IPython test suite: `./Include/cpython/tupleobject.h:24: PyTuple_GET_SIZE: Assertion PyTuple_Check(op) failed.`

[mgorny]

Crash report

What happened?

ipython/ipython@f6fd3f5 started causing an assertion failure in its test suite:

$ pytest -s IPython/extensions/tests/test_deduperreload.py::DecoratorPatchingSuite::test_function_decorator_from_other_module
========================================================= test session starts =========================================================
platform linux -- Python 3.15.0a0, pytest-8.4.1, pluggy-1.6.0
rootdir: /tmp/ipython
configfile: pyproject.toml
collected 1 item                                                                                                                      

IPython/extensions/tests/test_deduperreload.py python3: ./Include/cpython/tupleobject.h:24: PyTuple_GET_SIZE: Assertion `PyTuple_Check(op)' failed.
Fatal Python error: Aborted

Current thread 0x00007fab77070780 [pytest] (most recent call first):
  File "/tmp/ipython/IPython/extensions/deduperreload/deduperreload_patching.py", line 103 in try_patch_attr
  File "/tmp/ipython/IPython/extensions/deduperreload/deduperreload_patching.py", line 132 in patch_function
  File "/tmp/ipython/IPython/extensions/deduperreload/deduperreload.py", line 485 in _patch_namespace_inner
  File "/tmp/ipython/IPython/extensions/deduperreload/deduperreload.py", line 529 in _patch_namespace
  File "/tmp/ipython/IPython/extensions/deduperreload/deduperreload.py", line 561 in maybe_reload_module
  File "/tmp/ipython/IPython/extensions/autoreload.py", line 322 in check
  File "/tmp/ipython/IPython/extensions/autoreload.py", line 848 in pre_run_cell
  File "/tmp/ipython/IPython/extensions/tests/test_deduperreload.py", line 706 in pre_run_cell
  File "/tmp/ipython/IPython/extensions/tests/test_deduperreload.py", line 719 in run_code
  File "/tmp/ipython/IPython/extensions/tests/test_deduperreload.py", line 2279 in test_function_decorator_from_other_module
  File "/home/mgorny/git/cpython/Lib/unittest/case.py", line 613 in _callTestMethod
  File "/home/mgorny/git/cpython/Lib/unittest/case.py", line 667 in run
  File "/home/mgorny/git/cpython/Lib/unittest/case.py", line 723 in __call__
  File "/tmp/ipython/.venv/lib/python3.15/site-packages/_pytest/unittest.py", line 351 in runtest
  File "/tmp/ipython/.venv/lib/python3.15/site-packages/_pytest/runner.py", line 178 in pytest_runtest_call
  File "/tmp/ipython/.venv/lib/python3.15/site-packages/pluggy/_callers.py", line 121 in _multicall
  File "/tmp/ipython/.venv/lib/python3.15/site-packages/pluggy/_manager.py", line 120 in _hookexec
  File "/tmp/ipython/.venv/lib/python3.15/site-packages/pluggy/_hooks.py", line 512 in __call__
  File "/tmp/ipython/.venv/lib/python3.15/site-packages/_pytest/runner.py", line 246 in <lambda>
  File "/tmp/ipython/.venv/lib/python3.15/site-packages/_pytest/runner.py", line 344 in from_call
  File "/tmp/ipython/.venv/lib/python3.15/site-packages/_pytest/runner.py", line 245 in call_and_report
  File "/tmp/ipython/.venv/lib/python3.15/site-packages/_pytest/runner.py", line 136 in runtestprotocol
  File "/tmp/ipython/.venv/lib/python3.15/site-packages/_pytest/runner.py", line 117 in pytest_runtest_protocol
  File "/tmp/ipython/.venv/lib/python3.15/site-packages/pluggy/_callers.py", line 121 in _multicall
  File "/tmp/ipython/.venv/lib/python3.15/site-packages/pluggy/_manager.py", line 120 in _hookexec
  File "/tmp/ipython/.venv/lib/python3.15/site-packages/pluggy/_hooks.py", line 512 in __call__
  File "/tmp/ipython/.venv/lib/python3.15/site-packages/_pytest/main.py", line 367 in pytest_runtestloop
  File "/tmp/ipython/.venv/lib/python3.15/site-packages/pluggy/_callers.py", line 121 in _multicall
  File "/tmp/ipython/.venv/lib/python3.15/site-packages/pluggy/_manager.py", line 120 in _hookexec
  File "/tmp/ipython/.venv/lib/python3.15/site-packages/pluggy/_hooks.py", line 512 in __call__
  File "/tmp/ipython/.venv/lib/python3.15/site-packages/_pytest/main.py", line 343 in _main
  File "/tmp/ipython/.venv/lib/python3.15/site-packages/_pytest/main.py", line 289 in wrap_session
  File "/tmp/ipython/.venv/lib/python3.15/site-packages/_pytest/main.py", line 336 in pytest_cmdline_main
  File "/tmp/ipython/.venv/lib/python3.15/site-packages/pluggy/_callers.py", line 121 in _multicall
  File "/tmp/ipython/.venv/lib/python3.15/site-packages/pluggy/_manager.py", line 120 in _hookexec
  File "/tmp/ipython/.venv/lib/python3.15/site-packages/pluggy/_hooks.py", line 512 in __call__
  File "/tmp/ipython/.venv/lib/python3.15/site-packages/_pytest/config/__init__.py", line 175 in main
  File "/tmp/ipython/.venv/lib/python3.15/site-packages/_pytest/config/__init__.py", line 201 in console_main
  File "/tmp/ipython/.venv/bin/pytest", line 10 in <module>

