Crash report

What happened?

In DEBUG build:

import collections.abc
del collections.abc.MutableSequence
import array

or:

sys.setrecursionlimit(25)
import array

generates a double DECREF on the array ArrayType object due to poisoned module state:

Python/gc.c:96: gc_decref: Assertion "gc_get_refs(g) > 0" failed: refcount is too small
object type name: type
object repr     : <class 'array.array'>
Fatal Python error: _PyObject_AssertFailed: _PyObject_AssertFailed

Analysis

So, array_modexec creates the ArrayType and assigns it to array state:

CREATE_TYPE(m, state->ArrayType, &array_spec);

It then goes on to do some other setup tasks, and if any of these fail, it DECREF's state->ArrayType but leaves the type object on the state struct:

	PyObject *mutablesequence = PyImport_ImportModuleAttrString(
	"collections.abc", "MutableSequence");
	if (!mutablesequence) {
	Py_DECREF((PyObject *)state->ArrayType);
	return -1;
	}
	PyObject *res = PyObject_CallMethod(mutablesequence, "register", "O",
	(PyObject *)state->ArrayType);
	Py_DECREF(mutablesequence);
	if (!res) {
	Py_DECREF((PyObject *)state->ArrayType);
	return -1;
	}

Returning -1 error code.

PyModule_ExecDef passes the -1 up the chain:

return -1;

which ends up with an exception in _bootstrap.py:

	except:
	try:
	del sys.modules[spec.name]
	except KeyError:
	pass
	raise

At this point, the array module refcount falls and it's cleaned up, and array_clear calls:

Py_CLEAR(state->ArrayType);

because the ArrayType pointer is still in the module state, this generates the double DECREF

CPython versions tested on:

CPython main branch

Operating systems tested on:

Linux

Output from running 'python -VV' on the command line: