Access violation in python39.dll!meth_dealloc on exit

[cgohlke]

BPO	41237
Nosy	@pfmoore, @tjguk, @encukou, @zware, @zooba

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = None
closed_at = <Date 2020-07-09.08:25:17.613>
created_at = <Date 2020-07-08.06:09:25.217>
labels = ['interpreter-core', 'OS-windows', 'type-crash', '3.9']
title = 'Access violation in python39.dll!meth_dealloc on exit'
updated_at = <Date 2020-11-09.09:58:02.814>
user = 'https://bugs.python.org/cgohlke'

bugs.python.org fields:

activity = <Date 2020-11-09.09:58:02.814>
actor = 'petr.viktorin'
assignee = 'none'
closed = True
closed_date = <Date 2020-07-09.08:25:17.613>
closer = 'cgohlke'
components = ['Interpreter Core', 'Windows']
creation = <Date 2020-07-08.06:09:25.217>
creator = 'cgohlke'
dependencies = []
files = []
hgrepos = []
issue_num = 41237
keywords = []
message_count = 3.0
messages = ['373279', '373283', '373381']
nosy_count = 6.0
nosy_names = ['paul.moore', 'tim.golden', 'petr.viktorin', 'cgohlke', 'zach.ware', 'steve.dower']
pr_nums = []
priority = 'normal'
resolution = None
stage = 'resolved'
status = 'closed'
superseder = None
type = 'crash'
url = 'https://bugs.python.org/issue41237'
versions = ['Python 3.9']

[cgohlke]

When testing extension packages on Python 3.9.0b4 for Windows, I often get access violations in python39.dll!meth_dealloc during interpreter exit. The crash only happens when heap verification is turned on ("C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\gflags.exe" /p /enable python.exe; https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/gflags). The debug build does not crash.

Could be related to "PEP-573: Module State Access from C Extension Methods", https://bugs.python.org/issue38787

To reproduce the crash with with numpy-1.19.0 (built from source):

Python 3.9.0b4 (tags/v3.9.0b4:69dec9c, Jul  2 2020, 21:46:36) [MSC v.1924 64 bit (AMD64)] on win32
Type "help", "copyright", "credits" or "license" for more information.
>>> import numpy;numpy.test()
NumPy version 1.19.0
<snip>
10364 passed, 438 skipped, 108 deselected, 17 xfailed, 1 xpassed in 243.52s (0:04:03)
True
>>> exit()
Windows fatal exception: access violation

Current thread 0x00002688 (most recent call first):
<no Python frame>

The crash is at <https://github.com/python/cpython/blob/1d1c5743400bdf384ec83eb6ba5b39a355d121e3/Objects/methodobject.c#L169\>:

static void
meth_dealloc(PyCFunctionObject *m)
{
    _PyObject_GC_UNTRACK(m);
    if (m->m_weakreflist != NULL) {
        PyObject_ClearWeakRefs((PyObject*) m);
    }
    Py_XDECREF(m->m_self);
    Py_XDECREF(m->m_module);
    Py_XDECREF(PyCFunction_GET_CLASS(m));  /* <-- crash */
    PyObject_GC_Del(m);
}

Call Stack:

>	python39.dll!meth_dealloc(PyCFunctionObject * m) Line 169	C
 	[Inline Frame] python39.dll!_Py_Dealloc(_object *) Line 2209	C
 	[Inline Frame] python39.dll!_Py_DECREF(_object *) Line 430	C
 	[Inline Frame] python39.dll!_Py_XDECREF(_object * op) Line 497	C
 	[Inline Frame] python39.dll!free_keys_object(_dictkeysobject *) Line 598	C
 	[Inline Frame] python39.dll!dictkeys_decref(_dictkeysobject *) Line 333	C
 	python39.dll!dict_dealloc(PyDictObject * mp) Line 2026	C
 	[Inline Frame] python39.dll!_Py_Dealloc(_object *) Line 2209	C
 	[Inline Frame] python39.dll!_Py_DECREF(_object *) Line 430	C
 	python39.dll!_PyInterpreterState_ClearModules(_is * interp) Line 768	C
 	python39.dll!_PyImport_Cleanup(_ts * tstate) Line 628	C
 	python39.dll!Py_FinalizeEx() Line 1432	C
 	python39.dll!Py_Exit(int sts) Line 2433	C
 	python39.dll!handle_system_exit() Line 696	C
 	python39.dll!_PyErr_PrintEx(_ts * tstate, int set_sys_last_vars) Line 708	C
 	[Inline Frame] python39.dll!PyErr_Print() Line 807	C
 	python39.dll!PyRun_InteractiveLoopFlags(_iobuf * fp, const char * filename_str, PyCompilerFlags * flags) Line 137	C
 	python39.dll!PyRun_AnyFileExFlags(_iobuf * fp, const char * filename, int closeit, PyCompilerFlags * flags) Line 81	C
 	python39.dll!pymain_run_stdin(PyConfig * config, PyCompilerFlags * cf) Line 509	C
 	python39.dll!pymain_run_python(int * exitcode) Line 597	C
 	python39.dll!Py_RunMain() Line 675	C
 	python39.dll!Py_Main(int argc, wchar_t * * argv) Line 716	C
 	[External Code]	

