python3.10.12 crashed on powerpc 32bit system when PyGC_Collect()

[fduan001]

Crash report

What happened?

^@(gdb)
#0  _PyObject_IS_GC (obj=0x80000000) at ../Python-3.10.13/Include/internal/pycore_object.h:165
#1  visit_decref (op=0x80000000, parent=parent@entry=0xb78a5b18) at ../Python-3.10.13/Modules/gcmodule.c:456
#2  0x0fe3297c in abc_data_traverse (self=0xb78a5b18, visit=0xfdee5e0 <visit_decref>, arg=0xb78a5b18) at ../Python-3.10.13/Modules/_abc.c:52
#3  0x0fdef3cc in subtract_refs (containers=<optimized out>) at ../Python-3.10.13/Modules/gcmodule.c:482
#4  deduce_unreachable (unreachable=0xbfedad4c, base=<optimized out>) at ../Python-3.10.13/Modules/gcmodule.c:1105
#5  gc_collect_main (tstate=tstate@entry=0x10030030, generation=generation@entry=2, n_collected=n_collected@entry=0xbfedadcc,
    n_uncollectable=n_uncollectable@entry=0xbfedadc8, nofail=nofail@entry=0) at ../Python-3.10.13/Modules/gcmodule.c:1239
#6  0x0fdf00e0 in gc_collect_with_callback (tstate=tstate@entry=0x10030030, generation=generation@entry=2)
    at ../Python-3.10.13/Modules/gcmodule.c:1413
#7  0x0fdf08f8 in PyGC_Collect () at ../Python-3.10.13/Modules/gcmodule.c:2099
#8  0x0fdc0430 in Py_FinalizeEx () at ../Python-3.10.13/Python/pylifecycle.c:1781
#9  Py_FinalizeEx () at ../Python-3.10.13/Python/pylifecycle.c:1703
#10 0x0fdc146c in Py_Exit (sts=0) at ../Python-3.10.13/Python/pylifecycle.c:2858
#11 0x0fdc791c in handle_system_exit () at ../Python-3.10.13/Python/pythonrun.c:775
#12 _PyErr_PrintEx (tstate=0x10030030, set_sys_last_vars=set_sys_last_vars@entry=1) at ../Python-3.10.13/Python/pythonrun.c:785
#13 0x0fdc7980 in PyErr_PrintEx (set_sys_last_vars=set_sys_last_vars@entry=1) at ../Python-3.10.13/Python/pythonrun.c:880
#14 0x0fdc79a8 in PyErr_Print () at ../Python-3.10.13/Python/pythonrun.c:886
#15 0x0fdc8170 in _PyRun_SimpleFileObject (fp=fp@entry=0x10021430, filename=filename@entry=0xb78105a0, closeit=closeit@entry=1,
    flags=flags@entry=0xbfedafb0) at ../Python-3.10.13/Python/pythonrun.c:462
#16 0x0fdc84f4 in _PyRun_AnyFileObject (fp=fp@entry=0x10021430, filename=filename@entry=0xb78105a0, closeit=closeit@entry=1,
    flags=flags@entry=0xbfedafb0) at ../Python-3.10.13/Python/pythonrun.c:90
#17 0x0fded70c in pymain_run_file_obj (skip_source_first_line=0, filename=0xb78105a0, program_name=0xb78fbee0)
    at ../Python-3.10.13/Modules/main.c:353
#18 pymain_run_file (config=0x10021ff4) at ../Python-3.10.13/Modules/main.c:372
#19 pymain_run_python (exitcode=0xbfedafb8) at ../Python-3.10.13/Modules/main.c:587
#20 Py_RunMain () at ../Python-3.10.13/Modules/main.c:666
#21 0x0fdedbcc in pymain_main (args=args@entry=0xbfedb048) at ../Python-3.10.13/Modules/main.c:696
#22 0x0fdedcb0 in Py_BytesMain (argc=<optimized out>, argv=<optimized out>) at ../Python-3.10.13/Modules/main.c:720
#23 0x10000474 in main (argc=<optimized out>, argv=<optimized out>) at ../Python-3.10.13/Programs/python.c:15

CPython versions tested on:

3.10

Operating systems tested on:

Linux

Output from running 'python -VV' on the command line:

Python 3.10.13 (main, Aug 24 2023, 12:59:26) [GCC 11.4.0]

[fduan001]

