Segmentation fault on Python 3.13 when running under ASan

[ofek]

Description

Repo snapshot: https://github.com/jcrist/msgspec/tree/ddea2a07833bf5bd0db49ec056ecbc612aff6b26
Changes applied: https://github.com/jcrist/msgspec/pull/909/files
Workflow run: https://github.com/jcrist/msgspec/actions/runs/18891966978/job/53921422350?pr=909#step:10:32
Command: LD_PRELOAD=`gcc -print-file-name=libasan.so` coverage run -m pytest -s -m "not mypy and not pyright"
Output:

============================= test session starts ==============================
platform linux -- Python 3.13.7, pytest-8.4.2, pluggy-1.6.0
rootdir: /home/runner/work/msgspec/msgspec
configfile: pyproject.toml
collected 6184 items / 2 deselected / 6182 selected

<clipped>
tests/test_schema.py ....................................................................................................................
Fatal Python error: Segmentation fault

Current thread 0x00007f6d7392e7c0 (most recent call first):
  File "/home/runner/work/msgspec/msgspec/tests/test_struct.py", line 2249 in test_defstruct_dict
  File "/opt/hostedtoolcache/Python/3.13.7/x64/lib/python3.13/site-packages/_pytest/python.py", line 157 in pytest_pyfunc_call
  File "/opt/hostedtoolcache/Python/3.13.7/x64/lib/python3.13/site-packages/pluggy/_callers.py", line 121 in _multicall
  File "/opt/hostedtoolcache/Python/3.13.7/x64/lib/python3.13/site-packages/pluggy/_manager.py", line 120 in _hookexec
  File "/opt/hostedtoolcache/Python/3.13.7/x64/lib/python3.13/site-packages/pluggy/_hooks.py", line 512 in __call__
  File "/opt/hostedtoolcache/Python/3.13.7/x64/lib/python3.13/site-packages/_pytest/python.py", line 1671 in runtest
  File "/opt/hostedtoolcache/Python/3.13.7/x64/lib/python3.13/site-packages/_pytest/runner.py", line 178 in pytest_runtest_call
  File "/opt/hostedtoolcache/Python/3.13.7/x64/lib/python3.13/site-packages/pluggy/_callers.py", line 121 in _multicall
  File "/opt/hostedtoolcache/Python/3.13.7/x64/lib/python3.13/site-packages/pluggy/_manager.py", line 120 in _hookexec
  File "/opt/hostedtoolcache/Python/3.13.7/x64/lib/python3.13/site-packages/pluggy/_hooks.py", line 512 in __call__
  File "/opt/hostedtoolcache/Python/3.13.7/x64/lib/python3.13/site-packages/_pytest/runner.py", line 246 in <lambda>
  File "/opt/hostedtoolcache/Python/3.13.7/x64/lib/python3.13/site-packages/_pytest/runner.py", line 344 in from_call
  File "/opt/hostedtoolcache/Python/3.13.7/x64/lib/python3.13/site-packages/_pytest/runner.py", line 245 in call_and_report
  File "/opt/hostedtoolcache/Python/3.13.7/x64/lib/python3.13/site-packages/_pytest/runner.py", line 136 in runtestprotocol