Locals:

-		m	0x000001fbea75ddb0 {ob_base={ob_refcnt=0 ob_type=0x00007fff5a1e5650 {python39.dll!_typeobject PyCFunction_Type} {...} } ...}	PyCFunctionObject *
-		ob_base	{ob_refcnt=0 ob_type=0x00007fff5a1e5650 {python39.dll!_typeobject PyCFunction_Type} {ob_base={ob_base=...} ...} }	_object
		ob_refcnt	0	__int64
-		ob_type	0x00007fff5a1e5650 {python39.dll!_typeobject PyCFunction_Type} {ob_base={ob_base={ob_refcnt=23 ob_type=...} ...} ...}	_typeobject *
+		ob_base	{ob_base={ob_refcnt=23 ob_type=0x00007fff5a1e7c60 {python39.dll!_typeobject PyType_Type} {ob_base={ob_base=...} ...} } ...}	PyVarObject
+		tp_name	0x00007fff5a16d8a0 "builtin_function_or_method"	const char *
		tp_basicsize	56	__int64
		tp_itemsize	0	__int64
		tp_dealloc	0x00007fff59e2c260 {python39.dll!meth_dealloc(PyCFunctionObject *)}	void(*)(_object *)
		tp_vectorcall_offset	48	__int64
		tp_getattr	0x0000000000000000	_object *(*)(_object *, char *)
		tp_setattr	0x0000000000000000	int(*)(_object *, char *, _object *)
+		tp_as_async	0x0000000000000000 <NULL>	PyAsyncMethods *
		tp_repr	0x00007fff59e5c430 {python39.dll!meth_repr(PyCFunctionObject *)}	_object *(*)(_object *)
+		tp_as_number	0x0000000000000000 <NULL>	PyNumberMethods *
+		tp_as_sequence	0x0000000000000000 <NULL>	PySequenceMethods *
+		tp_as_mapping	0x0000000000000000 <NULL>	PyMappingMethods *
		tp_hash	0x00007fff59f44768 {python39.dll!meth_hash(PyCFunctionObject *)}	__int64(*)(_object *)
		tp_call	0x00007fff59e28790 {python39.dll!cfunction_call(_object *, _object *, _object *)}	_object *(*)(_object *, _object *, _object *)
		tp_str	0x00007fff59e5b978 {python39.dll!object_str(_object *)}	_object *(*)(_object *)
		tp_getattro	0x00007fff59e2fc40 {python39.dll!PyObject_GenericGetAttr(_object *, _object *)}	_object *(*)(_object *, _object *)
		tp_setattro	0x00007fff59e92520 {python39.dll!PyObject_GenericSetAttr(_object *, _object *, _object *)}	int(*)(_object *, _object *, _object *)
+		tp_as_buffer	0x0000000000000000 <NULL>	PyBufferProcs *
		tp_flags	808960	unsigned long
+		tp_doc	0x0000000000000000 <NULL>	const char *
		tp_traverse	0x00007fff59eb0eb0 {python39.dll!meth_traverse(PyCFunctionObject *, int(*)(_object *, void *), void *)}	int(*)(_object *, int(*)(_object *, void *), void *)
		tp_clear	0x0000000000000000	int(*)(_object *)
		tp_richcompare	0x00007fff59f653a4 {python39.dll!meth_richcompare(_object *, _object *, int)}	_object *(*)(_object *, _object *, int)
		tp_weaklistoffset	40	__int64
		tp_iter	0x0000000000000000	_object *(*)(_object *)
		tp_iternext	0x0000000000000000	_object *(*)(_object *)
+		tp_methods	0x00007fff5a20dad0 {python39.dll!PyMethodDef meth_methods[2]} {ml_name=0x00007fff5a1673d0 "__reduce__" ...}	PyMethodDef *
+		tp_members	0x00007fff5a20da80 {python39.dll!PyMemberDef meth_members[2]} {name=0x00007fff5a038210 "__module__" ...}	PyMemberDef *
+		tp_getset	0x00007fff5a20d990 {python39.dll!PyGetSetDef meth_getsets[6]} {name=0x00007fff5a038208 "__doc__" get=...}	PyGetSetDef *
