Subclassing a #[pyclass] in Python causes segfault during interpreter finalization

[joar]

🐛 Bug Reports

When reporting a bug, please provide the following information. If this is not a bug report you can just discard this template.

🌍 Environment

• Your operating system and version: Ubuntu 18.04
• Your python version: Python 3.7
• How did you install python (e.g. apt or pyenv)? Did you use a virtualenv?:
  • Python installed through the "deadsnakes" PPA
  • I use python's venv
• Your rust version (rustc --version):
  rustc 1.30.0-nightly (2d4e34ca8 2018-09-09)

💥 Reproducing

Check out the branch at https://github.com/joar/pyo3/tree/bug/subclass-causes-sigsegv/examples/word-count

$ cd examples/word-count

$ python setup.py develop

$ cat ../../target/debug/build/pyo3-4833970e0e0d17d0/output
cargo:rustc-cfg=Py_3_5
cargo:rustc-cfg=Py_3_6
cargo:rustc-cfg=Py_3_7
cargo:rustc-cfg=Py_3
cargo:rustc-cfg=py_sys_config="WITH_THREAD"
cargo:python_flags=FLAG_WITH_THREAD=1,CFG_Py_3_5,CFG_Py_3_6,CFG_Py_3_7
cargo:rerun-if-env-changed=LD_LIBRARY_PATH
cargo:rerun-if-env-changed=PATH
cargo:rerun-if-env-changed=PYTHON_SYS_EXECUTABLE
cargo:rerun-if-env-changed=LIB

$ python minimal-test.py
===> creating WordCounter
===> created WordCounter
===> deleting wc
===> deleted wc
fish: “python minimal-test.py” terminated by signal SIGSEGV (Address boundary error)

I believe the issue occurs during python's final GC.

[konstin]

Thanks for the report!

I've minimized the example:

#[pyclass(subclass)]
struct SomeClass {}

#[pymethods]
impl SomeClass {
    #[new]
    fn __new__(obj: &PyRawObject) -> PyResult<()> {
        obj.init(|_| SomeClass {})
    }
}

#[pymodinit]
fn word_count(_py: Python, m: &PyModule) -> PyResult<()> {
    m.add_class::<SomeClass>()?;
    Ok(())
}

from word_count import SomeClass


class SomeSubClass(SomeClass):
    pass


a = SomeSubClass()
print(a)

With python-dbg you get a bit more information:

<__main__.SomeSubClass object at 0x7ffff6820f60>
Debug memory block at address p=0x7ffff6820f60: API '�'
    6392409932133498880 bytes originally requested
    The 7 pad bytes at p-7 are not all FORBIDDENBYTE (0xfb):
        at p-7: 0xff *** OUCH
        at p-6: 0xff *** OUCH
        at p-5: 0xff *** OUCH
        at p-4: 0xff *** OUCH
        at p-3: 0xff *** OUCH
        at p-2: 0xff *** OUCH
        at p-1: 0xff *** OUCH
    Because memory is corrupted at the start, the count of bytes requested
       may be bogus, and checking the trailing pad bytes may segfault.
    The 8 pad bytes at tail=0x58b6e6f6f6010f60 are 
Program received signal SIGSEGV, Segmentation fault.
0x000000000042163f in _PyObject_DebugDumpAddress (p=p@entry=0x7ffff6820f60) at ../Objects/obmalloc.c:2108
2108	../Objects/obmalloc.c: Datei oder Verzeichnis nicht gefunden.

And with gdb I could get a backtrace:

