Segmentation fault in 3.11.4, 3.12.0b3; _PyInterpreterFrame ownership issue

[andersk]

Crash report

This test case (minimized from a crash in the Zulip test suite) causes a segmentation fault in Python 3.11.4 and 3.12.0b3.

https://github.com/andersk/python-segfault

$ git clone https://github.com/andersk/python-segfault.git
$ cd python-segfault
$ pip install -r requirements.txt
…
Successfully installed Django-4.2.2 asgiref-3.7.2 coverage-7.2.7 sqlparse-0.4.4
$ python -m django migrate --settings=myapp.settings
…
$ python -m coverage run --timid -m django test --settings=myapp.settings
Found 1 test(s).
System check identified no issues (0 silenced).
150
151
…
199
200
Fatal Python error: Segmentation fault

Based on the tracebacks below, this looks like a _PyInterpreterFrame ownership issue similar to #99729 and #100126. The crash is here:

cpython/Objects/frameobject.c

Line 854 in 1bbf60d

assert(f->f_frame->owner != FRAME_OWNED_BY_GENERATOR ||

where the _PyInterpreterFrame at *f->f_frame has already been freed.

Error messages

Full output with Python traceback

$ python -m coverage run --timid -m django test --settings=myapp.settings
Found 1 test(s).
System check identified no issues (0 silenced).
150
151
…
199
200
Fatal Python error: Segmentation fault

