Failed assertion in `itertoolsmodule.c: itertools_count_impl` for `count(sys.maxsize)`

[devdanzin]

Crash report

What happened?

Calling itertools.count(sys.maxsize) aborts with the following message:

python -c "from sys import maxsize; from itertools import count; count(maxsize)"
python: ./Modules/itertoolsmodule.c:3325: itertools_count_impl: Assertion `(cnt != PY_SSIZE_T_MAX && long_cnt == NULL && fast_mode) || (cnt == PY_SSIZE_T_MAX && long_cnt != NULL && !fast_mode)' failed.
Aborted (core dumped)

Found using fusil by @vstinner.

CPython versions tested on:

CPython main branch

Operating systems tested on:

Linux, Windows

Output from running 'python -VV' on the command line:

Python 3.14.0a1+ (heads/main:4ea214ea982, Nov 6 2024, 00:52:15) [MSC v.1941 64 bit (AMD64)]

Linked PRs

• gh-126595: fix a crash when calling itertools.count(sys.maxsize) #126617
• [3.13] gh-126595: fix a crash when calling itertools.count(sys.maxsize) (GH-126617) #126739
• [3.12] gh-126595: fix a crash when calling itertools.count(sys.maxsize) (GH-126617) #126740

[picnixz]

cc @rhettinger

[skirpichev]

Note, that on non-debug builds there is no crash:

Python 3.13.0rc1+ (heads/3.13:bd29ce8509, Aug 29 2024, 15:30:15) [GCC 12.2.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> from sys import maxsize
>>> from itertools import count
>>> c = count(maxsize)
>>> next(c)
9223372036854775807
>>> next(c)
9223372036854775808
>>> next(c)
9223372036854775809

So, I don't think this should be backported.

On another hand, we have an issue with repl. Continuing the above example:

>>> count(maxsize)
count(<NULL>)

This seems to be fixed by pr.

[picnixz]

Note, that on non-debug builds there is no crash:

I think we should still backport fixes for non-debug builds because people might want to use debug builds for themselves.

[devdanzin]

>>> count(maxsize)
count(<NULL>)

Nice find! If we take it further, another assertion fails:

Python 3.14.0a1+ experimental free-threading build (heads/main:6293d00, Nov  9 2024, 07:56:06) [GCC 13.2.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> from sys import maxsize; from itertools import count
>>> c = count(maxsize - 2)
>>> for x in c:
...     print(c, x)
... 
count(9223372036854775806) 9223372036854775805
python: Objects/unicodeobject.c:3046: unicode_fromformat_arg: Assertion `obj' failed.
Aborted (core dumped)

[picnixz]

Ah the PR does not fix this second assertion on unicode objects. I'll work a bit more. Thanks for finding it.

[picnixz]

Update: I found the issue. When the counter reaches PY_SSIZE_T_MAX, it does not set its long_cnt field. In particular, if you call repr() just after, the field will still be NULL (it's set by next only). I'm preparing the fix.