[issue46070] broken subinterpreters

[STINNER Victor]

STINNER Victor <vstinner at python.org> added the comment:

I can sometimes reproduce the crash on Windows with Python 3.9. Call stack (most recent to oldest frames):

* PyObject_GC_UnTrack() - crash on _PyGCHead_SET_NEXT(prev, next) because prev is dangling pointer (0x1fe64dd5250), Visual Studio is unable to read memory
* meth_dealloc() -- delete _sre_compile() method object
* (...)
* PyDict_SetItem() -- set "compile" to None
* _PyModule_ClearDict() -- clear the "_sre" module dict
* _PyModule_Clear()
* _PyImport_Clenaup()
* Py_EndInterpreter()
* (...)
* run_in_subinterp()
* (...)
* t_bootstrap()

The crash occurs in meth_dealloc(), when deallocating the _sre_compile() method object stored in _sre module dictionary as the attribute "compile".

The PyGC_Head.prev pointer is a dangling pointer.

On Python 3.9, the "re" module is not imported at startup, but it's imported indirectly by "import importlib.util" via "import typing". On Python 3.10, the re module is no longer imported by "import importlib.util".

The crash is random. Sometimes, I need 3 or 4 tries. Sometimes, it crash using -X dev. Sometimes, it crash immediately. When debugging in Visual Stuido, the crash seems easier to reproduce.

On Python 3.9, the _sre exetnsion uses the old API: PyModule_Create() with PyModuleDef.m_size = -1.

On Python 3.10, the _sre extension has been converted to multiphase init API: PyModuleDef_Init() with PyModuleDef.m_size = sizeof(_sremodulestate). Moreover, "import importlib.util" no longer imports indirectly the "re" module.

----------

_______________________________________
Python tracker <report at bugs.python.org>
<https://bugs.python.org/issue46070>
_______________________________________