+		tp_base	0x00007fff5a1e7e00 {python39.dll!_typeobject PyBaseObject_Type} {ob_base={ob_base={ob_refcnt=10617 ob_type=...} ...} ...}	_typeobject *
+		tp_dict	0x000001fbb3b2a240 {ob_refcnt=1 ob_type=0x00007fff5a1db8b0 {python39.dll!_typeobject PyDict_Type} {ob_base=...} }	_object *
		tp_descr_get	0x0000000000000000	_object *(*)(_object *, _object *, _object *)
		tp_descr_set	0x0000000000000000	int(*)(_object *, _object *, _object *)
		tp_dictoffset	0	__int64
		tp_init	0x00007fff59e26378 {python39.dll!object_init(_object *, _object *, _object *)}	int(*)(_object *, _object *, _object *)
		tp_alloc	0x00007fff59e98130 {python39.dll!PyType_GenericAlloc(_typeobject *, __int64)}	_object *(*)(_typeobject *, __int64)
		tp_new	0x0000000000000000	_object *(*)(_typeobject *, _object *, _object *)
		tp_free	0x00007fff59e2c610 {python39.dll!PyObject_GC_Del(void *)}	void(*)(void *)
		tp_is_gc	0x0000000000000000	int(*)(_object *)
+		tp_bases	0x000001fbb3b04910 {ob_refcnt=1 ob_type=0x00007fff5a1e7920 {python39.dll!_typeobject PyTuple_Type} {...} }	_object *
+		tp_mro	0x000001fbb3b2a400 {ob_refcnt=1 ob_type=0x00007fff5a1e7920 {python39.dll!_typeobject PyTuple_Type} {...} }	_object *
+		tp_cache	0x0000000000000000 <NULL>	_object *
+		tp_subclasses	0x000001fbb3b2a4c0 {ob_refcnt=1 ob_type=0x00007fff5a1db8b0 {python39.dll!_typeobject PyDict_Type} {ob_base=...} }	_object *
+		tp_weaklist	0x000001fbb3b29db0 {ob_refcnt=1 ob_type=0x00007fff5a1e8620 {python39.dll!_typeobject _PyWeakref_RefType} {...} }	_object *
		tp_del	0x0000000000000000	void(*)(_object *)
		tp_version_tag	40	unsigned int
		tp_finalize	0x0000000000000000	void(*)(_object *)
		tp_vectorcall	0x0000000000000000	_object *(*)(_object *, _object * const *, unsigned __int64, _object *)
-		m_ml	0x000001fbe8ec3fe0 {ml_name=??? ml_meth=??? ml_flags=??? ...}	PyMethodDef *
		ml_name	<Unable to read memory>	
		ml_meth	<Unable to read memory>	
		ml_flags	<Unable to read memory>	
		ml_doc	<Unable to read memory>	
-		m_self	0x000001fbea74eed0 {ob_refcnt=2181481948096 ob_type=0x00007fff5a1da1f0 {python39.dll!_typeobject PyCapsule_Type} {...} }	_object *
		ob_refcnt	2181481948096	__int64
-		ob_type	0x00007fff5a1da1f0 {python39.dll!_typeobject PyCapsule_Type} {ob_base={ob_base={ob_refcnt=3 ob_type=...} ...} ...}	_typeobject *
+		ob_base	{ob_base={ob_refcnt=3 ob_type=0x00007fff5a1e7c60 {python39.dll!_typeobject PyType_Type} {ob_base={ob_base=...} ...} } ...}	PyVarObject
+		tp_name	0x00007fff5a16bb68 "PyCapsule"	const char *
		tp_basicsize	48	__int64
		tp_itemsize	0	__int64
		tp_dealloc	0x00007fff59f3c880 {python39.dll!capsule_dealloc(_object *)}	void(*)(_object *)
		tp_vectorcall_offset	0	__int64
		tp_getattr	0x0000000000000000	_object *(*)(_object *, char *)
		tp_setattr	0x0000000000000000	int(*)(_object *, char *, _object *)
+		tp_as_async	0x0000000000000000 <NULL>	PyAsyncMethods *
		tp_repr	0x00007fff5a00093c {python39.dll!capsule_repr(_object *)}	_object *(*)(_object *)