Current thread's C stack trace (most recent call first):
  Binary file "/tmp/ipython/.venv/bin/python3", at _Py_DumpStack+0x46 [0x55ede4eecee7]
  Binary file "/tmp/ipython/.venv/bin/python3", at +0x348d42 [0x55ede4f09d42]
  Binary file "/tmp/ipython/.venv/bin/python3", at +0x3494d8 [0x55ede4f0a4d8]
  Binary file "/usr/lib64/libc.so.6", at +0x3de10 [0x7fab770b0e10]
  Binary file "/usr/lib64/libc.so.6", at +0x97aac [0x7fab7710aaac]
  Binary file "/usr/lib64/libc.so.6", at gsignal+0x16 [0x7fab770b0cd6]
  Binary file "/usr/lib64/libc.so.6", at abort+0x28 [0x7fab7709830b]
  Binary file "/usr/lib64/libc.so.6", at __assert_perror_fail+0x0 [0x7fab77098275]
  Binary file "/tmp/ipython/.venv/bin/python3", at +0x1527f1 [0x55ede4d137f1]
  Binary file "/tmp/ipython/.venv/bin/python3", at +0x15407e [0x55ede4d1507e]
  Binary file "/tmp/ipython/.venv/bin/python3", at +0x1370a7 [0x55ede4cf80a7]
  Binary file "/tmp/ipython/.venv/bin/python3", at _PyObject_GenericSetAttrWithDict+0xc6 [0x55ede4d4b519]
  Binary file "/tmp/ipython/.venv/bin/python3", at PyObject_GenericSetAttr+0x12 [0x55ede4d4b77b]
  Binary file "/tmp/ipython/.venv/bin/python3", at PyObject_SetAttr+0x75 [0x55ede4d49c52]
  Binary file "/tmp/ipython/.venv/bin/python3", at +0x264e37 [0x55ede4e25e37]
  Binary file "/tmp/ipython/.venv/bin/python3", at +0x264e92 [0x55ede4e25e92]
  Binary file "/tmp/ipython/.venv/bin/python3", at _PyEval_EvalFrameDefault+0x6642 [0x55ede4e373ad]
  Binary file "/tmp/ipython/.venv/bin/python3", at +0x2927bc [0x55ede4e537bc]
  Binary file "/tmp/ipython/.venv/bin/python3", at +0x29298d [0x55ede4e5398d]
  Binary file "/tmp/ipython/.venv/bin/python3", at +0x1281f1 [0x55ede4ce91f1]
  Binary file "/tmp/ipython/.venv/bin/python3", at +0x12b634 [0x55ede4cec634]
  Binary file "/tmp/ipython/.venv/bin/python3", at +0x12b829 [0x55ede4cec829]
  Binary file "/tmp/ipython/.venv/bin/python3", at +0x129eec [0x55ede4ceaeec]
  Binary file "/tmp/ipython/.venv/bin/python3", at +0x12a1d2 [0x55ede4ceb1d2]
  Binary file "/tmp/ipython/.venv/bin/python3", at PyObject_Call+0x24 [0x55ede4ceb20e]
  Binary file "/tmp/ipython/.venv/bin/python3", at _PyEval_EvalFrameDefault+0x73ff [0x55ede4e3816a]
  Binary file "/tmp/ipython/.venv/bin/python3", at +0x2927bc [0x55ede4e537bc]
  Binary file "/tmp/ipython/.venv/bin/python3", at +0x29298d [0x55ede4e5398d]
  Binary file "/tmp/ipython/.venv/bin/python3", at +0x1281f1 [0x55ede4ce91f1]
  Binary file "/tmp/ipython/.venv/bin/python3", at +0x129cbd [0x55ede4ceacbd]
  Binary file "/tmp/ipython/.venv/bin/python3", at +0x129daa [0x55ede4ceadaa]
  Binary file "/tmp/ipython/.venv/bin/python3", at +0x1c5732 [0x55ede4d86732]
  <truncated rest of calls>
Aborted                    (core dumped) pytest -s IPython/extensions/tests/test_deduperreload.py::DecoratorPatchingSuite::test_function_decorator_from_other_module

FWIU it does not involve any compiled extensions, just pure Python code. Unfortunately, the logic seems pretty complex and I wasn't able to find sufficient time to reduce it. I've been able to reproduce with 3.11.13, 3.13.7, and main as of 31d3836 built with --with-pydebug, so I guess all versions are affected.