^@(gdb)
#0  _PyObject_IS_GC (obj=0x80000000) at ../Python-3.10.13/Include/internal/pycore_object.h:165
#1  visit_decref (op=0x80000000, parent=parent@entry=0xb78a5b18) at ../Python-3.10.13/Modules/gcmodule.c:456
#2  0x0fe3297c in abc_data_traverse (self=0xb78a5b18, visit=0xfdee5e0 <visit_decref>, arg=0xb78a5b18) at ../Python-3.10.13/Modules/_abc.c:52
#3  0x0fdef3cc in subtract_refs (containers=<optimized out>) at ../Python-3.10.13/Modules/gcmodule.c:482
#4  deduce_unreachable (unreachable=0xbfedad4c, base=<optimized out>) at ../Python-3.10.13/Modules/gcmodule.c:1105
#5  gc_collect_main (tstate=tstate@entry=0x10030030, generation=generation@entry=2, n_collected=n_collected@entry=0xbfedadcc,
    n_uncollectable=n_uncollectable@entry=0xbfedadc8, nofail=nofail@entry=0) at ../Python-3.10.13/Modules/gcmodule.c:1239
#6  0x0fdf00e0 in gc_collect_with_callback (tstate=tstate@entry=0x10030030, generation=generation@entry=2)
    at ../Python-3.10.13/Modules/gcmodule.c:1413
#7  0x0fdf08f8 in PyGC_Collect () at ../Python-3.10.13/Modules/gcmodule.c:2099
#8  0x0fdc0430 in Py_FinalizeEx () at ../Python-3.10.13/Python/pylifecycle.c:1781
#9  Py_FinalizeEx () at ../Python-3.10.13/Python/pylifecycle.c:1703
#10 0x0fdc146c in Py_Exit (sts=0) at ../Python-3.10.13/Python/pylifecycle.c:2858
#11 0x0fdc791c in handle_system_exit () at ../Python-3.10.13/Python/pythonrun.c:775
#12 _PyErr_PrintEx (tstate=0x10030030, set_sys_last_vars=set_sys_last_vars@entry=1) at ../Python-3.10.13/Python/pythonrun.c:785
#13 0x0fdc7980 in PyErr_PrintEx (set_sys_last_vars=set_sys_last_vars@entry=1) at ../Python-3.10.13/Python/pythonrun.c:880
#14 0x0fdc79a8 in PyErr_Print () at ../Python-3.10.13/Python/pythonrun.c:886
#15 0x0fdc8170 in _PyRun_SimpleFileObject (fp=fp@entry=0x10021430, filename=filename@entry=0xb78105a0, closeit=closeit@entry=1,
    flags=flags@entry=0xbfedafb0) at ../Python-3.10.13/Python/pythonrun.c:462
#16 0x0fdc84f4 in _PyRun_AnyFileObject (fp=fp@entry=0x10021430, filename=filename@entry=0xb78105a0, closeit=closeit@entry=1,
    flags=flags@entry=0xbfedafb0) at ../Python-3.10.13/Python/pythonrun.c:90
#17 0x0fded70c in pymain_run_file_obj (skip_source_first_line=0, filename=0xb78105a0, program_name=0xb78fbee0)
    at ../Python-3.10.13/Modules/main.c:353
#18 pymain_run_file (config=0x10021ff4) at ../Python-3.10.13/Modules/main.c:372
#19 pymain_run_python (exitcode=0xbfedafb8) at ../Python-3.10.13/Modules/main.c:587
#20 Py_RunMain () at ../Python-3.10.13/Modules/main.c:666
#21 0x0fdedbcc in pymain_main (args=args@entry=0xbfedb048) at ../Python-3.10.13/Modules/main.c:696
#22 0x0fdedcb0 in Py_BytesMain (argc=<optimized out>, argv=<optimized out>) at ../Python-3.10.13/Modules/main.c:720
#23 0x10000474 in main (argc=<optimized out>, argv=<optimized out>) at ../Python-3.10.13/Programs/python.c:15
(gdb)

[fduan001]

