[issue25395] SIGSEGV using json.tool: highly nested OrderedDict

Serhiy Storchaka added the comment: Thank you Martin for your review and for initial investigation. -- resolution: -> fixed stage: patch review -> resolved status: open -> closed ___ Python tracker ___

[issue25395] SIGSEGV using json.tool: highly nested OrderedDict

Roundup Robot added the comment: New changeset ce8c850a52d4 by Serhiy Storchaka in branch '3.5': Issue #25395: Fixed crash when highly nested OrderedDict structures were https://hg.python.org/cpython/rev/ce8c850a52d4 New changeset bd6bfa5fe203 by Serhiy Storchaka in branch 'default': Issue #2539

[issue25395] SIGSEGV using json.tool: highly nested OrderedDict

Changes by Serhiy Storchaka : -- assignee: -> serhiy.storchaka ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscribe:

[issue25395] SIGSEGV using json.tool: highly nested OrderedDict

Martin Panter added the comment: Left a comment about a minor English grammar problem. The existing comment Serhiy mentioned was added way back in 2003 for Issue 668433. It appears to use the same underlying technique, reverting the nesting level before calling the base class dealloc. One para

[issue25395] SIGSEGV using json.tool: highly nested OrderedDict

Serhiy Storchaka added the comment: There is a problem with odict-trashcan.v3.patch. PyDict_Type.tp_dealloc() can put the object to the freelist if it's type is dict. Since odict_dealloc() fakes object's type, it alows deallocated OrderedDict to be later used as dict. But the size of OrderedDi

[issue25395] SIGSEGV using json.tool: highly nested OrderedDict

Eric Snow added the comment: Thanks for solving this! odict-trashcan.v3.patch LGTM -- stage: patch review -> commit review ___ Python tracker ___ ___

[issue25395] SIGSEGV using json.tool: highly nested OrderedDict

Serhiy Storchaka added the comment: Using Py_CLEAR() fixes symptoms in this test, but the real issue is that deallocating code is executed twice for some objects (for every 25th OrderedDict). PyDict_Type.tp_dealloc() can deposit an object in the _PyTrash_delete_later list if trash_delete_nest

[issue25395] SIGSEGV using json.tool: highly nested OrderedDict

Martin Panter added the comment: Here is a new patch which uses Py_CLEAR() rather than Py_XDECREF(), which seems to cure the negative reference count problem. This change was only a guess based on looking at namespaceobject.c and the Py_CLEAR() documentation, so it would be good for someone el

[issue25395] SIGSEGV using json.tool: highly nested OrderedDict

Serhiy Storchaka added the comment: I think there is no need to run the test in a subprocess. You can trigger the crash by "del obj". from collections import OrderedDict obj = None for _ in range(1000): obj = OrderedDict([(None, obj)]) del obj support.gc_collect() Unfortunately this test

[issue25395] SIGSEGV using json.tool: highly nested OrderedDict

Martin Panter added the comment: Here is a patch that seems to fix the problem for me. Can someone who knows more about tp_dealloc() methods and the Py_TRASHCAN_SAFE stuff have a look? All I know is that the body of the trashcan stuff can be deferred until an outer nested body is finished, so

[issue25395] SIGSEGV using json.tool: highly nested OrderedDict

Martin Panter added the comment: The following simplified code produces the crash: from collections import OrderedDict obj = [] for _ in range(33): obj = OrderedDict(((None, obj),)) for _ in range(17): obj = [obj] print("Still alive, crash happens at interpreter finalization") This cras

[issue25395] SIGSEGV using json.tool

Serhiy Storchaka added the comment: Likely this issue is related to C implementation of OrderedDict. json.tool doesn't crash with --sort-keys and doesn't crash with Python implementation of OrderedDict. The patch for similar issue25406 doesn't fix this issue. -- nosy: +eric.snow, rhet

[issue25395] SIGSEGV using json.tool

Serhiy Storchaka added the comment: 3.6.0a0 (de982d8b7b15) #0 0x080e62a1 in _PyTrash_thread_destroy_chain () at Objects/object.c:2010 #1 0x080bf8b3 in frame_dealloc (f=f@entry=0x83f06e4) at Objects/frameobject.c:462 #2 0x080e3eef in _Py_Dealloc (op=op@entry=0x83f06e4) at Objects/object.c:178

[issue25395] SIGSEGV using json.tool

STINNER Victor added the comment: Can you post a GDB traceback? -- ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscrib

[issue25395] SIGSEGV using json.tool

Serhiy Storchaka added the comment: Doesn't crash on 3.4.3. Crashes on 3.5.0. The crash is reproduced with Python-only implementation of json, therefore it is not related to json. -- nosy: +haypo priority: normal -> high ___ Python tracker

[issue25395] SIGSEGV using json.tool

Changes by R. David Murray : -- nosy: +serhiy.storchaka stage: -> needs patch versions: +Python 3.6 ___ Python tracker ___ ___ Python

[issue25395] SIGSEGV using json.tool

New submission from Simonas Kazlauskas: cat attachment | python -m json.tool reliably makes python to SIGSEGV on Arch linux $ python --version Python 3.5.0 $ uname -a Linux kumabox 4.2.2-1-ARCH #1 SMP PREEMPT Tue Sep 29 22:21:33 CEST 2015 x86_64 GNU/Linux Does not fail on 2.7.10. --