Backtrace:

#0  0x00007fab7710aaac in ?? () from /usr/lib64/libc.so.6
#1  0x00007fab770b0cd6 in raise () from /usr/lib64/libc.so.6
#2  0x000055ede4f0a4f3 in faulthandler_fatal_error (signum=6) at ./Modules/faulthandler.c:427
#3  <signal handler called>
#4  0x00007fab7710aaac in ?? () from /usr/lib64/libc.so.6
#5  0x00007fab770b0cd6 in raise () from /usr/lib64/libc.so.6
#6  0x00007fab7709830b in abort () from /usr/lib64/libc.so.6
#7  0x00007fab77098275 in ?? () from /usr/lib64/libc.so.6
#8  0x000055ede4d137f1 in PyTuple_GET_SIZE (op=<optimized out>) at ./Include/cpython/tupleobject.h:24
#9  0x000055ede4d1507e in func_set_code (self=0x7fab70622150, value=0x7fab705dece0, _unused_ignored=<optimized out>)
    at Objects/funcobject.c:681
#10 0x000055ede4cf80a7 in getset_set (self=0x7fab76fb55b0, obj=0x7fab70622150, value=0x7fab705dece0) at Objects/descrobject.c:250
#11 0x000055ede4d4b519 in _PyObject_GenericSetAttrWithDict (obj=0x7fab70622150, name=0x7fab76f76ca0, value=0x7fab705dece0, 
    dict=dict@entry=0x0) at Objects/object.c:1959
#12 0x000055ede4d4b77b in PyObject_GenericSetAttr (obj=<optimized out>, name=<optimized out>, value=<optimized out>)
    at Objects/object.c:2030
#13 0x000055ede4d49c52 in PyObject_SetAttr (v=0x7fab70622150, name=<optimized out>, value=0x7fab705dece0) at Objects/object.c:1475
#14 0x000055ede4e25e37 in builtin_setattr_impl (module=module@entry=0x7fab770312b0, obj=<optimized out>, name=<optimized out>, 
    value=<optimized out>) at Python/bltinmodule.c:1726
#15 0x000055ede4e25e92 in builtin_setattr (module=0x7fab770312b0, args=args@entry=0x7ffd8032f978, nargs=nargs@entry=3)
    at Python/clinic/bltinmodule.c.h:681
#16 0x000055ede4e373ad in _PyEval_EvalFrameDefault (tstate=0x55ede5262260 <_PyRuntime+333056>, frame=0x7fab77377bf0, throwflag=0)
    at Python/generated_cases.c.h:2249
#17 0x000055ede4e537bc in _PyEval_EvalFrame (tstate=tstate@entry=0x55ede5262260 <_PyRuntime+333056>, 
    frame=frame@entry=0x7fab77377380, throwflag=throwflag@entry=0) at ./Include/internal/pycore_ceval.h:121
#18 0x000055ede4e5398d in _PyEval_Vector (tstate=0x55ede5262260 <_PyRuntime+333056>, func=0x7fab755b87d0, locals=locals@entry=0x0, 
    args=0x7fab70d6d5a0, argcount=<optimized out>, kwnames=0x7fab7053aa30) at Python/ceval.c:1989
#19 0x000055ede4ce91f1 in _PyFunction_Vectorcall (func=<optimized out>, stack=<optimized out>, nargsf=<optimized out>, 
    kwnames=<optimized out>) at Objects/call.c:413
#20 0x000055ede4cec634 in _PyObject_VectorcallTstate (tstate=tstate@entry=0x55ede5262260 <_PyRuntime+333056>, 
    callable=callable@entry=0x7fab755b87d0, args=args@entry=0x7fab70d6d5a0, nargsf=nargsf@entry=1, 
    kwnames=kwnames@entry=0x7fab7053aa30) at ./Include/internal/pycore_call.h:169
#21 0x000055ede4cec829 in method_vectorcall (method=method@entry=0x7fab7061c170, args=args@entry=0x7fab70d6d5a8, 
    nargsf=<optimized out>, kwnames=0x7fab7053aa30) at Objects/classobject.c:65
#22 0x000055ede4ceaeec in _PyVectorcall_Call (tstate=tstate@entry=0x55ede5262260 <_PyRuntime+333056>, 
    func=0x55ede4cec6bc <method_vectorcall>, callable=callable@entry=0x7fab7061c170, 
    tuple=tuple@entry=0x55ede522b338 <_PyRuntime+107992>, kwargs=kwargs@entry=0x7fab7045d010) at Objects/call.c:285
#23 0x000055ede4ceb1d2 in _PyObject_Call (tstate=0x55ede5262260 <_PyRuntime+333056>, callable=callable@entry=0x7fab7061c170, 
    args=args@entry=0x55ede522b338 <_PyRuntime+107992>, kwargs=kwargs@entry=0x7fab7045d010) at Objects/call.c:348
#24 0x000055ede4ceb20e in PyObject_Call (callable=callable@entry=0x7fab7061c170, args=args@entry=0x55ede522b338 <_PyRuntime+107992>, 
    kwargs=kwargs@entry=0x7fab7045d010) at Objects/call.c:373
#25 0x000055ede4e3816a in _PyEval_EvalFrameDefault (tstate=0x55ede5262260 <_PyRuntime+333056>, frame=0x7fab773772f0, throwflag=0)
    at Python/generated_cases.c.h:2616
#26 0x000055ede4e537bc in _PyEval_EvalFrame (tstate=tstate@entry=0x55ede5262260 <_PyRuntime+333056>, 
    frame=frame@entry=0x7fab773772f0, throwflag=throwflag@entry=0) at ./Include/internal/pycore_ceval.h:121