  File "/opt/hostedtoolcache/Python/3.13.7/x64/lib/python3.13/site-packages/_pytest/runner.py", line 117 in pytest_runtest_protocol
  File "/opt/hostedtoolcache/Python/3.13.7/x64/lib/python3.13/site-packages/pluggy/_callers.py", line 121 in _multicall
  File "/opt/hostedtoolcache/Python/3.13.7/x64/lib/python3.13/site-packages/pluggy/_manager.py", line 120 in _hookexec
  File "/opt/hostedtoolcache/Python/3.13.7/x64/lib/python3.13/site-packages/pluggy/_hooks.py", line 512 in __call__
  File "/opt/hostedtoolcache/Python/3.13.7/x64/lib/python3.13/site-packages/_pytest/main.py", line 367 in pytest_runtestloop
  File "/opt/hostedtoolcache/Python/3.13.7/x64/lib/python3.13/site-packages/pluggy/_callers.py", line 121 in _multicall
  File "/opt/hostedtoolcache/Python/3.13.7/x64/lib/python3.13/site-packages/pluggy/_manager.py", line 120 in _hookexec
  File "/opt/hostedtoolcache/Python/3.13.7/x64/lib/python3.13/site-packages/pluggy/_hooks.py", line 512 in __call__
  File "/opt/hostedtoolcache/Python/3.13.7/x64/lib/python3.13/site-packages/_pytest/main.py", line 343 in _main
  File "/opt/hostedtoolcache/Python/3.13.7/x64/lib/python3.13/site-packages/_pytest/main.py", line 289 in wrap_session
  File "/opt/hostedtoolcache/Python/3.13.7/x64/lib/python3.13/site-packages/_pytest/main.py", line 336 in pytest_cmdline_main
  File "/opt/hostedtoolcache/Python/3.13.7/x64/lib/python3.13/site-packages/pluggy/_callers.py", line 121 in _multicall
  File "/opt/hostedtoolcache/Python/3.13.7/x64/lib/python3.13/site-packages/pluggy/_manager.py", line 120 in _hookexec
  File "/opt/hostedtoolcache/Python/3.13.7/x64/lib/python3.13/site-packages/pluggy/_hooks.py", line 512 in __call__
  File "/opt/hostedtoolcache/Python/3.13.7/x64/lib/python3.13/site-packages/_pytest/config/__init__.py", line 175 in main
  File "/opt/hostedtoolcache/Python/3.13.7/x64/lib/python3.13/site-packages/_pytest/config/__init__.py", line 201 in console_main
  File "/opt/hostedtoolcache/Python/3.13.7/x64/lib/python3.13/site-packages/pytest/__main__.py", line 9 in <module>
  File "/opt/hostedtoolcache/Python/3.13.7/x64/lib/python3.13/site-packages/coverage/execfile.py", line 213 in run
  File "/opt/hostedtoolcache/Python/3.13.7/x64/lib/python3.13/site-packages/coverage/cmdline.py", line 1023 in do_run
  File "/opt/hostedtoolcache/Python/3.13.7/x64/lib/python3.13/site-packages/coverage/cmdline.py", line 834 in command_line
  File "/opt/hostedtoolcache/Python/3.13.7/x64/lib/python3.13/site-packages/coverage/cmdline.py", line 1135 in main
  File "/opt/hostedtoolcache/Python/3.13.7/x64/bin/coverage", line 7 in <module>

