[New-bugs-announce] [issue25498] Python 3.4.3 core dump with simple sample code

[Jake Montgomery]

New submission from Jake Montgomery:

We are seeing a consistent "invalid memory access" crash in Python3.4.3. 

*Test setup* 
This is occurring on Ubuntu 14.04.1 LTS. It is occurring on multiple unrelated installs, but has not been tested with any other operating system. It occurs using the "Python 3.4.3 (default, Oct 14 2015, 20:28:29)" that is installed using apt-get. It does *not* appear to occur using Python 3.4.0. Other versions of python were not tested. 

*Reproducing*
I was able to reduce the code needed to a pretty minimal python program, which is attached. Running this as "pyton3 ./pythoncrash.py" will trigger the crash, and a core dump if enabled. 

If run under python3.4.3-dbg The error is:

    python3.4-dbg: ../Objects/memoryobject.c:115: mbuf_dealloc: Assertion `self->exports == 0' failed.

In some versions of this code, it had to be run twice, since it would only occur when the pyc files were already created. The attached version does not appear to have this behavior, but run it twice, at least, if you do not see the crash. 

The code supplied is "minimal", in that removing any line will cause the crash not to occur.

*More clues*
I suspect that the key is the multiprocessing.Value object, and its destruction. The other "import" statements may just be happenstance needed to create the correct memory conditions for the crash. I was able to start "stubbing out" the actual code in those imported packages, and the crash continued as long as the number of functions, classes, and class dependencies were maintained. But that became too tedious. In earlier versions of the test code, adding or removing significant numbers of function or classes could make the crash not manifest. 

*Stack trace*
Running under python3.4.3-dbg, gdb gives the following stack trace:

#0  0x00007fc0425b4cc9 in __GI_raise (sig=sig at entry=6)
    at ../nptl/sysdeps/unix/sysv/linux/raise.c:56
#1  0x00007fc0425b80d8 in __GI_abort () at abort.c:89
#2  0x00007fc0425adb86 in __assert_fail_base (
    fmt=0x7fc0426fe830 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n",
    assertion=assertion at entry=0x707199 "self->exports == 0",
    file=file at entry=0x70715a "../Objects/memoryobject.c", line=line at entry=115,
    function=function at entry=0x708923 <__PRETTY_FUNCTION__.10355> "mbuf_dealloc") at assert.c:92
#3  0x00007fc0425adc32 in __GI___assert_fail (assertion=0x707199 "self->exports == 0",
    file=0x70715a "../Objects/memoryobject.c", line=115,
    function=0x708923 <__PRETTY_FUNCTION__.10355> "mbuf_dealloc") at assert.c:101
#4  0x00000000004beb92 in mbuf_dealloc (self=0x7fc042068058) at ../Objects/memoryobject.c:115
#5  0x00000000004cd67b in _Py_Dealloc (op=<managedbuffer at remote 0x7fc042068058>)
    at ../Objects/object.c:1749
#6  0x00000000004c0ec6 in memory_clear (self=0x7fc042026bf8) at ../Objects/memoryobject.c:1079
#7  0x00000000004409c3 in delete_garbage (collectable=0x7fff21065180,
    old=0x9a4f40 <generations+64>) at ../Modules/gcmodule.c:866
#8  0x0000000000440f56 in collect (generation=2, n_collected=0x7fff210651e8,
    n_uncollectable=0x7fff210651f0, nofail=0) at ../Modules/gcmodule.c:1032
#9  0x000000000044144e in collect_with_callback (generation=2) at ../Modules/gcmodule.c:1140
#10 0x00000000004421f2 in PyGC_Collect () at ../Modules/gcmodule.c:1616
#11 0x00000000004226a0 in Py_Finalize () at ../Python/pythonrun.c:607
#12 0x0000000000428f38 in Py_Exit (sts=0) at ../Python/pythonrun.c:2713
#13 0x0000000000426077 in handle_system_exit () at ../Python/pythonrun.c:1812
#14 0x00000000004260a2 in PyErr_PrintEx (set_sys_last_vars=1) at ../Python/pythonrun.c:1822
#15 0x0000000000425cef in PyErr_Print () at ../Python/pythonrun.c:1718
#16 0x00000000004255c4 in PyRun_SimpleFileExFlags (fp=0x29824c0,
    filename=0x7fc042442b68 "./pythoncrash.py", closeit=1, flags=0x7fff21065520)
    at ../Python/pythonrun.c:1611
#17 0x0000000000424418 in PyRun_AnyFileExFlags (fp=0x29824c0,
    filename=0x7fc042442b68 "./pythoncrash.py", closeit=1, flags=0x7fff21065520)
    at ../Python/pythonrun.c:1292
#18 0x000000000043e9fb in run_file (fp=0x29824c0, filename=0x28b62f0 L"./pythoncrash.py",
    p_cf=0x7fff21065520) at ../Modules/main.c:319
#19 0x000000000043f781 in Py_Main (argc=2, argv=0x28b5020) at ../Modules/main.c:751
#20 0x000000000041e6d6 in main (argc=2, argv=0x7fff21065798) at ../Modules/python.c:69

The full core dump is available, if it would help.

----------
components: Interpreter Core
files: pythoncrash.py
messages: 253613
nosy: JakeMont
priority: normal
severity: normal
status: open
title: Python 3.4.3 core dump with simple sample code
versions: Python 3.4
Added file: http://bugs.python.org/file40876/pythoncrash.py

_______________________________________
Python tracker <report at bugs.python.org>
<http://bugs.python.org/issue25498>
_______________________________________