Current thread 0x00007f4abeab1740 (most recent call first):
 Garbage-collecting
 File "/home/anders/zulip/test/python-segfault/venv/lib/python3.11/site-packages/django/utils/functional.py", line 295 in __getattribute__
 File "/home/anders/zulip/test/python-segfault/venv/lib/python3.11/site-packages/django/db/models/fields/__init__.py", line 1587 in get_prep_value
 File "/home/anders/zulip/test/python-segfault/venv/lib/python3.11/site-packages/django/db/models/lookups.py", line 85 in get_prep_lookup
 File "/home/anders/zulip/test/python-segfault/venv/lib/python3.11/site-packages/django/db/models/lookups.py", line 27 in __init__
 File "/home/anders/zulip/test/python-segfault/venv/lib/python3.11/site-packages/django/db/models/sql/query.py", line 1307 in build_lookup
 File "/home/anders/zulip/test/python-segfault/venv/lib/python3.11/site-packages/django/db/models/sql/query.py", line 1480 in build_filter
 File "/home/anders/zulip/test/python-segfault/venv/lib/python3.11/site-packages/django/db/models/sql/query.py", line 1565 in _add_q
 File "/home/anders/zulip/test/python-segfault/venv/lib/python3.11/site-packages/django/db/models/sql/query.py", line 1534 in add_q
 File "/home/anders/zulip/test/python-segfault/venv/lib/python3.11/site-packages/django/db/models/query.py", line 1461 in _filter_or_exclude_inplace
 File "/home/anders/zulip/test/python-segfault/venv/lib/python3.11/site-packages/django/db/models/query.py", line 1454 in _filter_or_exclude
 File "/home/anders/zulip/test/python-segfault/venv/lib/python3.11/site-packages/django/db/models/query.py", line 1436 in filter
 File "/home/anders/zulip/test/python-segfault/venv/lib/python3.11/site-packages/django/db/models/query.py", line 623 in get
 File "/home/anders/zulip/test/python-segfault/venv/lib/python3.11/site-packages/django/db/models/manager.py", line 87 in manager_method
 File "/home/anders/zulip/test/python-segfault/venv/lib/python3.11/site-packages/django/contrib/sessions/backends/db.py", line 32 in _get_session_from_db
 File "/home/anders/zulip/test/python-segfault/venv/lib/python3.11/site-packages/django/contrib/sessions/backends/db.py", line 42 in load
 File "/home/anders/zulip/test/python-segfault/venv/lib/python3.11/site-packages/django/contrib/sessions/backends/base.py", line 192 in _get_session
 File "/home/anders/zulip/test/python-segfault/venv/lib/python3.11/site-packages/django/contrib/sessions/backends/base.py", line 53 in __getitem__
 File "/home/anders/zulip/test/python-segfault/venv/lib/python3.11/site-packages/django/contrib/auth/__init__.py", line 60 in _get_user_session_key
 File "/home/anders/zulip/test/python-segfault/venv/lib/python3.11/site-packages/django/contrib/auth/__init__.py", line 191 in get_user
 File "/home/anders/zulip/test/python-segfault/venv/lib/python3.11/site-packages/django/contrib/auth/middleware.py", line 11 in get_user
 File "/home/anders/zulip/test/python-segfault/venv/lib/python3.11/site-packages/django/contrib/auth/middleware.py", line 25 in <lambda>
 File "/home/anders/zulip/test/python-segfault/venv/lib/python3.11/site-packages/django/utils/functional.py", line 419 in _setup
 File "/home/anders/zulip/test/python-segfault/venv/lib/python3.11/site-packages/django/utils/functional.py", line 266 in inner
 File "/home/anders/zulip/test/python-segfault/myapp/urls.py", line 21 in foo
 File "/home/anders/zulip/test/python-segfault/myapp/urls.py", line 8 in <lambda>
 File "/home/anders/zulip/test/python-segfault/myapp/urls.py", line 8 in <lambda>
 File "/home/anders/zulip/test/python-segfault/myapp/urls.py", line 34 in me
 File "/home/anders/zulip/test/python-segfault/venv/lib/python3.11/site-packages/django/utils/decorators.py", line 134 in _wrapper_view
 File "/home/anders/zulip/test/python-segfault/myapp/urls.py", line 8 in <lambda>
 File "/home/anders/zulip/test/python-segfault/myapp/urls.py", line 8 in <lambda>
 File "/home/anders/zulip/test/python-segfault/myapp/urls.py", line 8 in <lambda>
 File "/home/anders/zulip/test/python-segfault/myapp/urls.py", line 8 in <lambda>
 File "/home/anders/zulip/test/python-segfault/venv/lib/python3.11/site-packages/django/core/handlers/base.py", line 197 in _get_response
 File "/home/anders/zulip/test/python-segfault/venv/lib/python3.11/site-packages/django/core/handlers/exception.py", line 55 in inner
 File "/home/anders/zulip/test/python-segfault/venv/lib/python3.11/site-packages/django/utils/deprecation.py", line 134 in __call__
 File "/home/anders/zulip/test/python-segfault/venv/lib/python3.11/site-packages/django/core/handlers/exception.py", line 55 in inner
 File "/home/anders/zulip/test/python-segfault/venv/lib/python3.11/site-packages/django/utils/deprecation.py", line 134 in __call__
 File "/home/anders/zulip/test/python-segfault/venv/lib/python3.11/site-packages/django/core/handlers/exception.py", line 55 in inner
 File "/home/anders/zulip/test/python-segfault/venv/lib/python3.11/site-packages/django/utils/deprecation.py", line 134 in __call__
 File "/home/anders/zulip/test/python-segfault/venv/lib/python3.11/site-packages/django/core/handlers/exception.py", line 55 in inner
 File "/home/anders/zulip/test/python-segfault/venv/lib/python3.11/site-packages/django/utils/deprecation.py", line 134 in __call__
 File "/home/anders/zulip/test/python-segfault/venv/lib/python3.11/site-packages/django/core/handlers/exception.py", line 55 in inner
 File "/home/anders/zulip/test/python-segfault/venv/lib/python3.11/site-packages/django/utils/deprecation.py", line 134 in __call__