Extension modules: msgspec._core, native_internal, mypy, mypy.api, yaml._yaml, msgpack._cmsgpack (total: 6)
AddressSanitizer:DEADLYSIGNAL
=================================================================
==2689==ERROR: AddressSanitizer: SEGV on unknown address 0x03e900000a81 (pc 0x7f6d7289eb2c bp 0x525000abb290 sp 0x525000abb250 T0)
==2689==The signal is caused by a READ memory access.
    #0 0x7f6d7289eb2c in pthread_kill (/lib/x86_64-linux-gnu/libc.so.6+0x9eb2c) (BuildId: 274eec488d230825a136fa9c4d85370fed7a0a5e)
    #1 0x7f6d7284527d in gsignal (/lib/x86_64-linux-gnu/libc.so.6+0x4527d) (BuildId: 274eec488d230825a136fa9c4d85370fed7a0a5e)
    #2 0x7f6d7284532f  (/lib/x86_64-linux-gnu/libc.so.6+0x4532f) (BuildId: 274eec488d230825a136fa9c4d85370fed7a0a5e)
    #3 0x7f6d72e24bf3 in PyObject_IS_GC Python/gc.c:1795
    #4 0x7f6d72e6bc2b in _PyObject_GC_MAY_BE_TRACKED Include/internal/pycore_gc.h:97
    #5 0x7f6d72e6bc2b in make_dict_from_instance_attributes Objects/dictobject.c:6736
    #6 0x7f6d72e6bbc1 in _PyObject_MaterializeManagedDict_LockHeld Objects/dictobject.c:6758
    #7 0x7f6d72ddd861 in _PyObject_MaterializeManagedDict Objects/dictobject.c:6785
    #8 0x7f6d72ddd861 in ensure_managed_dict Objects/dictobject.c:7274
    #9 0x7f6d72ddd861 in PyObject_GenericGetDict Objects/dictobject.c:7336
    #10 0x7f6d72de4204 in _PyObject_GenericGetAttrWithDict Objects/object.c:1665
    #11 0x7f6d72de4204 in PyObject_GetOptionalAttr Objects/object.c:1296
    #12 0x7f6d72e15ac4 in builtin_hasattr_impl Python/bltinmodule.c:1256
    #13 0x7f6d72e15ac4 in builtin_hasattr Python/clinic/bltinmodule.c.h:609
    #14 0x7f6d72de2c06 in cfunction_vectorcall_FASTCALL Objects/methodobject.c:424
    #15 0x7f6d72dba4d2 in _PyObject_VectorcallTstate Include/internal/pycore_call.h:168
    #16 0x7f6d72dba4d2 in PyObject_Vectorcall Objects/call.c:327
    #17 0x7f6d72d2966a in _PyEval_EvalFrameDefault Python/generated_cases.c.h:813
    #18 0x7f6d72dbc722 in _PyObject_VectorcallTstate Include/internal/pycore_call.h:168
    #19 0x7f6d72dbc722 in method_vectorcall Objects/classobject.c:71
    #20 0x7f6d72d2815a in _PyEval_EvalFrameDefault Python/generated_cases.c.h:1355
    #21 0x7f6d72dbb389 in _PyFunction_Vectorcall Objects/call.c:413
    #22 0x7f6d72dbb389 in _PyObject_VectorcallDictTstate Objects/call.c:146
    #23 0x7f6d72dbb389 in _PyObject_Call_Prepend Objects/call.c:504
    #24 0x7f6d72e7cf01 in slot_tp_call Objects/typeobject.c:9570
    #25 0x7f6d72dba3e6 in _PyObject_MakeTpCall Objects/call.c:242
    #26 0x7f6d72d2f906 in _PyEval_EvalFrameDefault Python/generated_cases.c.h:1502
    #27 0x7f6d72dbb389 in _PyFunction_Vectorcall Objects/call.c:413
    #28 0x7f6d72dbb389 in _PyObject_VectorcallDictTstate Objects/call.c:146
    #29 0x7f6d72dbb389 in _PyObject_Call_Prepend Objects/call.c:504
    #30 0x7f6d72e7cf01 in slot_tp_call Objects/typeobject.c:9570
    #31 0x7f6d72dbbaee in _PyObject_Call Objects/call.c:361
    #32 0x7f6d72dbbaee in PyObject_Call Objects/call.c:373
    #33 0x7f6d72d2815a in _PyEval_EvalFrameDefault Python/generated_cases.c.h:1355
    #34 0x7f6d72dbb389 in _PyFunction_Vectorcall Objects/call.c:413
    #35 0x7f6d72dbb389 in _PyObject_VectorcallDictTstate Objects/call.c:146
    #36 0x7f6d72dbb389 in _PyObject_Call_Prepend Objects/call.c:504
    #37 0x7f6d72e7cf01 in slot_tp_call Objects/typeobject.c:9570
    #38 0x7f6d72dba3e6 in _PyObject_MakeTpCall Objects/call.c:242
    #39 0x7f6d72d2f906 in _PyEval_EvalFrameDefault Python/generated_cases.c.h:1502
    #40 0x7f6d72dbb389 in _PyFunction_Vectorcall Objects/call.c:413
