[Python-Dev] A cute new way to get an infinite loop

[Armin Rigo]

Hi Bob,

On Fri, Sep 24, 2004 at 11:36:10PM -0400, Bob Ippolito wrote:
> >  >>> x = []
> >  >>> x.extend(-y for y in x)
> >  Segmentation fault
> 
> No algorithm that requires infinite memory will run for an infinite 
> amount of time on a finite computer.

The segfault is immediate.  And the example is different, as Ronald pointed
out: the list 'x' is empty!

Uh oh.  We have a real bug in listextend(): the list being extended is in a
semi-invalid state when it's calling tp_iternext() on the 2nd iterable.  This
might call back Python code, which can inspect the list.  The above example
does just that.  Crash.

"Semi-invalid" means that all invariants are respected but the final items in
the list are NULL.  Reading them crashes.  And I'm not even talking about the
nasty things you can do if you modify the list while it's being extended :-)

The safest solution would be to use a regular app1() to add each item as the
iterable produce them instead of optimizing this case.  I'm not sure we need
the high-flying optimization of listextend() in this case (this is the case
where the iterable we extend the list with is neither a list nor a tuple).  I
believe that the speed of app1() would be acceptable, given the fixed bug and
the overall decrease of code complexity (though that should be measured).


Armin