+		tp_as_number	0x0000000000000000 <NULL>	PyNumberMethods *
+		tp_as_sequence	0x0000000000000000 <NULL>	PySequenceMethods *
+		tp_as_mapping	0x0000000000000000 <NULL>	PyMappingMethods *
		tp_hash	0x00007fff59e93c1c {python39.dll!_Py_HashPointer(const void *)}	__int64(*)(_object *)
		tp_call	0x0000000000000000	_object *(*)(_object *, _object *, _object *)
		tp_str	0x00007fff59e5b978 {python39.dll!object_str(_object *)}	_object *(*)(_object *)
		tp_getattro	0x00007fff59e2fc40 {python39.dll!PyObject_GenericGetAttr(_object *, _object *)}	_object *(*)(_object *, _object *)
		tp_setattro	0x00007fff59e92520 {python39.dll!PyObject_GenericSetAttr(_object *, _object *, _object *)}	int(*)(_object *, _object *, _object *)
+		tp_as_buffer	0x0000000000000000 <NULL>	PyBufferProcs *
		tp_flags	4096	unsigned long
+		tp_doc	0x00007fff5a122650 "Capsule objects let you wrap a C \"void *\" pointer in a Python\nobject.  They're a way of passing data through the Python interpreter\nwithout creating your own custom type.\n\nCapsules are used for commun...	const char *
		tp_traverse	0x0000000000000000	int(*)(_object *, int(*)(_object *, void *), void *)
		tp_clear	0x0000000000000000	int(*)(_object *)
		tp_richcompare	0x00007fff59e839c4 {python39.dll!object_richcompare(_object *, _object *, int)}	_object *(*)(_object *, _object *, int)
		tp_weaklistoffset	0	__int64
		tp_iter	0x0000000000000000	_object *(*)(_object *)
		tp_iternext	0x0000000000000000	_object *(*)(_object *)
+		tp_methods	0x0000000000000000 <NULL>	PyMethodDef *
+		tp_members	0x0000000000000000 <NULL>	PyMemberDef *
+		tp_getset	0x0000000000000000 <NULL>	PyGetSetDef *
+		tp_base	0x00007fff5a1e7e00 {python39.dll!_typeobject PyBaseObject_Type} {ob_base={ob_base={ob_refcnt=10617 ob_type=...} ...} ...}	_typeobject *
+		tp_dict	0x000001fbb3b2d780 {ob_refcnt=1 ob_type=0x00007fff5a1db8b0 {python39.dll!_typeobject PyDict_Type} {ob_base=...} }	_object *
		tp_descr_get	0x0000000000000000	_object *(*)(_object *, _object *, _object *)
		tp_descr_set	0x0000000000000000	int(*)(_object *, _object *, _object *)
		tp_dictoffset	0	__int64
		tp_init	0x00007fff59e26378 {python39.dll!object_init(_object *, _object *, _object *)}	int(*)(_object *, _object *, _object *)
		tp_alloc	0x00007fff59e98130 {python39.dll!PyType_GenericAlloc(_typeobject *, __int64)}	_object *(*)(_typeobject *, __int64)
		tp_new	0x0000000000000000	_object *(*)(_typeobject *, _object *, _object *)
		tp_free	0x00007fff59e50cd0 {python39.dll!PyObject_Free(void *)}	void(*)(void *)
		tp_is_gc	0x0000000000000000	int(*)(_object *)
+		tp_bases	0x000001fbb3b04b50 {ob_refcnt=1 ob_type=0x00007fff5a1e7920 {python39.dll!_typeobject PyTuple_Type} {...} }	_object *
+		tp_mro	0x000001fbb3b2d7c0 {ob_refcnt=1 ob_type=0x00007fff5a1e7920 {python39.dll!_typeobject PyTuple_Type} {...} }	_object *
+		tp_cache	0x0000000000000000 <NULL>	_object *
+		tp_subclasses	0x0000000000000000 <NULL>	_object *
