fxeqxmulfx · GitHub

Crash report

What happened?

from typing import Union
class BaseNode:
    next: Union["BaseNode", None] = None
    @staticmethod
    def add(node: "BaseNode") -> None:
        if BaseNode.next is None:
            BaseNode.next = node
            return
        current = BaseNode.next
        while current.next is not None:
            current = current.next
        current.next = node
    @staticmethod
    def remove(node: "BaseNode") -> None:
        if BaseNode.next is None:
            return
        current = BaseNode.next
        prev = BaseNode
        while True:
            if current is None:
                return
            if current == node:
                if current.next is not None:
                    prev.next = current.next
                else:
                    prev.next = None
                return
            prev = current
            current = current.next
class Node(BaseNode):
    def __init__(self) -> None:
        self.next = None
        BaseNode.add(self)
    def __del__(self) -> None:
        BaseNode.remove(self)
def main() -> None:
    Node()
    Node()
if __name__ == "__main__":
    main()

(Edited by @ZeroIntensity) Shortened repro:

class BaseNode:
    next = None
class Node(BaseNode):
    def __init__(self) -> None:
        if BaseNode.next is None:
            BaseNode.next = self
            return
        BaseNode.next.next = self
    def __del__(self) -> None:
        BaseNode.next = BaseNode.next.next
Node()
Node()

(Edited by @fxeqxmulfx) Use after free example:

class BaseNode:
    def __del__(self):
        print("next", BaseNode.next)
        print("del", self)
BaseNode.next = BaseNode()
BaseNode.next.next = BaseNode()
next <__main__.BaseNode object at 0x717fb2d23a10>
del <__main__.BaseNode object at 0x717fb2d23a10>
next <__main__.BaseNode object at 0x717fb2d23a10> use after free
del <__main__.BaseNode object at 0x717fb2d23a50>

CPython versions tested on:

3.14

Operating systems tested on:

Linux

Output from running 'python -VV' on the command line:

Python 3.14.0b2 (main, Jun 12 2025, 12:41:01) [Clang 20.1.4 ]

Linked PRs

Read the original on github.com ↗