#27 0x000055ede4e5398d in _PyEval_Vector (tstate=0x55ede5262260 <_PyRuntime+333056>, func=0x7fab755b8a10, locals=locals@entry=0x0, 
    args=0x7fab70d6d3f8, argcount=<optimized out>, kwnames=0x7fab7067b700) at Python/ceval.c:1989
#28 0x000055ede4ce91f1 in _PyFunction_Vectorcall (func=<optimized out>, stack=<optimized out>, nargsf=<optimized out>, 
    kwnames=<optimized out>) at Objects/call.c:413
#29 0x000055ede4ceacbd in _PyObject_VectorcallDictTstate (tstate=tstate@entry=0x55ede5262260 <_PyRuntime+333056>, 
    callable=callable@entry=0x7fab755b8a10, args=args@entry=0x7ffd80330130, nargsf=<optimized out>, nargsf@entry=1, 
    kwargs=kwargs@entry=0x7fab70544830) at Objects/call.c:146
#30 0x000055ede4ceadaa in _PyObject_Call_Prepend (tstate=tstate@entry=0x55ede5262260 <_PyRuntime+333056>, callable=0x7fab755b8a10, 
    obj=obj@entry=0x7fab7058f080, args=args@entry=0x55ede522b338 <_PyRuntime+107992>, kwargs=kwargs@entry=0x7fab70544830)
    at Objects/call.c:504
#31 0x000055ede4d86732 in call_method (self=0x7fab7058f080, attr=<optimized out>, args=0x55ede522b338 <_PyRuntime+107992>, 
    kwds=0x7fab70544830) at Objects/typeobject.c:3060
#32 0x000055ede4d8682c in slot_tp_call (self=<optimized out>, args=<optimized out>, kwds=<optimized out>)
    at Objects/typeobject.c:10562
#33 0x000055ede4ce939b in _PyObject_MakeTpCall (tstate=tstate@entry=0x55ede5262260 <_PyRuntime+333056>, 
    callable=callable@entry=0x7fab7058f080, args=args@entry=0x7ffd80330478, nargs=<optimized out>, 
    keywords=keywords@entry=0x7fab7539adf0) at Objects/call.c:242
#34 0x000055ede4ce95ce in _PyObject_VectorcallTstate (tstate=0x55ede5262260 <_PyRuntime+333056>, 
    callable=callable@entry=0x7fab7058f080, args=args@entry=0x7ffd80330478, nargsf=<optimized out>, 
    kwnames=kwnames@entry=0x7fab7539adf0) at ./Include/internal/pycore_call.h:167
#35 0x000055ede4ce9624 in PyObject_Vectorcall (callable=callable@entry=0x7fab7058f080, args=args@entry=0x7ffd80330478, 
    nargsf=<optimized out>, kwnames=kwnames@entry=0x7fab7539adf0) at Objects/call.c:327
#36 0x000055ede4e3913d in _PyEval_EvalFrameDefault (tstate=0x55ede5262260 <_PyRuntime+333056>, frame=0x7fab77377250, throwflag=0)
    at Python/generated_cases.c.h:2920
#37 0x000055ede4e537bc in _PyEval_EvalFrame (tstate=tstate@entry=0x55ede5262260 <_PyRuntime+333056>, 
    frame=frame@entry=0x7fab77376f60, throwflag=throwflag@entry=0) at ./Include/internal/pycore_ceval.h:121
#38 0x000055ede4e5398d in _PyEval_Vector (tstate=0x55ede5262260 <_PyRuntime+333056>, func=0x7fab75f9e5d0, locals=locals@entry=0x0, 
    args=0x7fab70d6d488, argcount=<optimized out>, kwnames=0x7fab7068fbb0) at Python/ceval.c:1989
#39 0x000055ede4ce91f1 in _PyFunction_Vectorcall (func=<optimized out>, stack=<optimized out>, nargsf=<optimized out>, 
    kwnames=<optimized out>) at Objects/call.c:413
#40 0x000055ede4ceacbd in _PyObject_VectorcallDictTstate (tstate=tstate@entry=0x55ede5262260 <_PyRuntime+333056>, 
    callable=callable@entry=0x7fab75f9e5d0, args=args@entry=0x7ffd803306e0, nargsf=<optimized out>, nargsf@entry=1, 
    kwargs=kwargs@entry=0x7fab707020f0) at Objects/call.c:146
#41 0x000055ede4ceadaa in _PyObject_Call_Prepend (tstate=tstate@entry=0x55ede5262260 <_PyRuntime+333056>, callable=0x7fab75f9e5d0, 
    obj=obj@entry=0x7fab75375b50, args=args@entry=0x55ede522b338 <_PyRuntime+107992>, kwargs=kwargs@entry=0x7fab707020f0)
    at Objects/call.c:504
#42 0x000055ede4d86732 in call_method (self=self@entry=0x7fab75375b50, attr=<optimized out>, 
    args=args@entry=0x55ede522b338 <_PyRuntime+107992>, kwds=kwds@entry=0x7fab707020f0) at Objects/typeobject.c:3060
#43 0x000055ede4d8682c in slot_tp_call (self=self@entry=0x7fab75375b50, args=args@entry=0x55ede522b338 <_PyRuntime+107992>, 
    kwds=kwds@entry=0x7fab707020f0) at Objects/typeobject.c:10562
#44 0x000055ede4ceb139 in _PyObject_Call (tstate=0x55ede5262260 <_PyRuntime+333056>, callable=callable@entry=0x7fab75375b50, 
