test_capi: test_get_set_optimizer() crash

[vstinner]

AMD64 Arch Linux TraceRefs 3.x: https://buildbot.python.org/all/#/builders/484/builds/3721

$ ./python -m test -m test_get_set_optimizer -v test_capi 
== CPython 3.13.0a0 (heads/main:889851ecc3, Jul 23 2023, 01:02:30) [GCC 13.1.1 20230614 (Red Hat 13.1.1-4)]
== Linux-6.3.12-200.fc38.x86_64-x86_64-with-glibc2.37 little-endian
== Python build: debug TraceRefs
== cwd: /home/vstinner/python/main/build/test_python_116212æ
== CPU count: 12
== encodings: locale=UTF-8, FS=utf-8
0:00:00 load avg: 0.70 Run tests sequentially
0:00:00 load avg: 0.70 [1/1] test_capi
test_get_set_optimizer (test.test_capi.test_misc.TestOptimizerAPI.test_get_set_optimizer) ... Fatal Python error: Segmentation fault

Current thread 0x00007f52695e2740 (most recent call first):
  File "/home/vstinner/python/main/Lib/unittest/case.py", line 589 in _callTestMethod
  (...)

gdb traceback:

test_get_set_optimizer (test.test_capi.test_misc.TestOptimizerAPI.test_get_set_optimizer) ... 
Program received signal SIGSEGV, Segmentation fault.
0x0000000000000000 in ?? ()
Missing separate debuginfos, use: dnf debuginfo-install bzip2-libs-1.0.8-13.fc38.x86_64 glibc-2.37-4.fc38.x86_64 libffi-3.4.4-2.fc38.x86_64 openssl-libs-3.0.9-1.fc38.x86_64 xz-libs-5.4.1-1.fc38.x86_64 zlib-1.2.13-3.fc38.x86_64
(gdb) up
#1  0x000000000055f2d0 in _Py_Dealloc (op=<Counter optimizer at remote 0x7fffe9da2480>) at Objects/object.c:2615
2615	    (*dealloc)(op);
(gdb) p dealloc
$1 = (destructor) 0x0
(gdb) p *op
$2 = {
  _ob_next = 0x0,
  _ob_prev = 0x0,
  {
    ob_refcnt = 0,
    ob_refcnt_split = {0, 0}
  },
  ob_type = 0xa23cc0 <CounterOptimizer_Type>
}

(gdb) where
#0  0x0000000000000000 in ?? ()
#1  0x000000000055f2d0 in _Py_Dealloc (op=<Counter optimizer at remote 0x7fffe9da2480>) at Objects/object.c:2615
#2  0x00000000006940af in Py_DECREF (filename=0x854880 "./Include/object.h", lineno=796, op=<Counter optimizer at remote 0x7fffe9da2480>) at ./Include/object.h:685
#3  0x00000000006940dd in Py_XDECREF (op=<Counter optimizer at remote 0x7fffe9da2480>) at ./Include/object.h:796
#4  0x0000000000694bbc in _PyFrame_ClearExceptCode (frame=0x7ffff7fba2f8) at Python/frame.c:140
#5  0x000000000064fd0a in clear_thread_frame (tstate=0xb91930 <_PyRuntime+500272>, frame=0x7ffff7fba2f8) at Python/ceval.c:1447
#6  0x000000000064fe85 in _PyEvalFrameClearAndPop (tstate=0xb91930 <_PyRuntime+500272>, frame=0x7ffff7fba2f8) at Python/ceval.c:1473
#7  0x00000000006384e7 in _PyEval_EvalFrameDefault (tstate=0xb91930 <_PyRuntime+500272>, frame=0x7ffff7fba278, throwflag=0) at Python/generated_cases.c.h:952
#8  0x0000000000631359 in _PyEval_EvalFrame (tstate=0xb91930 <_PyRuntime+500272>, frame=0x7ffff7fba1b8, throwflag=0) at ./Include/internal/pycore_ceval.h:88
#9  0x000000000065036c in _PyEval_Vector (tstate=0xb91930 <_PyRuntime+500272>, func=0x7fffea08b1e0, locals=0x0, args=0x7ffffffdd770, argcount=2, kwnames=0x0) at Python/ceval.c:1582
#10 0x00000000004ee0b9 in _PyFunction_Vectorcall (func=<function at remote 0x7fffea08b1e0>, stack=0x7ffffffdd770, nargsf=2, kwnames=0x0) at Objects/call.c:413
#11 0x00000000004f132d in _PyObject_VectorcallTstate (tstate=0xb91930 <_PyRuntime+500272>, callable=<function at remote 0x7fffea08b1e0>, args=0x7ffffffdd770, nargsf=2, kwnames=0x0) at ./Include/internal/pycore_
...

Oh, last week, I also saw a test_get_set_optimizer() crash on FreeBSD: #106714 (comment)

[vstinner]

Python built with:

git clean -fdx
./configure --with-pydebug --with-trace-refs CFLAGS="-O0"
make -j14

[vstinner]

Oh, no need for Trace Refs to reproduce the error. I can also reproduce the crash with a regular Linux debug build

git clean -fdx
./configure --with-pydebug CFLAGS="-O0"
make -j14

Reproduce with:

./python -m test -m test_get_set_optimizer -v test_capi 

gdb traceback:

Program received signal SIGSEGV, Segmentation fault.
0x0000000000000000 in ?? ()
Missing separate debuginfos, use: dnf debuginfo-install bzip2-libs-1.0.8-13.fc38.x86_64 glibc-2.37-4.fc38.x86_64 libffi-3.4.4-2.fc38.x86_64 openssl-libs-3.0.9-1.fc38.x86_64 xz-libs-5.4.1-1.fc38.x86_64 zlib-1.2.13-3.fc38.x86_64
(gdb) up
#1  0x000000000055ec0b in _Py_Dealloc (op=<Counter optimizer at remote 0x7fffe9797d00>) at Objects/object.c:2615
2615	    (*dealloc)(op);
(gdb) p *op
$1 = {
  {
    ob_refcnt = 0,
    ob_refcnt_split = {0, 0}
  },
  ob_type = 0xa1b940 <CounterOptimizer_Type>
}
(gdb) p op->ob_type->tp_dealloc
$2 = (destructor) 0x0

It seems like CounterOptimizer_Type->tp_dealloc is NULL and so is not supposed to be called.

cc @brandtbucher @iritkatriel

[vstinner]

I didn't see the crash recently: https://buildbot.python.org/all/#/builders/484

So I close the issue.