+		tp_weaklist	0x000001fbb3b2f090 {ob_refcnt=1 ob_type=0x00007fff5a1e8620 {python39.dll!_typeobject _PyWeakref_RefType} {...} }	_object *
		tp_del	0x0000000000000000	void(*)(_object *)
		tp_version_tag	0	unsigned int
		tp_finalize	0x0000000000000000	void(*)(_object *)
		tp_vectorcall	0x0000000000000000	_object *(*)(_object *, _object * const *, unsigned __int64, _object *)
-		m_module	0x000001fbea75e3f0 {ob_refcnt=9 ob_type=0x00007fff5a1e8140 {python39.dll!_typeobject PyUnicode_Type} {...} }	_object *
		ob_refcnt	9	__int64
-		ob_type	0x00007fff5a1e8140 {python39.dll!_typeobject PyUnicode_Type} {ob_base={ob_base={ob_refcnt=495 ob_type=...} ...} ...}	_typeobject *
+		ob_base	{ob_base={ob_refcnt=495 ob_type=0x00007fff5a1e7c60 {python39.dll!_typeobject PyType_Type} {ob_base={...} ...} } ...}	PyVarObject
+		tp_name	0x00007fff5a036c8c "str"	const char *
		tp_basicsize	80	__int64
		tp_itemsize	0	__int64
		tp_dealloc	0x00007fff59e2c830 {python39.dll!unicode_dealloc(_object *)}	void(*)(_object *)
		tp_vectorcall_offset	0	__int64
		tp_getattr	0x0000000000000000	_object *(*)(_object *, char *)
		tp_setattr	0x0000000000000000	int(*)(_object *, char *, _object *)
+		tp_as_async	0x0000000000000000 <NULL>	PyAsyncMethods *
		tp_repr	0x00007fff59ea4cac {python39.dll!unicode_repr(_object *)}	_object *(*)(_object *)
+		tp_as_number	0x00007fff5a20f9f0 {python39.dll!PyNumberMethods unicode_as_number} {nb_add=0x0000000000000000 nb_subtract=...}	PyNumberMethods *
+		tp_as_sequence	0x00007fff5a20f8c0 {python39.dll!PySequenceMethods unicode_as_sequence} {sq_length=0x00007fff59e6c498 {python39.dll!unicode_length(_object *)} ...}	PySequenceMethods *
+		tp_as_mapping	0x00007fff5a20f950 {python39.dll!PyMappingMethods unicode_as_mapping} {mp_length=0x00007fff59e6c498 {python39.dll!unicode_length(_object *)} ...}	PyMappingMethods *
		tp_hash	0x00007fff59e95970 {python39.dll!unicode_hash(_object *)}	__int64(*)(_object *)
		tp_call	0x0000000000000000	_object *(*)(_object *, _object *, _object *)
		tp_str	0x00007fff59ea68c0 {python39.dll!unicode_str(_object *)}	_object *(*)(_object *)
		tp_getattro	0x00007fff59e2fc40 {python39.dll!PyObject_GenericGetAttr(_object *, _object *)}	_object *(*)(_object *, _object *)
		tp_setattro	0x00007fff59e92520 {python39.dll!PyObject_GenericSetAttr(_object *, _object *, _object *)}	int(*)(_object *, _object *, _object *)
+		tp_as_buffer	0x0000000000000000 <NULL>	PyBufferProcs *
		tp_flags	269227008	unsigned long
+		tp_doc	0x00007fff5a141740 "str(object='') -> str\nstr(bytes_or_buffer[, encoding[, errors]]) -> str\n\nCreate a new string object from the given object. If encoding or\nerrors is specified, then the object must expose a data buffer...	const char *
		tp_traverse	0x0000000000000000	int(*)(_object *, int(*)(_object *, void *), void *)
		tp_clear	0x0000000000000000	int(*)(_object *)
		tp_richcompare	0x00007fff59e828a0 {python39.dll!PyUnicode_RichCompare(_object *, _object *, int)}	_object *(*)(_object *, _object *, int)