    args=args@entry=0x55ede522b338 <_PyRuntime+107992>, kwargs=kwargs@entry=0x7fab707020f0) at Objects/call.c:361
#45 0x000055ede4ceb20e in PyObject_Call (callable=callable@entry=0x7fab75375b50, args=args@entry=0x55ede522b338 <_PyRuntime+107992>, 
    kwargs=kwargs@entry=0x7fab707020f0) at Objects/call.c:373
#46 0x000055ede4e3816a in _PyEval_EvalFrameDefault (tstate=0x55ede5262260 <_PyRuntime+333056>, frame=0x7fab77376ed0, throwflag=0)
    at Python/generated_cases.c.h:2616
#47 0x000055ede4e537bc in _PyEval_EvalFrame (tstate=tstate@entry=0x55ede5262260 <_PyRuntime+333056>, 
    frame=frame@entry=0x7fab77376960, throwflag=throwflag@entry=0) at ./Include/internal/pycore_ceval.h:121
#48 0x000055ede4e5398d in _PyEval_Vector (tstate=0x55ede5262260 <_PyRuntime+333056>, func=0x7fab75f9e5d0, locals=locals@entry=0x0, 
    args=0x7fab70723c08, argcount=<optimized out>, kwnames=0x7fab706ee210) at Python/ceval.c:1989
#49 0x000055ede4ce91f1 in _PyFunction_Vectorcall (func=<optimized out>, stack=<optimized out>, nargsf=<optimized out>, 
    kwnames=<optimized out>) at Objects/call.c:413
#50 0x000055ede4ceacbd in _PyObject_VectorcallDictTstate (tstate=tstate@entry=0x55ede5262260 <_PyRuntime+333056>, 
    callable=callable@entry=0x7fab75f9e5d0, args=args@entry=0x7ffd80330c50, nargsf=<optimized out>, nargsf@entry=1, 
    kwargs=kwargs@entry=0x7fab70609910) at Objects/call.c:146
#51 0x000055ede4ceadaa in _PyObject_Call_Prepend (tstate=tstate@entry=0x55ede5262260 <_PyRuntime+333056>, callable=0x7fab75f9e5d0, 
    obj=obj@entry=0x7fab75376270, args=args@entry=0x55ede522b338 <_PyRuntime+107992>, kwargs=kwargs@entry=0x7fab70609910)
    at Objects/call.c:504
#52 0x000055ede4d86732 in call_method (self=0x7fab75376270, attr=<optimized out>, args=0x55ede522b338 <_PyRuntime+107992>, 
    kwds=0x7fab70609910) at Objects/typeobject.c:3060
#53 0x000055ede4d8682c in slot_tp_call (self=<optimized out>, args=<optimized out>, kwds=<optimized out>)
    at Objects/typeobject.c:10562
#54 0x000055ede4ce939b in _PyObject_MakeTpCall (tstate=tstate@entry=0x55ede5262260 <_PyRuntime+333056>, 
    callable=callable@entry=0x7fab75376270, args=args@entry=0x7ffd80330f98, nargs=<optimized out>, 
    keywords=keywords@entry=0x7fab75812270) at Objects/call.c:242
#55 0x000055ede4ce95ce in _PyObject_VectorcallTstate (tstate=0x55ede5262260 <_PyRuntime+333056>, 
    callable=callable@entry=0x7fab75376270, args=args@entry=0x7ffd80330f98, nargsf=<optimized out>, 
    kwnames=kwnames@entry=0x7fab75812270) at ./Include/internal/pycore_call.h:167
#56 0x000055ede4ce9624 in PyObject_Vectorcall (callable=callable@entry=0x7fab75376270, args=args@entry=0x7ffd80330f98, 
    nargsf=<optimized out>, kwnames=kwnames@entry=0x7fab75812270) at Objects/call.c:327
#57 0x000055ede4e3913d in _PyEval_EvalFrameDefault (tstate=0x55ede5262260 <_PyRuntime+333056>, frame=0x7fab773768b8, throwflag=0)
    at Python/generated_cases.c.h:2920
#58 0x000055ede4e537bc in _PyEval_EvalFrame (tstate=tstate@entry=0x55ede5262260 <_PyRuntime+333056>, 
    frame=frame@entry=0x7fab77376648, throwflag=throwflag@entry=0) at ./Include/internal/pycore_ceval.h:121
#59 0x000055ede4e5398d in _PyEval_Vector (tstate=0x55ede5262260 <_PyRuntime+333056>, func=0x7fab75f9e5d0, locals=locals@entry=0x0, 
    args=0x7fab70d6d218, argcount=<optimized out>, kwnames=0x7fab70711680) at Python/ceval.c:1989
#60 0x000055ede4ce91f1 in _PyFunction_Vectorcall (func=<optimized out>, stack=<optimized out>, nargsf=<optimized out>, 
    kwnames=<optimized out>) at Objects/call.c:413
#61 0x000055ede4ceacbd in _PyObject_VectorcallDictTstate (tstate=tstate@entry=0x55ede5262260 <_PyRuntime+333056>, 
    callable=callable@entry=0x7fab75f9e5d0, args=args@entry=0x7ffd80331200, nargsf=<optimized out>, nargsf@entry=1, 
    kwargs=kwargs@entry=0x7fab7052ec90) at Objects/call.c:146
#62 0x000055ede4ceadaa in _PyObject_Call_Prepend (tstate=tstate@entry=0x55ede5262260 <_PyRuntime+333056>, callable=0x7fab75f9e5d0, 
    obj=obj@entry=0x7fab75376630, args=args@entry=0x55ede522b338 <_PyRuntime+107992>, kwargs=kwargs@entry=0x7fab7052ec90)
