Repository navigation
Crash when detaching dict from inline values and no memory is available #124547
Description
Activity
In 3.13 this could be fixed by having the dict keep the object alive, and then decref it when the dict goes away (recovering the object from the inline values). In 3.14 it's no longer possible to recover the inline values because we support inline values on objects of various sizes.
It seems the issue originates from _testcapi.set_nomemory(0).
When I run this code
from test.test_class import WithAttrs import _testcapi a = WithAttrs() d = a.__dict__ # _testcapi.set_nomemory(0) del a print(d, d["a"])
It's output is as follows
Running Release|x64 interpreter... object address : 000001C8DC77D1E0 object refcount : 3 object type : 00007FFFC0F03F80 object type name: MemoryError object repr : lost sys.stderr object address : 000001C8DC77D120 object refcount : 3 object type : 00007FFFC0F03F80 object type name: MemoryError object repr : lost sys.stderr object address : 000001C8DC77D1E0 object refcount : 3 object type : 00007FFFC0F03F80 object type name: MemoryError object repr : lost sys.stderr
It seems that nomemory(0) is used to simulate normal conditions and insert debugging hooks, but I don’t understand why commenting it out appears to resolve the issue.
- added a commit that references this issue on Sep 27, 2024
- added a commit that references this issue on Sep 27, 2024
- added a commit that references this issue on Jul 26, 2026
- added a commit that references this issue on Aug 3, 2026
Bug report
Bug description:
Add to test_class.py in TestInlineValues:
This will crash because the dictionary will no longer points to valid memory:
#0 Py_XINCREF (op=<unknown at remote 0xdddddddddddddddd>) at ./Include/refcount.h:456 #1 _Py_XNewRef (obj=<unknown at remote 0xdddddddddddddddd>) at ./Include/refcount.h:488 #2 _Py_dict_lookup_threadsafe (mp=mp@entry=0x7ffff778ff50, key=key@entry='a', hash=<optimized out>, value_addr=value_addr@entry=0x7fffffffb078) at Objects/dictobject.c:1544 #3 0x0000000000518457 in dict_subscript (self={'b': <unknown at remote 0xdddddddddddddddd>, 'd': <unknown at remote 0xdddddddddddddddd>, 'a': <unknown at remote 0xdddddddddddddddd>, 'c': <unknown at remote 0xdddddddddddddddd>}, key='a') at Objects/dictobject.c:3325 #4 0x000000000049d8c6 in PyObject_GetItem (o=o@entry={'b': <unknown at remote 0xdddddddddddddddd>, 'd': <unknown at remote 0xdddddddddddddddd>, 'a': <unknown at remote 0xdddddddddddddddd>, 'c': <unknown at remote 0xdddddddddddddddd>}, key=key@entry='a') at Objects/abstract.c:158CPython versions tested on:
CPython main branch
Operating systems tested on:
Linux
Linked PRs