		tp_weaklistoffset	0	__int64
		tp_iter	0x00007fff59ea7618 {python39.dll!unicode_iter(_object *)}	_object *(*)(_object *)
		tp_iternext	0x0000000000000000	_object *(*)(_object *)
+		tp_methods	0x00007fff5a20fb70 {python39.dll!PyMethodDef unicode_methods[51]} {ml_name=0x00007fff5a039c58 "encode" ...}	PyMethodDef *
+		tp_members	0x0000000000000000 <NULL>	PyMemberDef *
+		tp_getset	0x0000000000000000 <NULL>	PyGetSetDef *
+		tp_base	0x00007fff5a1e7e00 {python39.dll!_typeobject PyBaseObject_Type} {ob_base={ob_base={ob_refcnt=10617 ob_type=...} ...} ...}	_typeobject *
+		tp_dict	0x000001fbb3b19a40 {ob_refcnt=1 ob_type=0x00007fff5a1db8b0 {python39.dll!_typeobject PyDict_Type} {ob_base=...} }	_object *
		tp_descr_get	0x0000000000000000	_object *(*)(_object *, _object *, _object *)
		tp_descr_set	0x0000000000000000	int(*)(_object *, _object *, _object *)
		tp_dictoffset	0	__int64
		tp_init	0x00007fff59e26378 {python39.dll!object_init(_object *, _object *, _object *)}	int(*)(_object *, _object *, _object *)
		tp_alloc	0x00007fff59e98130 {python39.dll!PyType_GenericAlloc(_typeobject *, __int64)}	_object *(*)(_typeobject *, __int64)
		tp_new	0x00007fff59e263d8 {python39.dll!unicode_new(_typeobject *, _object *, _object *)}	_object *(*)(_typeobject *, _object *, _object *)
		tp_free	0x00007fff59e50cd0 {python39.dll!PyObject_Free(void *)}	void(*)(void *)
		tp_is_gc	0x0000000000000000	int(*)(_object *)
+		tp_bases	0x000001fbb3b04610 {ob_refcnt=1 ob_type=0x00007fff5a1e7920 {python39.dll!_typeobject PyTuple_Type} {...} }	_object *
+		tp_mro	0x000001fbb3b19cc0 {ob_refcnt=1 ob_type=0x00007fff5a1e7920 {python39.dll!_typeobject PyTuple_Type} {...} }	_object *
+		tp_cache	0x0000000000000000 <NULL>	_object *
+		tp_subclasses	0x000001fbb94c5f00 {ob_refcnt=1 ob_type=0x00007fff5a1db8b0 {python39.dll!_typeobject PyDict_Type} {ob_base=...} }	_object *
+		tp_weaklist	0x000001fbb3b1fe50 {ob_refcnt=1 ob_type=0x00007fff5a1e8620 {python39.dll!_typeobject _PyWeakref_RefType} {...} }	_object *
		tp_del	0x0000000000000000	void(*)(_object *)
		tp_version_tag	4	unsigned int
		tp_finalize	0x0000000000000000	void(*)(_object *)
		tp_vectorcall	0x0000000000000000	_object *(*)(_object *, _object * const *, unsigned __int64, _object *)
-		m_weakreflist	0x0000000000000000 <NULL>	_object *
		ob_refcnt	<Unable to read memory>	
		ob_type	<Unable to read memory>	
		vectorcall	0x0000000000000000	_object *(*)(_object *, _object * const *, unsigned __int64, _object *)

[cgohlke]

I tracked this to an import of the numba-0.50.1 package during the numpy tests. python -c"import numba' is enough to reproduce this crash during interpreter exit. Probably the package needs to be ported to Python 3.9.

[cgohlke]

This issue seems specific to C extensions built with pybind11 (using 2.5.0 and master branch). Building the minimal example at https://github.com/pybind/python_example and running python.exe -c"import python_example" will crash at exit.