    at Objects/call.c:504
#63 0x000055ede4d86732 in call_method (self=0x7fab75376630, attr=<optimized out>, args=0x55ede522b338 <_PyRuntime+107992>, 
    kwds=0x7fab7052ec90) at Objects/typeobject.c:3060
#64 0x000055ede4d8682c in slot_tp_call (self=<optimized out>, args=<optimized out>, kwds=<optimized out>)
    at Objects/typeobject.c:10562
#65 0x000055ede4ce939b in _PyObject_MakeTpCall (tstate=tstate@entry=0x55ede5262260 <_PyRuntime+333056>, 
    callable=callable@entry=0x7fab75376630, args=args@entry=0x7ffd80331548, nargs=<optimized out>, 
    keywords=keywords@entry=0x7fab757b2080) at Objects/call.c:242
#66 0x000055ede4ce95ce in _PyObject_VectorcallTstate (tstate=0x55ede5262260 <_PyRuntime+333056>, 
    callable=callable@entry=0x7fab75376630, args=args@entry=0x7ffd80331548, nargsf=<optimized out>, 
    kwnames=kwnames@entry=0x7fab757b2080) at ./Include/internal/pycore_call.h:167
#67 0x000055ede4ce9624 in PyObject_Vectorcall (callable=callable@entry=0x7fab75376630, args=args@entry=0x7ffd80331548, 
    nargsf=<optimized out>, kwnames=kwnames@entry=0x7fab757b2080) at Objects/call.c:327
#68 0x000055ede4e3913d in _PyEval_EvalFrameDefault (tstate=0x55ede5262260 <_PyRuntime+333056>, frame=0x7fab773765c8, throwflag=0)
#62 0x000055ede4ceadaa in _PyObject_Call_Prepend (tstate=tstate@entry=0x55ede5262260 <_PyRuntime+333056>, callable=0x7fab75f9e5d0, 
    obj=obj@entry=0x7fab75376630, args=args@entry=0x55ede522b338 <_PyRuntime+107992>, kwargs=kwargs@entry=0x7fab7052ec90)
    at Objects/call.c:504
#63 0x000055ede4d86732 in call_method (self=0x7fab75376630, attr=<optimized out>, args=0x55ede522b338 <_PyRuntime+107992>, 
    kwds=0x7fab7052ec90) at Objects/typeobject.c:3060
#64 0x000055ede4d8682c in slot_tp_call (self=<optimized out>, args=<optimized out>, kwds=<optimized out>)
    at Objects/typeobject.c:10562
#65 0x000055ede4ce939b in _PyObject_MakeTpCall (tstate=tstate@entry=0x55ede5262260 <_PyRuntime+333056>, 
    callable=callable@entry=0x7fab75376630, args=args@entry=0x7ffd80331548, nargs=<optimized out>, 
    keywords=keywords@entry=0x7fab757b2080) at Objects/call.c:242
#66 0x000055ede4ce95ce in _PyObject_VectorcallTstate (tstate=0x55ede5262260 <_PyRuntime+333056>, 
    callable=callable@entry=0x7fab75376630, args=args@entry=0x7ffd80331548, nargsf=<optimized out>, 
    kwnames=kwnames@entry=0x7fab757b2080) at ./Include/internal/pycore_call.h:167
#67 0x000055ede4ce9624 in PyObject_Vectorcall (callable=callable@entry=0x7fab75376630, args=args@entry=0x7ffd80331548, 
    nargsf=<optimized out>, kwnames=kwnames@entry=0x7fab757b2080) at Objects/call.c:327
#68 0x000055ede4e3913d in _PyEval_EvalFrameDefault (tstate=0x55ede5262260 <_PyRuntime+333056>, frame=0x7fab773765c8, throwflag=0)
--Type <RET> for more, q to quit, c to continue without paging--
    at Python/generated_cases.c.h:2920
#69 0x000055ede4e537bc in _PyEval_EvalFrame (tstate=tstate@entry=0x55ede5262260 <_PyRuntime+333056>, 
    frame=frame@entry=0x7fab77376210, throwflag=throwflag@entry=0) at ./Include/internal/pycore_ceval.h:121
#70 0x000055ede4e5398d in _PyEval_Vector (tstate=0x55ede5262260 <_PyRuntime+333056>, func=0x7fab75f9e5d0, locals=locals@entry=0x0, 
    args=0x7fab756e0be8, argcount=<optimized out>, kwnames=0x7fab73f739d0) at Python/ceval.c:1989
#71 0x000055ede4ce91f1 in _PyFunction_Vectorcall (func=<optimized out>, stack=<optimized out>, nargsf=<optimized out>, 
    kwnames=<optimized out>) at Objects/call.c:413
#72 0x000055ede4ceacbd in _PyObject_VectorcallDictTstate (tstate=tstate@entry=0x55ede5262260 <_PyRuntime+333056>, 
    callable=callable@entry=0x7fab75f9e5d0, args=args@entry=0x7ffd803317b0, nargsf=<optimized out>, nargsf@entry=1, 
    kwargs=kwargs@entry=0x7fab7052c3b0) at Objects/call.c:146
#73 0x000055ede4ceadaa in _PyObject_Call_Prepend (tstate=tstate@entry=0x55ede5262260 <_PyRuntime+333056>, callable=0x7fab75f9e5d0, 
    obj=obj@entry=0x7fab7572d970, args=args@entry=0x55ede522b338 <_PyRuntime+107992>, kwargs=kwargs@entry=0x7fab7052c3b0)