    #41 0x7f6d72dbb389 in _PyObject_VectorcallDictTstate Objects/call.c:146
    #42 0x7f6d72dbb389 in _PyObject_Call_Prepend Objects/call.c:504
    #43 0x7f6d72e7cf01 in slot_tp_call Objects/typeobject.c:9570
    #44 0x7f6d72dba3e6 in _PyObject_MakeTpCall Objects/call.c:242
    #45 0x7f6d72d2f906 in _PyEval_EvalFrameDefault Python/generated_cases.c.h:1502
    #46 0x7f6d72dbb389 in _PyFunction_Vectorcall Objects/call.c:413
    #47 0x7f6d72dbb389 in _PyObject_VectorcallDictTstate Objects/call.c:146
    #48 0x7f6d72dbb389 in _PyObject_Call_Prepend Objects/call.c:504
    #49 0x7f6d72e7cf01 in slot_tp_call Objects/typeobject.c:9570
    #50 0x7f6d72dba3e6 in _PyObject_MakeTpCall Objects/call.c:242
    #51 0x7f6d72d2f906 in _PyEval_EvalFrameDefault Python/generated_cases.c.h:1502
    #52 0x7f6d72ea85b3 in PyEval_EvalCode Python/ceval.c:604
    #53 0x7f6d72ea7142 in builtin_exec_impl Python/bltinmodule.c:1143
    #54 0x7f6d72ea7142 in builtin_exec Python/clinic/bltinmodule.c.h:556
    #55 0x7f6d72de29c2 in cfunction_vectorcall_FASTCALL_KEYWORDS Objects/methodobject.c:440
    #56 0x7f6d72dba4d2 in _PyObject_VectorcallTstate Include/internal/pycore_call.h:168
    #57 0x7f6d72dba4d2 in PyObject_Vectorcall Objects/call.c:327
    #58 0x7f6d72d2966a in _PyEval_EvalFrameDefault Python/generated_cases.c.h:813
    #59 0x7f6d72ea85b3 in PyEval_EvalCode Python/ceval.c:604
    #60 0x7f6d72ec6bbc in run_eval_code_obj Python/pythonrun.c:1381
    #61 0x7f6d72ec65f4 in run_mod Python/pythonrun.c:1466
    #62 0x7f6d72ec6514 in pyrun_file Python/pythonrun.c:1295
    #63 0x7f6d72ec636b in _PyRun_SimpleFileObject Python/pythonrun.c:517
    #64 0x7f6d72ec6187 in _PyRun_AnyFileObject Python/pythonrun.c:77
    #65 0x7f6d72ecfb06 in pymain_run_file_obj Modules/main.c:410
    #66 0x7f6d72ecfb06 in pymain_run_file Modules/main.c:429
    #67 0x7f6d72ecfb06 in pymain_run_python Modules/main.c:696
    #68 0x7f6d72ecfb06 in Py_RunMain Modules/main.c:775
    #69 0x7f6d72ecf66a in Py_BytesMain Modules/main.c:829
    #70 0x7f6d7282a1c9  (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 274eec488d230825a136fa9c4d85370fed7a0a5e)
    #71 0x7f6d7282a28a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 274eec488d230825a136fa9c4d85370fed7a0a5e)
    #72 0x56119b7d5094 in _start (/opt/hostedtoolcache/Python/3.13.7/x64/bin/python3.13+0x1094) (BuildId: bf9669d2008ecbbbcbb359aa705bc419c1858020)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (/lib/x86_64-linux-gnu/libc.so.6+0x9eb2c) (BuildId: 274eec488d230825a136fa9c4d85370fed7a0a5e) in pthread_kill
==2689==ABORTING
tests/test_struct.py ...................................................................................................................................................................................................................................................................

[provinzkraut]

I can reproduce the segfault locally on 3.13.7. However, it disappears when I run the tests with pytest -v. That seems odd.

[shadchin]

I fixed this issue as follows

--- a/src/msgspec/_core.c
+++ b/src/msgspec/_core.c
@@ -5173,6 +5173,11 @@ Struct_alloc(PyTypeObject *type) {
     if (obj == NULL) return NULL;
     /* Zero out slot fields */
     memset((char *)obj + sizeof(PyObject), '\0', type->tp_basicsize - sizeof(PyObject));
+#if PY313_PLUS
+    if (type->tp_flags & Py_TPFLAGS_INLINE_VALUES) {
+        _PyObject_InitInlineValues(obj, type);
+    }
+#endif
     return obj;
 }

[provinzkraut]

@shadchin would you mind submitting a PR with your fix?

[shadchin]

Done #960