[issue26287] Core dump in f-string with formatting errors due to refcount bug

[Eric V. Smith]

Eric V. Smith added the comment:

The problem has to do with refcounting when an error occurs. Adjusting the 
title accordingly.

I'm not sure yet if the problem is in PyObject_Format(), or in handling errors 
in the eval loop when processing FORMAT_VALUE opcodes. I'm slowly tracking it 
down. It doesn't happen with format(), so I suspect it's in FORMAT_VALUE.

Here's an example showing the error with a large, non-cached int. You need to 
call it twice to trigger the refcount problem.

>>> f'{1000:j}'
Traceback (most recent call last):
  File "", line 1, in 
ValueError: Unknown format code 'j' for object of type 'int'
>>> f'{1000:j}'
Fatal Python error: Objects/tupleobject.c:233 object at 0x7f904006b360 has 
negative ref count -2604246222170760230

Current thread 0x7f9041278700 (most recent call first):
Aborted (core dumped)

--
title: Core dump in f-string with lambda and format specification -> Core dump 
in f-string with formatting errors due to refcount bug

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue26287] Core dump in f-string with formatting errors due to refcount bug

[Eric V. Smith]

Eric V. Smith added the comment:

Yes, that's my thinking as well. I'll have a patch soon-ish.

--

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue26287] Core dump in f-string with formatting errors due to refcount bug

[Martin Panter]

Martin Panter added the comment:

I have zero experience with with ceval.c but I have a theory after looking over 
revision 1ddeb2e175df. I suspect “value” is a borrowed reference from TOP(), 
but at  
and  you 
are calling DECREF on it without calling SET_TOP() if there is an error.

I suspected FORMAT_VALUE, because the crash doesn’t happen when you call 
format() directly.

--

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com