    at Objects/call.c:504
#74 0x000055ede4d86732 in call_method (self=0x7fab7572d970, attr=<optimized out>, args=0x55ede522b338 <_PyRuntime+107992>, 
    kwds=0x7fab7052c3b0) at Objects/typeobject.c:3060
#75 0x000055ede4d8682c in slot_tp_call (self=<optimized out>, args=<optimized out>, kwds=<optimized out>)
    at Objects/typeobject.c:10562
#76 0x000055ede4ce939b in _PyObject_MakeTpCall (tstate=tstate@entry=0x55ede5262260 <_PyRuntime+333056>, 
    callable=callable@entry=0x7fab7572d970, args=args@entry=0x7ffd80331af8, nargs=<optimized out>, 
    keywords=keywords@entry=0x7fab75872a80) at Objects/call.c:242
#77 0x000055ede4ce95ce in _PyObject_VectorcallTstate (tstate=0x55ede5262260 <_PyRuntime+333056>, 
    callable=callable@entry=0x7fab7572d970, args=args@entry=0x7ffd80331af8, nargsf=<optimized out>, 
    kwnames=kwnames@entry=0x7fab75872a80) at ./Include/internal/pycore_call.h:167
#78 0x000055ede4ce9624 in PyObject_Vectorcall (callable=callable@entry=0x7fab7572d970, args=args@entry=0x7ffd80331af8, 
    nargsf=<optimized out>, kwnames=kwnames@entry=0x7fab75872a80) at Objects/call.c:327
#79 0x000055ede4e3913d in _PyEval_EvalFrameDefault (tstate=0x55ede5262260 <_PyRuntime+333056>, frame=0x7fab77376120, throwflag=0)
    at Python/generated_cases.c.h:2920
#80 0x000055ede4e537bc in _PyEval_EvalFrame (tstate=tstate@entry=0x55ede5262260 <_PyRuntime+333056>, 
    frame=frame@entry=0x7fab77376020, throwflag=throwflag@entry=0) at ./Include/internal/pycore_ceval.h:121
#81 0x000055ede4e5398d in _PyEval_Vector (tstate=tstate@entry=0x55ede5262260 <_PyRuntime+333056>, func=func@entry=0x7fab7636a990, 
    locals=locals@entry=0x7fab76363830, args=args@entry=0x0, argcount=argcount@entry=0, kwnames=kwnames@entry=0x0)
    at Python/ceval.c:1989
#82 0x000055ede4e53a89 in PyEval_EvalCode (co=co@entry=0x55ee0ca3f050, globals=globals@entry=0x7fab76363830, 
    locals=locals@entry=0x7fab76363830) at Python/ceval.c:873
#83 0x000055ede4ed0e4e in run_eval_code_obj (tstate=tstate@entry=0x55ede5262260 <_PyRuntime+333056>, co=co@entry=0x55ee0ca3f050, 
    globals=globals@entry=0x7fab76363830, locals=locals@entry=0x7fab76363830) at Python/pythonrun.c:1365
#84 0x000055ede4ed0feb in run_mod (mod=mod@entry=0x55ee0caa7bd8, filename=filename@entry=0x7fab763cf880, 
    globals=globals@entry=0x7fab76363830, locals=locals@entry=0x7fab76363830, flags=flags@entry=0x7ffd80331ef8, 
    arena=arena@entry=0x7fab763f0340, interactive_src=0x0, generate_new_source=0) at Python/pythonrun.c:1459
#85 0x000055ede4ed187a in pyrun_file (fp=fp@entry=0x55ee0c96d510, filename=filename@entry=0x7fab763cf880, start=start@entry=257, 
    globals=globals@entry=0x7fab76363830, locals=locals@entry=0x7fab76363830, closeit=closeit@entry=1, flags=0x7ffd80331ef8)
    at Python/pythonrun.c:1293
#86 0x000055ede4ed3107 in _PyRun_SimpleFileObject (fp=fp@entry=0x55ee0c96d510, filename=filename@entry=0x7fab763cf880, 
    closeit=closeit@entry=1, flags=flags@entry=0x7ffd80331ef8) at Python/pythonrun.c:521
#87 0x000055ede4ed330d in _PyRun_AnyFileObject (fp=fp@entry=0x55ee0c96d510, filename=filename@entry=0x7fab763cf880, 
    closeit=closeit@entry=1, flags=flags@entry=0x7ffd80331ef8) at Python/pythonrun.c:81
#88 0x000055ede4efdf52 in pymain_run_file_obj (program_name=program_name@entry=0x7fab763cfa60, 
    filename=filename@entry=0x7fab763cf880, skip_source_first_line=0) at Modules/main.c:410
#89 0x000055ede4efe078 in pymain_run_file (config=config@entry=0x55ede522d2f0 <_PyRuntime+116112>) at Modules/main.c:429
#90 0x000055ede4efebc0 in pymain_run_python (exitcode=exitcode@entry=0x7ffd80332074) at Modules/main.c:691
#91 0x000055ede4efee78 in Py_RunMain () at Modules/main.c:772
#92 0x000055ede4efeeef in pymain_main (args=args@entry=0x7ffd803320d0) at Modules/main.c:802
#93 0x000055ede4efefbd in Py_BytesMain (argc=<optimized out>, argv=<optimized out>) at Modules/main.c:826
#94 0x000055ede4c4f1a6 in main (argc=<optimized out>, argv=<optimized out>) at ./Programs/python.c:15

