b-pass · GitHub

Crash report

What happened?

Stack trace:

#0  tstate_delete_common.constprop.0 (tstate=tstate@entry=0x555555666ca0, release_gil=0) at ../Python/pystate.c:1854
#1  0x00007ffff78cd341 in zapthreads (interp=0x7ffff74c8010) at ../Python/pystate.c:1915
#2  PyInterpreterState_Delete (interp=0x7ffff74c8010) at ../Python/pystate.c:1016
#3  0x00005555555552ef in main () at repro.c:16

(note the address passed to tstate_delete_common is definitely corrupt, and not the address of any PyThreadState created in this program)

This was triggered by creating a new PyThreeadState for the interpreter, switching to it, deleting an old thread state for the same interpreter, and then calling Py_EndInterpreter (on the new thread state).

repro.c:

#include <Python.h>
int main()
{
        Py_Initialize();
        PyThreadState *orig = NULL;
        PyInterpreterConfig cfg =  _PyInterpreterConfig_INIT;
        Py_NewInterpreterFromConfig(&orig, &cfg);
        PyThreadState *temp = PyThreadState_New(orig->interp);
        PyThreadState_Swap(temp);
        PyThreadState_Clear(orig);
        PyThreadState_Delete(orig);
        Py_EndInterpreter(temp);
        Py_Finalize();
}

Compiled with $ gcc -O1 -ggdb repro.cpp -I/usr/include/python3.14 -lpython3.14

CPython versions tested on:

3.14

Operating systems tested on:

Linux

Output from running 'python -VV' on the command line:

Python 3.14.0b1 (main, May 8 2025, 08:57:13) [GCC 13.3.0]

Linked PRs

Read the original on github.com ↗