(gdb) bt
#0  0x000000000042163f in _PyObject_DebugDumpAddress (p=p@entry=0x7ffff6820f60) at ../Objects/obmalloc.c:2108
#1  0x0000000000421989 in _PyMem_DebugCheckAddress (api=<optimized out>, p=p@entry=0x7ffff6820f60) at ../Objects/obmalloc.c:2049
#2  0x0000000000421a00 in _PyMem_DebugRawFree (ctx=ctx@entry=0x9c3400 <_PyMem_Debug+96>, p=p@entry=0x7ffff6820f60) at ../Objects/obmalloc.c:1905
#3  0x0000000000421a4f in _PyMem_DebugFree (ctx=0x9c3400 <_PyMem_Debug+96>, ptr=0x7ffff6820f60) at ../Objects/obmalloc.c:1986
#4  0x0000000000422909 in PyObject_Free (ptr=<optimized out>) at ../Objects/obmalloc.c:503
#5  0x00007ffff53df182 in <T as pyo3::typeob::PyObjectAlloc<T>>::dealloc (py=..., obj=0x7ffff6820f60) at /home/konsti/pyo3/src/typeob.rs:239
#6  0x00007ffff53fcab0 in pyo3::typeob::tp_dealloc_callback (obj=0x7ffff6820f60) at /home/konsti/pyo3/src/typeob.rs:463
#7  0x00000000004b6518 in subtype_dealloc (self=self@entry=<SomeSubClass at remote 0x7ffff6820f60>) at ../Objects/typeobject.c:1222
#8  0x00000000004a4b23 in _Py_Dealloc (op=<SomeSubClass at remote 0x7ffff6820f60>) at ../Objects/object.c:1791
#9  0x0000000000491101 in free_keys_object (keys=keys@entry=0xb97a30) at ../Objects/dictobject.c:561
#10 0x0000000000492d8f in dict_dealloc (mp=mp@entry=0x7ffff7efb058) at ../Objects/dictobject.c:2024
#11 0x00000000004a4b23 in _Py_Dealloc (
    op={'__name__': '__main__', '__doc__': None, '__package__': None, '__loader__': <unknown at remote 0x7ffff7e7cbb8>, '__spec__': None, '__annotations__': {}, '__builtins__': <module at remote 0x7ffff7f54cd8>, '__cached__': None, 'tempfile': <module at remote 0x7ffff681b8d8>, 'SomeClass': <type at remote 0x7ffff56c41d8>, 'SomeSubClass': <type at remote 0xbc4258>, <unknown at remote 0x7ffff682a3c0>: <unknown at remote 0x7ffff6820e90>, 'a': <SomeSubClass at remote 0x7ffff6820f60>}) at ../Objects/object.c:1791
#12 0x00000000004a224d in module_dealloc (m=m@entry=0x7ffff7e956d8) at ../Objects/moduleobject.c:643
#13 0x00000000004a4b23 in _Py_Dealloc (op=op@entry=<module at remote 0x7ffff7e956d8>) at ../Objects/object.c:1791
#14 0x0000000000494cf8 in insertdict (mp=mp@entry=0x7ffff7f56b20, key=key@entry='__main__', hash=<optimized out>, value=value@entry=None) at ../Objects/dictobject.c:1181
#15 0x00000000004977b4 in PyDict_SetItem (
    op=op@entry={'builtins': None, 'sys': None, '_frozen_importlib': None, '_imp': None, '_warnings': None, '_thread': None, '_weakref': None, '_frozen_importlib_external': None, '_io': None, 'marshal': None, 'posix': None, 'zipimport': None, 'encodings': None, 'codecs': None, '_codecs': None, 'encodings.aliases': None, 'encodings.utf_8': None, '_signal': None, '__main__': None, 'encodings.latin_1': <module at remote 0x7ffff7ec6b58>, 'io': <module at remote 0x7ffff7e631d8>, 'abc': <module at remote 0x7ffff7e633d8>, '_weakrefset': <module at remote 0x7ffff7e63a58>, 'site': <module at remote 0x7ffff7e80658>, 'os': <module at remote 0x7ffff7e80cd8>, 'errno': <module at remote 0x7ffff7e1f158>, 'stat': <module at remote 0x7ffff7e1f258>, '_stat': <module at remote 0x7ffff7e1f7d8>, 'posixpath': <module at remote 0x7ffff7e1f2d8>, 'genericpath': <module at remote 0x7ffff7e2f158>, 'os.path': <module at remote 0x7ffff7e1f2d8>, '_collections_abc': <module at remote 0x7ffff7e2f0d8>, '_sitebuiltins': <module at remote 0x7ffff7e80e58>, '_b...(truncated), key='__main__', value=None) at ../Objects/dictobject.c:1575
#16 0x000000000055cbf0 in PyImport_Cleanup () at ../Python/import.c:402
#17 0x0000000000424e26 in Py_FinalizeEx () at ../Python/pylifecycle.c:608
#18 0x000000000043bb49 in Py_Main (argc=argc@entry=2, argv=argv@entry=0xa91260) at ../Modules/main.c:830
#19 0x000000000042111f in main (argc=2, argv=0x7fffffffd9c8) at ../Programs/python.c:69

[joar]

@konstin Awesome! Thank you!

[joar]

@konstin I'm sorry, but it does not seem like this issue is fixed. Running examples/rustapi_module/tests/test_subclassing.py fails for me.

[konstin]

:/

[kngwyu]

I can't reproduce 🤔

[konstin]

@joar Did you update to the latest master?