Skip to content

Crash in GenericAlias repr() with a self-mutating list #143823

Closed as not planned
Closed as not planned

Description

@JelleZijlstra

Crash report

What happened?

This snippet causes a segfault on current main:

import types
lst = []
class X:
    def __repr__(self):
        lst.clear()
        return "x"
        
lst += [X(), 1]
ga = types.GenericAlias(int, lst)
print(repr(ga))

This is because the ga_repr_items_list() function does not properly handle the case where the list is mutated while we're iterating over it.

Similar to #143635 but a distinct code path.

CPython versions tested on:

CPython main branch, 3.14

Operating systems tested on:

macOS

Output from running 'python -VV' on the command line:

Python 3.15.0a4+ (heads/main:1857a40807d, Jan 13 2026, 19:01:52) [Clang 15.0.0 (clang-1500.3.9.4)]

Activity

  1. JelleZijlstra commented on Jan 14, 2026

    @JelleZijlstra
    MemberAuthor

    Actually no, it's the same thing, though this repro case is simpler.

  2. a12k commented on Jan 14, 2026

    @a12k
    Contributor

    Potentially this is failing to protect a collection before calling from C to Python space. I haven't looked into the underlying code, but if you don't have a proposed solution in mind I'd be happy to play with it and submit a PR based on what I uncover.

  3. JelleZijlstra commented on Jan 14, 2026

    @JelleZijlstra
    MemberAuthor

    There's a related fix in progress in #143670, but I think it's insufficient. Feel free to propose a PR; make sure it fixes both the case here and the one in #143635.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    topic-typingtype-crashA hard crash of the interpreter, possibly with a core dump

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions