Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Use after free in 3.11 #96572

Closed
matthiasgoergens opened this issue Sep 5, 2022 · 13 comments
Closed

Use after free in 3.11 #96572

matthiasgoergens opened this issue Sep 5, 2022 · 13 comments
Assignees
@kumaraditya303
Labels
3.11 only security fixes 3.12 bugs and security fixes release-blocker type-crash A hard crash of the interpreter, possibly with a core dump

Comments

@matthiasgoergens
Copy link
Contributor

matthiasgoergens commented Sep 5, 2022 •
edited
Loading

When I try to build the current 3.11 0c81909 on my 64-bit ArchLinux machine with clang version 14.0.6 and the following configuration:

../configure \
    --with-assertions \
    --with-address-sanitizer \
    --with-trace-refs \
    --with-undefined-behavior-sanitizer

I get the following error:

(3.11)$ make
./_bootstrap_python ../Programs/_freeze_module.py abc ../Lib/abc.py Python/frozen_modules/abc.h
=================================================================
==1780959==ERROR: AddressSanitizer: heap-use-after-free on address 0x608000046cb0 at pc 0x55896728b06e bp 0x7ffc8d63cba0 sp 0x7ffc8d63cb98
READ of size 8 at 0x608000046cb0 thread T0
    #0 0x55896728b06d in _Py_ForgetReference /home/matthias/prog/python/cpython/build-bisect-2/../Objects/object.c:2044:23
    #1 0x55896728dd86 in _Py_Dealloc /home/matthias/prog/python/cpython/build-bisect-2/../Objects/object.c:2385:5
    #2 0x5589672019f7 in Py_DECREF /home/matthias/prog/python/cpython/build-bisect-2/../Include/object.h:538:9
    #3 0x5589672019f7 in Py_XDECREF /home/matthias/prog/python/cpython/build-bisect-2/../Include/object.h:602:9
    #4 0x5589672019f7 in insertdict /home/matthias/prog/python/cpython/build-bisect-2/../Objects/dictobject.c:1304:5
    #5 0x558967566581 in _PyEval_EvalFrameDefault /home/matthias/prog/python/cpython/build-bisect-2/../Python/ceval.c:2774:23
    #6 0x558967544abd in _PyEval_Vector /home/matthias/prog/python/cpython/build-bisect-2/../Python/ceval.c:6424:24
    #7 0x558967530c0d in builtin___build_class__ /home/matthias/prog/python/cpython/build-bisect-2/../Python/bltinmodule.c:201:12
    #8 0x55896726d395 in cfunction_vectorcall_FASTCALL_KEYWORDS /home/matthias/prog/python/cpython/build-bisect-2/../Objects/methodobject.c:443:24
    #9 0x5589670ce5a4 in _PyObject_VectorcallTstate /home/matthias/prog/python/cpython/build-bisect-2/../Include/internal/pycore_call.h:92:11
    #10 0x558967567ba6 in _PyEval_EvalFrameDefault /home/matthias/prog/python/cpython/build-bisect-2/../Python/ceval.c
    #11 0x558967544abd in _PyEval_Vector /home/matthias/prog/python/cpython/build-bisect-2/../Python/ceval.c:6424:24
    #12 0x558967544544 in PyEval_EvalCode /home/matthias/prog/python/cpython/build-bisect-2/../Python/ceval.c:1154:21
    #13 0x5589676b990b in exec_code_in_module /home/matthias/prog/python/cpython/build-bisect-2/../Python/import.c:764:9
    #14 0x5589676ba193 in PyImport_ImportFrozenModuleObject /home/matthias/prog/python/cpython/build-bisect-2/../Python/import.c:1394:9
    #15 0x5589676bbfb1 in PyImport_ImportFrozenModule /home/matthias/prog/python/cpython/build-bisect-2/../Python/import.c:1434:11
    #16 0x55896772498f in init_importlib /home/matthias/prog/python/cpython/build-bisect-2/../Python/pylifecycle.c:186:9
    #17 0x55896772349d in pycore_interp_init /home/matthias/prog/python/cpython/build-bisect-2/../Python/pylifecycle.c:871:13
    #18 0x558967719beb in pyinit_config /home/matthias/prog/python/cpython/build-bisect-2/../Python/pylifecycle.c:900:14
    #19 0x558967719beb in pyinit_core /home/matthias/prog/python/cpython/build-bisect-2/../Python/pylifecycle.c:1063:18
    #20 0x558967719beb in Py_InitializeFromConfig /home/matthias/prog/python/cpython/build-bisect-2/../Python/pylifecycle.c:1253:14
    #21 0x5589679ecc04 in main /home/matthias/prog/python/cpython/build-bisect-2/../Programs/_bootstrap_python.c:103:14
    #22 0x7f5b4e5662cf  (/usr/lib/libc.so.6+0x232cf) (BuildId: 9c28cfc869012ebbd43cdb0f1eebcd14e1b8bdd8)
    #23 0x7f5b4e566389 in __libc_start_main (/usr/lib/libc.so.6+0x23389) (BuildId: 9c28cfc869012ebbd43cdb0f1eebcd14e1b8bdd8)
    #24 0x558966dcae34 in _start /build/glibc/src/glibc/csu/../sysdeps/x86_64/start.S:115

0x608000046cb0 is located 16 bytes inside of 88-byte region [0x608000046ca0,0x608000046cf8)
freed by thread T0 here:
    #0 0x558966e7ecf2 in __interceptor_free.part.0 asan_malloc_linux.cpp.o
    #1 0x55896726ec73 in meth_dealloc /home/matthias/prog/python/cpython/build-bisect-2/../Objects/methodobject.c:175:5
    #2 0x558967567c97 in _PyEval_EvalFrameDefault /home/matthias/prog/python/cpython/build-bisect-2/../Python/ceval.c:4783:13
    #3 0x558967544abd in _PyEval_Vector /home/matthias/prog/python/cpython/build-bisect-2/../Python/ceval.c:6424:24
    #4 0x558967530c0d in builtin___build_class__ /home/matthias/prog/python/cpython/build-bisect-2/../Python/bltinmodule.c:201:12
    #5 0x55896726d395 in cfunction_vectorcall_FASTCALL_KEYWORDS /home/matthias/prog/python/cpython/build-bisect-2/../Objects/methodobject.c:443:24
    #6 0x5589670ce5a4 in _PyObject_VectorcallTstate /home/matthias/prog/python/cpython/build-bisect-2/../Include/internal/pycore_call.h:92:11
    #7 0x558967567ba6 in _PyEval_EvalFrameDefault /home/matthias/prog/python/cpython/build-bisect-2/../Python/ceval.c
    #8 0x558967544abd in _PyEval_Vector /home/matthias/prog/python/cpython/build-bisect-2/../Python/ceval.c:6424:24
    #9 0x558967544544 in PyEval_EvalCode /home/matthias/prog/python/cpython/build-bisect-2/../Python/ceval.c:1154:21
    #10 0x5589676b990b in exec_code_in_module /home/matthias/prog/python/cpython/build-bisect-2/../Python/import.c:764:9
    #11 0x5589676ba193 in PyImport_ImportFrozenModuleObject /home/matthias/prog/python/cpython/build-bisect-2/../Python/import.c:1394:9
    #12 0x5589676bbfb1 in PyImport_ImportFrozenModule /home/matthias/prog/python/cpython/build-bisect-2/../Python/import.c:1434:11
    #13 0x55896772498f in init_importlib /home/matthias/prog/python/cpython/build-bisect-2/../Python/pylifecycle.c:186:9
    #14 0x55896772349d in pycore_interp_init /home/matthias/prog/python/cpython/build-bisect-2/../Python/pylifecycle.c:871:13
    #15 0x558967719beb in pyinit_config /home/matthias/prog/python/cpython/build-bisect-2/../Python/pylifecycle.c:900:14
    #16 0x558967719beb in pyinit_core /home/matthias/prog/python/cpython/build-bisect-2/../Python/pylifecycle.c:1063:18
    #17 0x558967719beb in Py_InitializeFromConfig /home/matthias/prog/python/cpython/build-bisect-2/../Python/pylifecycle.c:1253:14
    #18 0x5589679ecc04 in main /home/matthias/prog/python/cpython/build-bisect-2/../Programs/_bootstrap_python.c:103:14
    #19 0x7f5b4e5662cf  (/usr/lib/libc.so.6+0x232cf) (BuildId: 9c28cfc869012ebbd43cdb0f1eebcd14e1b8bdd8)

previously allocated by thread T0 here:
    #0 0x558966e7fd09 in __interceptor_malloc (/home/matthias/prog/python/cpython/build-bisect-2/_bootstrap_python+0x765d09)
    #1 0x5589677e02e4 in gc_alloc /home/matthias/prog/python/cpython/build-bisect-2/../Modules/gcmodule.c:2283:17
    #2 0x5589677e0198 in _PyObject_GC_New /home/matthias/prog/python/cpython/build-bisect-2/../Modules/gcmodule.c:2298:20
    #3 0x55896726c600 in PyCMethod_New /home/matthias/prog/python/cpython/build-bisect-2/../Objects/methodobject.c:101:14
    #4 0x558967286aa5 in _PyObject_GenericGetAttrWithDict /home/matthias/prog/python/cpython/build-bisect-2/../Objects/object.c:1337:15
    #5 0x558967284949 in PyObject_GetAttr /home/matthias/prog/python/cpython/build-bisect-2/../Objects/object.c
    #6 0x55896754bf4a in _PyEval_EvalFrameDefault /home/matthias/prog/python/cpython/build-bisect-2/../Python/ceval.c:3471:29
    #7 0x558967544abd in _PyEval_Vector /home/matthias/prog/python/cpython/build-bisect-2/../Python/ceval.c:6424:24
    #8 0x558967530c0d in builtin___build_class__ /home/matthias/prog/python/cpython/build-bisect-2/../Python/bltinmodule.c:201:12
    #9 0x55896726d395 in cfunction_vectorcall_FASTCALL_KEYWORDS /home/matthias/prog/python/cpython/build-bisect-2/../Objects/methodobject.c:443:24
    #10 0x5589670ce5a4 in _PyObject_VectorcallTstate /home/matthias/prog/python/cpython/build-bisect-2/../Include/internal/pycore_call.h:92:11
    #11 0x558967567ba6 in _PyEval_EvalFrameDefault /home/matthias/prog/python/cpython/build-bisect-2/../Python/ceval.c
    #12 0x558967544abd in _PyEval_Vector /home/matthias/prog/python/cpython/build-bisect-2/../Python/ceval.c:6424:24
    #13 0x558967544544 in PyEval_EvalCode /home/matthias/prog/python/cpython/build-bisect-2/../Python/ceval.c:1154:21
    #14 0x5589676b990b in exec_code_in_module /home/matthias/prog/python/cpython/build-bisect-2/../Python/import.c:764:9
    #15 0x5589676ba193 in PyImport_ImportFrozenModuleObject /home/matthias/prog/python/cpython/build-bisect-2/../Python/import.c:1394:9
    #16 0x5589676bbfb1 in PyImport_ImportFrozenModule /home/matthias/prog/python/cpython/build-bisect-2/../Python/import.c:1434:11
    #17 0x55896772498f in init_importlib /home/matthias/prog/python/cpython/build-bisect-2/../Python/pylifecycle.c:186:9
    #18 0x55896772349d in pycore_interp_init /home/matthias/prog/python/cpython/build-bisect-2/../Python/pylifecycle.c:871:13
    #19 0x558967719beb in pyinit_config /home/matthias/prog/python/cpython/build-bisect-2/../Python/pylifecycle.c:900:14
    #20 0x558967719beb in pyinit_core /home/matthias/prog/python/cpython/build-bisect-2/../Python/pylifecycle.c:1063:18
    #21 0x558967719beb in Py_InitializeFromConfig /home/matthias/prog/python/cpython/build-bisect-2/../Python/pylifecycle.c:1253:14
    #22 0x5589679ecc04 in main /home/matthias/prog/python/cpython/build-bisect-2/../Programs/_bootstrap_python.c:103:14
    #23 0x7f5b4e5662cf  (/usr/lib/libc.so.6+0x232cf) (BuildId: 9c28cfc869012ebbd43cdb0f1eebcd14e1b8bdd8)

SUMMARY: AddressSanitizer: heap-use-after-free /home/matthias/prog/python/cpython/build-bisect-2/../Objects/object.c:2044:23 in _Py_ForgetReference
Shadow bytes around the buggy address:
  0x0c1080000d40: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fa
  0x0c1080000d50: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c1080000d60: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fa
  0x0c1080000d70: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fa
  0x0c1080000d80: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c1080000d90: fa fa fa fa fd fd[fd]fd fd fd fd fd fd fd fd fa
  0x0c1080000da0: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa
  0x0c1080000db0: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c1080000dc0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c1080000dd0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c1080000de0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==1780959==ABORTING
make: *** [Makefile:1215: Python/frozen_modules/abc.h] Error 1

This error also used to happen with main last week, but it seems not right now.
@matthiasgoergens matthiasgoergens added the type-crash A hard crash of the interpreter, possibly with a core dump label Sep 5, 2022
@hugovk hugovk added the 3.11 only security fixes label Sep 5, 2022
@matthiasgoergens
Copy link
Contributor Author

matthiasgoergens commented Sep 5, 2022 •
edited
Loading

Hmm, this doesn't seem to reproduce all the time.. Might be flaky?

@hugovk
Copy link
Member

hugovk commented Sep 5, 2022

@matthiasgoergens Thanks for the report. Please can you use git bisect to find when this started in 3.11? Might be useful to also find when it started and ended in main too.

Also ping release manager @pablogsal.

@matthiasgoergens
Copy link
Contributor Author

matthiasgoergens commented Sep 5, 2022 •
edited
Loading

Yes, I'll try bisecting. I'm not sure I have a 100% reliable way to trigger this, so I was suspicious of my previous bisection efforts.

So I'm not even sure, whether it actually went away in main, or whether I just got (un)lucky recently.

@hugovk
Copy link
Member

hugovk commented Sep 5, 2022

See also https://docs.python.org/3.11/whatsnew/changelog.html?highlight=_bootstrap_python#id77 and #90108 for some info on _bootstrap_python, which was re-introduced in 3.11.

@matthiasgoergens
Copy link
Contributor Author

Hmm, whether I can trigger this problem seems to depend on the order in which make builds things?

Once I have a binary with the problem, I can trigger it reliably.

But I can't reliably make a binary with the problem.

@matthiasgoergens
Copy link
Contributor Author

matthiasgoergens commented Sep 6, 2022 •
edited
Loading

Preliminarily: it looks like building --with-pydebug causes the problem not to show up. But I'm not sure, because it's flaky for me.

@chilaxan
Copy link
Contributor

chilaxan commented Sep 6, 2022 •
edited
Loading

I built main on MacOS 10.15.7 with Clang 12.0.0 with the same configure command and hit the same heap-use-after-free