(gdb) bt
#0  PyType_HasFeature (feature=<optimized out>, type=<optimized out>) at ../Python-3.10.13/Objects/dictobject.c:1826
#1  _PyDict_Next (op=0x40, ppos=0xbfbedf78, pkey=0x0, pvalue=0xbfbedf7c, phash=0x0) at ../Python-3.10.13/Objects/dictobject.c:1826
#2  0x0fcaf458 in PyDict_Next (op=op@entry=0x40, ppos=ppos@entry=0xbfbedf78, pkey=pkey@entry=0x0, pvalue=pvalue@entry=0xbfbedf7c)
    at ../Python-3.10.13/Objects/dictobject.c:1882
#3  0x0fce24d4 in PyType_Modified (type=0xffd8588 <PyBytesIO_Type>) at ../Python-3.10.13/Objects/typeobject.c:343
#4  PyType_Modified (type=0xffd8588 <PyBytesIO_Type>) at ../Python-3.10.13/Objects/typeobject.c:316
#5  0x0fce2504 in PyType_Modified (type=0xffd8c04 <PyBufferedIOBase_Type>) at ../Python-3.10.13/Objects/typeobject.c:347
#6  PyType_Modified (type=0xffd8c04 <PyBufferedIOBase_Type>) at ../Python-3.10.13/Objects/typeobject.c:316
#7  0x0fce2504 in PyType_Modified (type=0xffd7f78 <PyIOBase_Type>) at ../Python-3.10.13/Objects/typeobject.c:347
#8  PyType_Modified (type=0xffd7f78 <PyIOBase_Type>) at ../Python-3.10.13/Objects/typeobject.c:316
#9  0x0fce2504 in PyType_Modified (type=0xffcd098 <PyBaseObject_Type>) at ../Python-3.10.13/Objects/typeobject.c:347
#10 PyType_Modified (type=0xffcd098 <PyBaseObject_Type>) at ../Python-3.10.13/Objects/typeobject.c:316
#11 0x0fce2e74 in type_cache_clear (use_none=<optimized out>, cache=<optimized out>) at ../Python-3.10.13/Objects/typeobject.c:249
#12 _PyType_ClearCache (interp=interp@entry=0x10021df0) at ../Python-3.10.13/Objects/typeobject.c:291
#13 0x0fce2f1c in _PyType_Fini (interp=interp@entry=0x10021df0) at ../Python-3.10.13/Objects/typeobject.c:308
#14 0x0fdbcb94 in finalize_interp_types (interp=0x10021df0) at ../Python-3.10.13/Python/pylifecycle.c:1641
#15 finalize_interp_clear (tstate=tstate@entry=0x10030030) at ../Python-3.10.13/Python/pylifecycle.c:1680
#16 0x0fdc0464 in Py_FinalizeEx () at ../Python-3.10.13/Python/pylifecycle.c:1843
#17 Py_FinalizeEx () at ../Python-3.10.13/Python/pylifecycle.c:1703
#18 0x0fdc146c in Py_Exit (sts=0) at ../Python-3.10.13/Python/pylifecycle.c:2858
#19 0x0fdc791c in handle_system_exit () at ../Python-3.10.13/Python/pythonrun.c:775
#20 _PyErr_PrintEx (tstate=0x10030030, set_sys_last_vars=set_sys_last_vars@entry=1) at ../Python-3.10.13/Python/pythonrun.c:785
#21 0x0fdc7980 in PyErr_PrintEx (set_sys_last_vars=set_sys_last_vars@entry=1) at ../Python-3.10.13/Python/pythonrun.c:880
#22 0x0fdc79a8 in PyErr_Print () at ../Python-3.10.13/Python/pythonrun.c:886
#23 0x0fdc8170 in _PyRun_SimpleFileObject (fp=fp@entry=0x10021430, filename=filename@entry=0xb7c195a0, closeit=closeit@entry=1,
    flags=flags@entry=0xbfbee220) at ../Python-3.10.13/Python/pythonrun.c:462
#24 0x0fdc84f4 in _PyRun_AnyFileObject (fp=fp@entry=0x10021430, filename=filename@entry=0xb7c195a0, closeit=closeit@entry=1,
    flags=flags@entry=0xbfbee220) at ../Python-3.10.13/Python/pythonrun.c:90
#25 0x0fded70c in pymain_run_file_obj (skip_source_first_line=0, filename=0xb7c195a0, program_name=0xb7d04ee0)
    at ../Python-3.10.13/Modules/main.c:353
#26 pymain_run_file (config=0x10021ff4) at ../Python-3.10.13/Modules/main.c:372
#27 pymain_run_python (exitcode=0xbfbee228) at ../Python-3.10.13/Modules/main.c:587
#28 Py_RunMain () at ../Python-3.10.13/Modules/main.c:666
#29 0x0fdedbcc in pymain_main (args=args@entry=0xbfbee2b8) at ../Python-3.10.13/Modules/main.c:696
#30 0x0fdedcb0 in Py_BytesMain (argc=<optimized out>, argv=<optimized out>) at ../Python-3.10.13/Modules/main.c:720
#31 0x10000474 in main (argc=<optimized out>, argv=<optimized out>) at ../Python-3.10.13/Programs/python.c:15

[fduan001]

Anyone know whether op=0x40 is valid or not?

[ZeroIntensity]

Stack traces aren't all that useful here :(

Do you have some code that's causing this? (Especially if you have an extension module active. In that case, it's likely you have an extra DECREF somewhere.)

[vstinner]

Can you reproduce the issue with a debug build of Python?

Moreover, can you try a more recent Python version, such as 3.12, or even 3.13?

op=0x80000000 is a surprising pointer address. op=op@entry=0x40 looks like a null pointer deference.

[rruuaanng]

I think you should try creating a dict, releasing it's reference count, and then attempting to call PyGC_Collect, which may trigger the problem again. from the stack perspective, it seems to be related to operating on released objects.

[ZeroIntensity]

I've marked this as pending, because there isn't any way we can solve the issue without seeing some code, and there hasn't been any reply. @fduan001

[thesamesam]

Please share the output of gcc -v and ld -v. Thanks.

Also, what did you hit this on (what were you doing? what project)?

[ZeroIntensity]

As no extra information has been provided, I'm going to close this for now. (I suspect the author doesn't have any notifications on, but there's nothing we can do about that. This is just noise in the crash issues that we need to deal with.)