Michael Goldish added the comment: OK, I caught the crash with a debug build of Python 3.4.3.
I have a core dump and even the process itself still alive in memory. I can provide any information you need. I can also explain how to debug a core dump with Visual Studio, if necessary. This time the crash was here: static void update_refs(PyGC_Head *containers) { PyGC_Head *gc = containers->gc.gc_next; for (; gc != containers; gc = gc->gc.gc_next) { assert(_PyGCHead_REFS(gc) == GC_REACHABLE); _PyGCHead_SET_REFS(gc, Py_REFCNT(FROM_GC(gc))); /* Python's cyclic gc should never see an incoming refcount * of 0: if something decref'ed to 0, it should have been * deallocated immediately at that time. * Possible cause (if the assert triggers): a tp_dealloc * routine left a gc-aware object tracked during its teardown * phase, and did something-- or allowed something to happen -- * that called back into Python. gc can trigger then, and may * see the still-tracked dying object. Before this assert * was added, such mistakes went on to allow gc to try to * delete the object again. In a debug build, that caused * a mysterious segfault, when _Py_ForgetReference tried * to remove the object from the doubly-linked list of all * objects a second time. In a release build, an actual * double deallocation occurred, which leads to corruption * of the allocator's internal bookkeeping pointers. That's * so serious that maybe this should be a release-build * check instead of an assert? */ ------> assert(_PyGCHead_REFS(gc) != 0); <------- crash } } In the calling frame I can see that update_refs() is called with a PyGC_Head object whose gc_refs is 0, and according to the paragraph above that shouldn't happen. A screenshot is attached. Stack trace: msvcr100d.dll!_NMSG_WRITE(int rterrnum=10) Line 217 msvcr100d.dll!abort() Line 71 msvcr100d.dll!_wassert(const wchar_t * expr=0x0000000063220618, const wchar_t * filename=0x00000000632205e0, unsigned int lineno=364) Line 153 python34_d.dll!update_refs(_gc_head * containers=0x000000006338cfc0) Line 364 + 0x2b bytes python34_d.dll!collect(int generation=0, __int64 * n_collected=0x000000012beee530, __int64 * n_uncollectable=0x000000012beee520, int nofail=0) Line 969 python34_d.dll!collect_with_callback(int generation=0) Line 1140 + 0x16 bytes python34_d.dll!collect_generations() Line 1163 + 0x9 bytes python34_d.dll!_PyObject_GC_Malloc(unsigned __int64 basicsize=56) Line 1739 python34_d.dll!_PyObject_GC_New(_typeobject * tp=0x00000000633ce280) Line 1748 + 0xe bytes python34_d.dll!PyList_New(__int64 size=0) Line 159 + 0xc bytes python34_d.dll!PyEval_EvalFrameEx(_frame * f=0x000000010f387658, int throwflag=3) Line 2347 + 0x8 bytes python34_d.dll!fast_function(_object * func=0x0000000000000003, _object * * * pp_stack=0x0000000129e69948, int n=737077536, int na=1661137695, int nk=0) Line 4335 python34_d.dll!call_function(_object * * * pp_stack=0x000000012beee919, int oparg=131) Line 4263 python34_d.dll!PyEval_EvalFrameEx(_frame * f=0x000000011c077528, int throwflag=3) Line 2840 python34_d.dll!fast_function(_object * func=0x0000000000000003, _object * * * pp_stack=0x0000000089a53190, int n=737078048, int na=1661137695, int nk=0) Line 4335 python34_d.dll!call_function(_object * * * pp_stack=0x000000012beeeb19, int oparg=131) Line 4263 python34_d.dll!PyEval_EvalFrameEx(_frame * f=0x000000010369f2a8, int throwflag=0) Line 2840 python34_d.dll!PyEval_EvalCodeEx(_object * _co=0x0000000100000002, _object * globals=0x0000000100000002, _object * locals=0x000000001fa5e218, _object * * args=0x0000000000730088, int argcount=2, _object * * kws=0x0000000000730080, int kwcount=0, _object * * defs=0x0000000000000000, int defcount=0, _object * kwdefs=0x0000000000000000, _object * closure=0x0000000000000000) Line 3588 + 0xf bytes python34_d.dll!function_call(_object * func=0x0000000003c10058, _object * arg=0x000000001fa5e218, _object * kw=0x00000001296360c8) Line 638 + 0x8a bytes python34_d.dll!PyObject_Call(_object * func=0x0000000003c10058, _object * arg=0x000000001fa5e218, _object * kw=0x00000001296360c8) Line 2040 + 0x13 bytes python34_d.dll!ext_do_call(_object * func=0x00000000c42c25a0, _object * * * pp_stack=0x000000012beeee49, int flags=62980184, int na=1, int nk=0) Line 4561 + 0xe bytes python34_d.dll!PyEval_EvalFrameEx(_frame * f=0x00000000fa4eab18, int throwflag=1) Line 2880 python34_d.dll!fast_function(_object * func=0x0000000000000001, _object * * * pp_stack=0x000000003b42f398, int n=737079376, int na=1661137695, int nk=0) Line 4335 python34_d.dll!call_function(_object * * * pp_stack=0x000000012beef049, int oparg=131) Line 4263 python34_d.dll!PyEval_EvalFrameEx(_frame * f=0x000000010f38ec28, int throwflag=0) Line 2840 python34_d.dll!PyEval_EvalCodeEx(_object * _co=0x0000000100000002, _object * globals=0x0000000100000002, _object * locals=0x000000012a1e5d78, _object * * args=0x0000000000730088, int argcount=2, _object * * kws=0x0000000000730080, int kwcount=0, _object * * defs=0x0000000000000000, int defcount=0, _object * kwdefs=0x0000000000000000, _object * closure=0x0000000000000000) Line 3588 + 0xf bytes python34_d.dll!function_call(_object * func=0x00000000036d2d48, _object * arg=0x000000012a1e5d78, _object * kw=0x000000012a1f1918) Line 638 + 0x8a bytes python34_d.dll!PyObject_Call(_object * func=0x00000000036d2d48, _object * arg=0x000000012a1e5d78, _object * kw=0x000000012a1f1918) Line 2040 + 0x13 bytes python34_d.dll!ext_do_call(_object * func=0x00000000033f6040, _object * * * pp_stack=0x000000012beef379, int flags=57486664, int na=0, int nk=0) Line 4561 + 0xe bytes python34_d.dll!PyEval_EvalFrameEx(_frame * f=0x000000010f80f118, int throwflag=1) Line 2880 python34_d.dll!fast_function(_object * func=0x0000000000000001, _object * * * pp_stack=0x000000012a1ee878, int n=737080704, int na=1661137695, int nk=0) Line 4335 python34_d.dll!call_function(_object * * * pp_stack=0x000000012beef579, int oparg=131) Line 4263 python34_d.dll!PyEval_EvalFrameEx(_frame * f=0x000000010f1c8b98, int throwflag=1) Line 2840 python34_d.dll!fast_function(_object * func=0x0000000000000001, _object * * * pp_stack=0x000000012a1ee878, int n=737081216, int na=1661137695, int nk=0) Line 4335 python34_d.dll!call_function(_object * * * pp_stack=0x000000012beef779, int oparg=131) Line 4263 python34_d.dll!PyEval_EvalFrameEx(_frame * f=0x000000010f80ee88, int throwflag=0) Line 2840 python34_d.dll!PyEval_EvalCodeEx(_object * _co=0x0000000000000001, _object * globals=0x0000000100000001, _object * locals=0x0000000000730058, _object * * args=0x0000000000000000, int argcount=1, _object * * kws=0x0000000000000000, int kwcount=0, _object * * defs=0x0000000000000000, int defcount=0, _object * kwdefs=0x0000000000000000, _object * closure=0x0000000000000000) Line 3588 + 0xf bytes python34_d.dll!function_call(_object * func=0x0000000003404058, _object * arg=0x000000012a1ee058, _object * kw=0x0000000000000000) Line 638 + 0x8a bytes python34_d.dll!PyObject_Call(_object * func=0x0000000003404058, _object * arg=0x000000012a1ee058, _object * kw=0x0000000000000000) Line 2040 + 0x13 bytes python34_d.dll!method_call(_object * func=0x0000000003404058, _object * arg=0x000000012a1ee058, _object * kw=0x0000000000000000) Line 347 + 0x1d bytes python34_d.dll!PyObject_Call(_object * func=0x0000000003826fa8, _object * arg=0x0000000000730058, _object * kw=0x0000000000000000) Line 2040 + 0x13 bytes python34_d.dll!PyEval_CallObjectWithKeywords(_object * func=0x0000000000000000, _object * arg=0x0000000000000000, _object * kw=0x0000000000000000) Line 4115 python34_d.dll!t_bootstrap(void * boot_raw=0x00000000e2e0df70) Line 1000 + 0x20 bytes python34_d.dll!bootstrap(void * call=0x000000000070ef20) Line 176 msvcr100d.dll!_callthreadstartex() Line 314 + 0x17 bytes msvcr100d.dll!_threadstartex(void * ptd=0x000000007be2d110) Line 297 kernel32.dll!0000000076eb5a4d() [Frames below may be incorrect and/or missing, no symbols loaded for kernel32.dll] ntdll.dll!00000000775aba01() ---------- Added file: http://bugs.python.org/file38498/gc_refs.png _______________________________________ Python tracker <rep...@bugs.python.org> <http://bugs.python.org/issue23187> _______________________________________ _______________________________________________ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com