=================================================================
==34674==ERROR: AddressSanitizer: heap-use-after-free on address 0x60800003f130 at pc 0x000108e74e7e bp 0x7ffee71b24f0 sp 0x7ffee71b24e8
READ of size 8 at 0x60800003f130 thread T0
    #0 0x108e74e7d in _Py_ForgetReference object.c:2056
    #1 0x108e77c3d in _Py_Dealloc object.c:2397
    #2 0x108dded6d in insertdict dictobject.c:1304
    #3 0x1091ab0d2 in _PyEval_EvalFrameDefault ceval.c:2192
    #4 0x109189431 in _PyEval_Vector ceval.c:5789
    #5 0x1091778b6 in builtin___build_class__ bltinmodule.c:202
    #6 0x108e54e6e in cfunction_vectorcall_FASTCALL_KEYWORDS methodobject.c:443
    #7 0x108c83354 in _PyObject_VectorcallTstate pycore_call.h:92
    #8 0x1091b076b in _PyEval_EvalFrameDefault ceval.c
    #9 0x109189431 in _PyEval_Vector ceval.c:5789
    #10 0x109188e1d in PyEval_EvalCode ceval.c:591
    #11 0x109373151 in PyImport_ImportFrozenModuleObject import.c:1384
    #12 0x109374fb1 in PyImport_ImportFrozenModule import.c:1424
    #13 0x1093e93c7 in pycore_interp_init pylifecycle.c:874
    #14 0x1093de51c in Py_InitializeFromConfig pylifecycle.c:1261
    #15 0x1096e799e in main _bootstrap_python.c:103
    #16 0x7fff681ebcc8 in start+0x0 (libdyld.dylib:x86_64+0x1acc8)

0x60800003f130 is located 16 bytes inside of 88-byte region [0x60800003f120,0x60800003f178)
freed by thread T0 here:
    #0 0x10a25d2c6 in wrap_free+0xa6 (libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x492c6)
    #1 0x108e56702 in meth_dealloc methodobject.c:175
    #2 0x1091b0853 in _PyEval_EvalFrameDefault ceval.c:4179
    #3 0x109189431 in _PyEval_Vector ceval.c:5789
    #4 0x1091778b6 in builtin___build_class__ bltinmodule.c:202
    #5 0x108e54e6e in cfunction_vectorcall_FASTCALL_KEYWORDS methodobject.c:443
    #6 0x108c83354 in _PyObject_VectorcallTstate pycore_call.h:92
    #7 0x1091b076b in _PyEval_EvalFrameDefault ceval.c
    #8 0x109189431 in _PyEval_Vector ceval.c:5789
    #9 0x109188e1d in PyEval_EvalCode ceval.c:591
    #10 0x109373151 in PyImport_ImportFrozenModuleObject import.c:1384
    #11 0x109374fb1 in PyImport_ImportFrozenModule import.c:1424
    #12 0x1093e93c7 in pycore_interp_init pylifecycle.c:874
    #13 0x1093de51c in Py_InitializeFromConfig pylifecycle.c:1261
    #14 0x1096e799e in main _bootstrap_python.c:103
    #15 0x7fff681ebcc8 in start+0x0 (libdyld.dylib:x86_64+0x1acc8)

previously allocated by thread T0 here:
    #0 0x10a25d17d in wrap_malloc+0x9d (libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x4917d)
    #1 0x1094b2f3e in gc_alloc gcmodule.c:2286
    #2 0x1094b2dd3 in _PyObject_GC_New gcmodule.c:2301
    #3 0x108e5410c in PyCMethod_New methodobject.c:101
    #4 0x108e6f798 in _PyObject_GenericGetAttrWithDict object.c:1337
    #5 0x108e6d357 in PyObject_GetAttr object.c
    #6 0x10919a894 in _PyEval_EvalFrameDefault ceval.c:2925
    #7 0x109189431 in _PyEval_Vector ceval.c:5789
    #8 0x1091778b6 in builtin___build_class__ bltinmodule.c:202
    #9 0x108e54e6e in cfunction_vectorcall_FASTCALL_KEYWORDS methodobject.c:443
    #10 0x108c83354 in _PyObject_VectorcallTstate pycore_call.h:92
    #11 0x1091b076b in _PyEval_EvalFrameDefault ceval.c
    #12 0x109189431 in _PyEval_Vector ceval.c:5789
    #13 0x109188e1d in PyEval_EvalCode ceval.c:591
    #14 0x109373151 in PyImport_ImportFrozenModuleObject import.c:1384
    #15 0x109374fb1 in PyImport_ImportFrozenModule import.c:1424
    #16 0x1093e93c7 in pycore_interp_init pylifecycle.c:874
    #17 0x1093de51c in Py_InitializeFromConfig pylifecycle.c:1261
    #18 0x1096e799e in main _bootstrap_python.c:103
    #19 0x7fff681ebcc8 in start+0x0 (libdyld.dylib:x86_64+0x1acc8)

