Skip to content

gh-143635: Fix crash in _Py_typing_type_repr #143670

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
sobolevn wants to merge 3 commits into
base: main
Choose a base branch
from
Open

gh-143635: Fix crash in _Py_typing_type_repr #143670

sobolevn wants to merge 3 commits into from
+57 −1

Conversation

@sobolevn
Copy link
Member

@sobolevn sobolevn commented Jan 10, 2026 •
edited by bedevere-app bot
Loading

I also added one more test case for a second possible crash in the same function.

@bedevere-app bedevere-app bot mentioned this pull request Jan 10, 2026
Open
@sobolevn sobolevn added skip news needs backport to 3.13 bugs and security fixes needs backport to 3.14 bugs and security fixes labels Jan 10, 2026
JelleZijlstra
JelleZijlstra reviewed Jan 11, 2026
View reviewed changes
@JelleZijlstra
Copy link
Member

JelleZijlstra commented Jan 11, 2026

This needs NEWS since it fixes a user-visible crash.

JelleZijlstra
JelleZijlstra requested changes Jan 14, 2026
View reviewed changes
Copy link
Member

@JelleZijlstra JelleZijlstra left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actually this is incorrect. The crash can be triggered if the list is cleared while we're iterating over it in ga_repr_items_list. INCREFing here is insufficient to protect us because the item may not be valid in the first place any more by the time we receive it.

My repro case in #143823 makes this clearer.

@bedevere-app
Copy link

bedevere-app bot commented Jan 14, 2026

When you're done making the requested changes, leave the comment: I have made the requested changes; please review again.

@JelleZijlstra JelleZijlstra mentioned this pull request Jan 14, 2026
Closed
@sobolevn
Copy link
Member Author

sobolevn commented Jan 14, 2026

Thank you! I refactored the PR to include the fix for the third case.

@sobolevn sobolevn requested a review from picnixz January 14, 2026 16:57
@picnixz
Copy link
Member

picnixz commented Jan 14, 2026

I thought there were more occurrences pf this function but am I wrong? or is it just me on mobile?

@picnixz
Copy link
Member

picnixz commented Jan 14, 2026

Or is it just in recursive calls where we already hold enough strong references?

@JelleZijlstra
Copy link
Member

JelleZijlstra commented Jan 14, 2026

The other calls look safe to me.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@sergey-miryanov sergey-miryanov sergey-miryanov left review comments

@JelleZijlstra JelleZijlstra JelleZijlstra approved these changes

@picnixz picnixz picnixz approved these changes

Assignees

No one assigned

Labels

awaiting merge needs backport to 3.13 bugs and security fixes needs backport to 3.14 bugs and security fixes

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@sobolevn @JelleZijlstra @picnixz @sergey-miryanov