SIGSEGV in Python 3.14.0rc2+ with List Comprehension and Lambda Expression

[15r10nk]

Crash report

What happened?

A segmentation fault (SIGSEGV) occurs when executing a list comprehension containing a lambda expression in Python 3.14.0rc2+. The crash is reproducible with a minimal code snippet and does not occur in earlier versions (e.g., Python 3.13).

Description:
The following code causes a segmentation fault in Python 3.14.0rc2+:

def report_error():
    pass
try:
    [0 for name_2 in unique_name_0 if (lambda: name_2)]
except:
    pass
unique_name_1: 0

> ../cpython/install/bin/python3 -X faulthandler  crash.py 
Fatal Python error: Segmentation fault

Current thread 0x00007f056f764740 [python3] (most recent call first):
  File "/home/frank/projects/pysource-playground/crash.py", line 7 in <module>

Current thread's C stack trace (most recent call first):
  Binary file "../cpython/install/bin/python3", at _Py_DumpStack+0x2e [0x55dc00a44c9e]
  Binary file "../cpython/install/bin/python3", at +0x2fd99a [0x55dc00a5999a]
  Binary file "/lib/x86_64-linux-gnu/libc.so.6", at +0x3c050 [0x7f056f7a3050]
  Binary file "../cpython/install/bin/python3", at +0x18624b [0x55dc008e224b]
  Binary file "../cpython/install/bin/python3", at _PyEval_EvalFrameDefault+0x16b8 [0x55dc007e6368]
  Binary file "../cpython/install/bin/python3", at PyEval_EvalCode+0x2c6 [0x55dc009b5016]
  Binary file "../cpython/install/bin/python3", at +0x2cbaee [0x55dc00a27aee]
  Binary file "../cpython/install/bin/python3", at +0x2cd9a4 [0x55dc00a299a4]
  Binary file "../cpython/install/bin/python3", at +0x2ce03c [0x55dc00a2a03c]
  Binary file "../cpython/install/bin/python3", at +0x2fbb89 [0x55dc00a57b89]
  Binary file "../cpython/install/bin/python3", at Py_BytesMain+0x64 [0x55dc00a58234]
  Binary file "/lib/x86_64-linux-gnu/libc.so.6", at +0x2724a [0x7f056f78e24a]
  Binary file "/lib/x86_64-linux-gnu/libc.so.6", at __libc_start_main+0x85 [0x7f056f78e305]
  Binary file "../cpython/install/bin/python3", at _start+0x21 [0x55dc007f6481]
fish: Job 1, '../cpython/install/bin/python3 …' terminated by signal SIGSEGV (Adressbereichsfehler)

I build cpython with:

./configure --prefix=$PWD/install --disable-ipv6
make -j install

The script did not crash but also not terminate when I used --with-pydebug.

CPython versions tested on:

3.14

Operating systems tested on:

Linux

Output from running 'python -VV' on the command line:

No response

Linked PRs

• gh-138349: Fix crash when combining module-level annotation and listcomp #138363
• [3.14] gh-138349: Fix crash when combining module-level annotation and listcomp (#138363) #138749

[StanFromIreland]

I cannot reproduce on 3.15, I will look to see if this has been fixed:

>>> unique_name_0 = [1, 2,3,3,4,5]
>>> def report_error():
...     pass
... try:
...     [0 for name_2 in unique_name_0 if (lambda: name_2)]
... except:
...     pass
...     
[0, 0, 0, 0, 0, 0]

[JelleZijlstra]

It reproduces on 3.15 if you put the whole repro in a file; presumably the annotation at the end is important. I'm bisecting now; the issue description says "3.14.0rc2+" but it goes back at least a little further.

[Fidget-Spinner]

It reproduces for me on main, 3.14rc2 and 3.14rc2+ when I put in a file as well.

[JelleZijlstra]

The bad commit is 922049b (#131550), perhaps unsurprisingly since the module-level annotation is important to reproduce. I will try to fix.

[15r10nk]

I found two similar examples, maybe this helps finding the problem:

class Generic:
    pass
try:
    [0 for name_2 in unique_name_0 if (0 for unique_name_1 in unique_name_2 for unique_name_3 in name_2)]
except:
    pass
unique_name_4: 0

class Generic:
    pass
unique_name_0: 0
[0 for name_2 in 0 for unique_name_1 in unique_name_2 if (lambda: name_2)]