SUMMARY: AddressSanitizer: heap-use-after-free object.c:2056 in _Py_ForgetReference
Shadow bytes around the buggy address:
  0x1c1000007dd0: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fa
  0x1c1000007de0: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00
  0x1c1000007df0: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fa
  0x1c1000007e00: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fa
  0x1c1000007e10: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00
=>0x1c1000007e20: fa fa fa fa fd fd[fd]fd fd fd fd fd fd fd fd fa
  0x1c1000007e30: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa
  0x1c1000007e40: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00
  0x1c1000007e50: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x1c1000007e60: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x1c1000007e70: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==34674==ABORTING
[1]    34674 abort      ./_bootstrap_python ./Programs/_freeze_module.py abc ./Lib/abc.py

I did some searching with lldb and it looks like the Py_DECREF in ceval.c:4179 is somehow missing the call to _Py_ForgetReference so meth_dealloc is called without _ob_next and _ob_prev being NULLed out.

@kumaraditya303 kumaraditya303 added the 3.12 bugs and security fixes label Sep 6, 2022
@kumaraditya303 kumaraditya303 self-assigned this Sep 6, 2022
@kumaraditya303
Copy link
Contributor

I am working on fix.

@bedevere-bot bedevere-bot mentioned this issue Sep 6, 2022
Merged
@kumaraditya303
Copy link
Contributor

See #96618

gvanrossum pushed a commit that referenced this issue Sep 6, 2022
@kumaraditya303
GH-96572: fix use after free in trace refs build mode (#96618)
6744490
miss-islington pushed a commit to miss-islington/cpython that referenced this issue Sep 6, 2022
@kumaraditya303 @miss-islington
pythonGH-96572: fix use after free in trace refs build mode (pythonGH…
858148b 
…-96618)

(cherry picked from commit 6744490)

Co-authored-by: Kumar Aditya <59607654+kumaraditya303@users.noreply.github.com>
@bedevere-bot bedevere-bot mentioned this issue Sep 6, 2022
Merged
miss-islington added a commit that referenced this issue Sep 6, 2022
@miss-islington @kumaraditya303
GH-96572: fix use after free in trace refs build mode (GH-96618)
a389fdb 
(cherry picked from commit 6744490)

Co-authored-by: Kumar Aditya <59607654+kumaraditya303@users.noreply.github.com>
@gvanrossum
Copy link
Member

Should be fixed now.

Repository owner moved this from Todo to Done in Release and Deferred blockers 🚫 Sep 6, 2022
@matthiasgoergens
Copy link
Contributor Author

Awesome, thanks!

@hugovk
Copy link
Member

hugovk commented Sep 7, 2022

@matthiasgoergens And thank you for both testing 3.11 and reporting! This got fixed just in time for 3.11 RC2 🚀

@matthiasgoergens
Copy link
Contributor Author

matthiasgoergens commented Sep 7, 2022 •
edited
Loading

To be honest, I only tested 3.11, because I was trying to do a git bisect to figure out how and when the problem was introduced in main. :)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@kumaraditya303 kumaraditya303

Labels
3.11 only security fixes 3.12 bugs and security fixes release-blocker type-crash A hard crash of the interpreter, possibly with a core dump
Projects
Release and Deferred blockers 🚫
Archived in project
Milestone
No milestone
Development

No branches or pull requests
6 participants
@matthiasgoergens @iritkatriel @hugovk @gvanrossum @chilaxan @kumaraditya303