[issue25395] SIGSEGV using json.tool: highly nested OrderedDict

Serhiy Storchaka added the comment: Thank you Martin for your review and for initial investigation. -- resolution: -> fixed stage: patch review -> resolved status: open -> closed ___ Python tracker

[issue25395] SIGSEGV using json.tool: highly nested OrderedDict

Roundup Robot added the comment: New changeset ce8c850a52d4 by Serhiy Storchaka in branch '3.5': Issue #25395: Fixed crash when highly nested OrderedDict structures were https://hg.python.org/cpython/rev/ce8c850a52d4 New changeset bd6bfa5fe203 by Serhiy Storchaka in branch 'default': Issue

[issue25395] SIGSEGV using json.tool: highly nested OrderedDict

Martin Panter added the comment: Left a comment about a minor English grammar problem. The existing comment Serhiy mentioned was added way back in 2003 for Issue 668433. It appears to use the same underlying technique, reverting the nesting level before calling the base class dealloc. One

[issue25395] SIGSEGV using json.tool: highly nested OrderedDict

Serhiy Storchaka added the comment: There is a problem with odict-trashcan.v3.patch. PyDict_Type.tp_dealloc() can put the object to the freelist if it's type is dict. Since odict_dealloc() fakes object's type, it alows deallocated OrderedDict to be later used as dict. But the size of

[issue25395] SIGSEGV using json.tool: highly nested OrderedDict

Eric Snow added the comment: Thanks for solving this! odict-trashcan.v3.patch LGTM -- stage: patch review -> commit review ___ Python tracker ___

[issue25395] SIGSEGV using json.tool: highly nested OrderedDict

Martin Panter added the comment: Here is a patch that seems to fix the problem for me. Can someone who knows more about tp_dealloc() methods and the Py_TRASHCAN_SAFE stuff have a look? All I know is that the body of the trashcan stuff can be deferred until an outer nested body is finished, so

[issue25395] SIGSEGV using json.tool: highly nested OrderedDict

Martin Panter added the comment: The following simplified code produces the crash: from collections import OrderedDict obj = [] for _ in range(33): obj = OrderedDict(((None, obj),)) for _ in range(17): obj = [obj] print("Still alive, crash happens at interpreter finalization") This

[issue25395] SIGSEGV using json.tool: highly nested OrderedDict

Serhiy Storchaka added the comment: I think there is no need to run the test in a subprocess. You can trigger the crash by "del obj". from collections import OrderedDict obj = None for _ in range(1000): obj = OrderedDict([(None, obj)]) del obj support.gc_collect() Unfortunately this test

[issue25395] SIGSEGV using json.tool: highly nested OrderedDict

Martin Panter added the comment: Here is a new patch which uses Py_CLEAR() rather than Py_XDECREF(), which seems to cure the negative reference count problem. This change was only a guess based on looking at namespaceobject.c and the Py_CLEAR() documentation, so it would be good for someone

[issue25395] SIGSEGV using json.tool: highly nested OrderedDict

Serhiy Storchaka added the comment: Using Py_CLEAR() fixes symptoms in this test, but the real issue is that deallocating code is executed twice for some objects (for every 25th OrderedDict). PyDict_Type.tp_dealloc() can deposit an object in the _PyTrash_delete_later list if