Perhaps this will be useful:

(gdb) up 9
#9  0x000055ede4d1507e in func_set_code (self=0x7fab70622150, value=0x7fab705dece0, _unused_ignored=<optimized out>)
    at Objects/funcobject.c:681
681	                                        PyTuple_GET_SIZE(op->func_closure));
(gdb) p op->func_closure
$4 = (PyObject *) 0x55ede51e57c0 <_Py_NoneStruct>

CPython versions tested on:

3.11, 3.13, CPython main branch

Operating systems tested on:

Linux

Output from running 'python -VV' on the command line:

Python 3.15.0a0 (heads/main:31d3836f260, Aug 30 2025, 18:24:26) [GCC 15.2.0]

[mgorny]

CC @smacke, @krassowski in case you could help.

[krassowski]

There is some backstory in ipython/ipython#14958 i.e. the patch was aimed at fixing another crash.

[ZeroIntensity]

Looking at the IPython patch, I see this:

cls.try_patch_readonly_attr(
    to_patch_to,
    tuple(new_closure) or None,
    "__closure__",
    new_is_value=True,
    offset=offset,
)

Is that manually injecting a None object reference into __closure__? If so, that's not valid -- func_closure expects NULL or a tuple, not None.

[smacke]

Looks like this is my bug. The context is that in ipython, @jaysarva and I have been working on some autoreload improvements (and Mike has found himself in the unenviable position of reviewing a lot of that code; really appreciate all your effort Mike), and one of the improvements is to patch function closures so that changes to decorated functions get picked up properly.

Is that manually injecting a None object reference into closure? If so, that's not valid -- func_closure expects NULL or a tuple, not None.

That's probably what it is. I'll try to get a fix merged into ipython shortly.

[smacke]

Actually I'm not so sure now since the same issue should have been present before ipython/ipython@f6fd3f5.

Anyway, I'll take a closer look later this weekend; feel free to assign to me.

[ZeroIntensity]

I think it's probably not a bug in CPython. I've been staring at all the ways to assign to func_closure, and they're all guarded by PyTuple_Check[Exact]. It does seem possible to do it through abuse of PyEval_EvalCodeEx, but that would just be written off as user error.

[mgorny]

Thank you for looking into it, and I'm sorry if I reported it to the wrong place. My assumption was that you shouldn't be able to get CPython to crash like that via pure Python code alone, but I guess IPython goes beyond what constitutes "public API" here.

[smacke]

I think it's probably not a bug in CPython.

It's definitely caused by one of my / Jay's ipython contributions :)

Thank you for looking into it, and I'm sorry if I reported it to the wrong place. My assumption was that you shouldn't be able to get CPython to crash like that via pure Python code alone, but I guess IPython goes beyond what constitutes "public API" here.

We're doing a lot of unsafe patching with ctypes in the new autoreload code and it's fair to think it could be CPython for someone unaware of that. But it's almost certainly a bug on ipython side (caused by me).

[smacke]

For a bit more context: I'd estimate the impact of this issue to be low severity since it will only potentially affect ipython users who opt into autoreload (which traditionally has not been super reliable anyway, though we are trying to improve that). Cool to see upstream tests in CPython catch what's likely a real issue!