=<_contextvars.Context at remote 0x7fffb4a8ebf0>, args=<optimized out>,
nargs=<optimized out>, kwnames=0x0) at Python/context.c:728
#14 0x0000555555e0a3e7 in _PyEval_EvalFrameDefault (tstate=<optimized out>, frame=<optimized out>,
throwflag=<optimized out>) at Python/generated_cases.c.h:3551
Once it aborted with message:
python: Objects/unionobject.c:296: PyObject *union_repr(PyObject *): Assertion `PyTuple_Check(alias->args)' failed.
Found using fusil by @vstinner.
CPython versions tested on:
CPython main branch
Operating systems tested on:
Linux
Output from running 'python -VV' on the command line:
Python 3.14.0a7+ experimental free-threading build (heads/main:741c6386b86, Apr 18 2025, 15:04:45) [Clang 19.1.7 (++20250114103320+cd708029e0b2-1exp120250114103432.75)]
Linked PRs
- gh-132713: Fix repr(list) race condition #132801
- gh-132713: Fix typing.Union[index] race condition #132802
- [3.13] gh-132713: Fix repr(list) race condition (#132801) #132809
- gh-132713: Simplify list_repr_impl() #132811
- [3.13] gh-132713: Fix typing.Union[index] race condition (GH-132802) #132839
- gh-132713: Fix repr(classmethod) race condition #132899