Crash on deallocator of type 'time.struct_time' during finalizing for free-threaded Python

[XuehaiPan]

Crash report

What happened?

A simple standalone file:

# test1.py

import time

obj = time.struct_time(range(1, 10))

$ pyenv install 3.14t-dev --debug
$ pyenv local 3.14t-dev-debug
$ python3 -VV
Python 3.14.0a0 experimental free-threading build (heads/main:bd3d31f, Aug  1 2024, 01:22:33) [Clang 15.0.0 (clang-1500.3.9.4)]
$ python3 test1.py
Fatal Python error: _Py_Dealloc: Deallocator of type 'time.struct_time' raised an exception
Python runtime state: finalizing (tstate=0x00000001018ca548)
Exception ignored in the internal traceback machinery:
ImportError: sys.meta_path is None, Python is likely shutting down
TypeError: Missed attribute 'n_fields' of type time.struct_time

Current thread 0x00000001fff70c00 (most recent call first):
  Garbage-collecting
  <no Python frame>
[1]    89377 abort      python3 test1.py
$ python3 -c 'import test1'
Fatal Python error: _Py_Dealloc: Deallocator of type 'time.struct_time' raised an exception
Python runtime state: finalizing (tstate=0x00000001040a2548)
Exception ignored in the internal traceback machinery:
ImportError: sys.meta_path is None, Python is likely shutting down
TypeError: Missed attribute 'n_fields' of type time.struct_time

Current thread 0x00000001fff70c00 (most recent call first):
  Garbage-collecting
  <no Python frame>
[1]    89737 abort      python3 -c 'import test1'

If I remove the assignment for obj, the program can exit successfully.

# test2.py

import time

time.struct_time(range(1, 10))

$ python3 test2.py           # no output
$ python3 -c 'import test2'  # no output

CPython versions tested on:

CPython main branch, CPython 3.13t, CPython 3.14t

Operating systems tested on:

Linux, macOS

Output from running 'python -VV' on the command line:

Python 3.14.0a0 experimental free-threading build (heads/main:bd3d31f, Aug 1 2024, 01:22:33) [Clang 15.0.0 (clang-1500.3.9.4)]

Linked PRs

• gh-122527: Fix a crash on deallocation of PyStructSequence #122577
• [3.13] gh-122527: Fix a crash on deallocation of PyStructSequence (GH-122577) #122625
• [3.12] gh-122527: Fix a crash on deallocation of PyStructSequence (GH-122577) #122626

[Eclips4]

Thanks for the report!
Confirmed on current main.

[colesbury]

Bisected to:

• 4ad8f09 (gh-117376: Partial implementation of deferred reference counting #117696)

(oops)

[colesbury]

The problem is in structseq_dealloc, the REAL_SIZE() call fails:

cpython/Objects/structseq.c

Lines 116 to 131 in 8844197

	static void
	structseq_dealloc(PyStructSequence *obj)
	{
	Py_ssize_t i, size;
	PyObject_GC_UnTrack(obj);
	PyTypeObject *tp = Py_TYPE(obj);
	size = REAL_SIZE(obj);
	for (i = 0; i < size; ++i) {
	Py_XDECREF(obj->ob_item[i]);
	}
	PyObject_GC_Del(obj);
	if (_PyType_HasFeature(tp, Py_TPFLAGS_HEAPTYPE)) {
	Py_DECREF(tp);
	}
	}

REAL_SIZE is a macro that expands to:

PyDict_GetItemWithError(_PyType_GetDict(Py_TYPE(self)), _Py_ID(n_fields))

The GC is clearing the type's dictionary (i.e., _PyType_GetDict) before the structseq instances is freed, so the REAL_SIZE call fails. We're also not handling that failure, which leads to a crash.

The default build works because the GC happens to free the structseq instance first before calling tp_clear() on the type's dictionary, but I don't think the GC guarantees any ordering of tp_clear() calls.

[colesbury]

You can trigger a similar crash in the default build with some weirder code:

import time
obj = time.struct_time(range(1, 10))
type(obj).obj = obj