 File "/home/anders/zulip/test/python-segfault/venv/lib/python3.11/site-packages/django/core/handlers/exception.py", line 55 in inner
 File "/home/anders/zulip/test/python-segfault/venv/lib/python3.11/site-packages/django/utils/deprecation.py", line 134 in __call__
 File "/home/anders/zulip/test/python-segfault/venv/lib/python3.11/site-packages/django/core/handlers/exception.py", line 55 in inner
 File "/home/anders/zulip/test/python-segfault/venv/lib/python3.11/site-packages/django/utils/deprecation.py", line 134 in __call__
 File "/home/anders/zulip/test/python-segfault/venv/lib/python3.11/site-packages/django/core/handlers/exception.py", line 55 in inner
 File "/home/anders/zulip/test/python-segfault/venv/lib/python3.11/site-packages/django/utils/deprecation.py", line 134 in __call__
 File "/home/anders/zulip/test/python-segfault/venv/lib/python3.11/site-packages/django/core/handlers/exception.py", line 55 in inner
 File "/home/anders/zulip/test/python-segfault/venv/lib/python3.11/site-packages/django/utils/deprecation.py", line 134 in __call__
 File "/home/anders/zulip/test/python-segfault/venv/lib/python3.11/site-packages/django/core/handlers/exception.py", line 55 in inner
 File "/home/anders/zulip/test/python-segfault/venv/lib/python3.11/site-packages/django/utils/deprecation.py", line 134 in __call__
 File "/home/anders/zulip/test/python-segfault/venv/lib/python3.11/site-packages/django/core/handlers/exception.py", line 55 in inner
 File "/home/anders/zulip/test/python-segfault/venv/lib/python3.11/site-packages/django/utils/deprecation.py", line 134 in __call__
 File "/home/anders/zulip/test/python-segfault/venv/lib/python3.11/site-packages/django/core/handlers/exception.py", line 55 in inner
 File "/home/anders/zulip/test/python-segfault/venv/lib/python3.11/site-packages/django/utils/deprecation.py", line 134 in __call__
 File "/home/anders/zulip/test/python-segfault/venv/lib/python3.11/site-packages/django/core/handlers/exception.py", line 55 in inner
 File "/home/anders/zulip/test/python-segfault/venv/lib/python3.11/site-packages/django/utils/deprecation.py", line 134 in __call__
 File "/home/anders/zulip/test/python-segfault/venv/lib/python3.11/site-packages/django/core/handlers/exception.py", line 55 in inner
 File "/home/anders/zulip/test/python-segfault/venv/lib/python3.11/site-packages/django/utils/deprecation.py", line 134 in __call__
 File "/home/anders/zulip/test/python-segfault/venv/lib/python3.11/site-packages/django/core/handlers/exception.py", line 55 in inner
 File "/home/anders/zulip/test/python-segfault/venv/lib/python3.11/site-packages/django/utils/deprecation.py", line 134 in __call__
 File "/home/anders/zulip/test/python-segfault/venv/lib/python3.11/site-packages/django/core/handlers/exception.py", line 55 in inner
 File "/home/anders/zulip/test/python-segfault/venv/lib/python3.11/site-packages/django/utils/deprecation.py", line 134 in __call__
 File "/home/anders/zulip/test/python-segfault/venv/lib/python3.11/site-packages/django/core/handlers/exception.py", line 55 in inner
 File "/home/anders/zulip/test/python-segfault/venv/lib/python3.11/site-packages/django/utils/deprecation.py", line 134 in __call__
 File "/home/anders/zulip/test/python-segfault/venv/lib/python3.11/site-packages/django/core/handlers/exception.py", line 55 in inner
 File "/home/anders/zulip/test/python-segfault/venv/lib/python3.11/site-packages/django/core/handlers/base.py", line 140 in get_response
 File "/home/anders/zulip/test/python-segfault/venv/lib/python3.11/site-packages/django/test/client.py", line 176 in __call__
 File "/home/anders/zulip/test/python-segfault/venv/lib/python3.11/site-packages/django/test/client.py", line 886 in request
 File "/home/anders/zulip/test/python-segfault/venv/lib/python3.11/site-packages/django/test/client.py", line 609 in generic
 File "/home/anders/zulip/test/python-segfault/venv/lib/python3.11/site-packages/django/test/client.py", line 482 in post
 File "/home/anders/zulip/test/python-segfault/venv/lib/python3.11/site-packages/django/test/client.py", line 948 in post
 File "/home/anders/zulip/test/python-segfault/myapp/test_me.py", line 35 in test_me
 File "/home/anders/zulip/test/python-segfault/myapp/test_me.py", line 10 in <lambda>
 File "/home/anders/zulip/test/python-segfault/myapp/test_me.py", line 10 in <lambda>
 File "/home/anders/zulip/test/python-segfault/myapp/test_me.py", line 10 in <lambda>
 File "/home/anders/zulip/test/python-segfault/myapp/test_me.py", line 10 in <lambda>
 File "/home/anders/zulip/test/python-segfault/myapp/test_me.py", line 10 in <lambda>
 File "/home/anders/zulip/test/python-segfault/myapp/test_me.py", line 10 in <lambda>
 File "/home/anders/zulip/test/python-segfault/myapp/test_me.py", line 10 in <lambda>
 File "/home/anders/zulip/test/python-segfault/myapp/test_me.py", line 10 in <lambda>
 File "/home/anders/zulip/test/python-segfault/myapp/test_me.py", line 10 in <lambda>
 File "/nix/store/cxsw4x1189ppmsydhwsmssr0x65nygj7-python3-3.11.4/lib/python3.11/unittest/case.py", line 579 in _callTestMethod
 File "/nix/store/cxsw4x1189ppmsydhwsmssr0x65nygj7-python3-3.11.4/lib/python3.11/unittest/case.py", line 623 in run
 File "/nix/store/cxsw4x1189ppmsydhwsmssr0x65nygj7-python3-3.11.4/lib/python3.11/unittest/case.py", line 678 in __call__
 File "/nix/store/cxsw4x1189ppmsydhwsmssr0x65nygj7-python3-3.11.4/lib/python3.11/unittest/suite.py", line 122 in run
 File "/nix/store/cxsw4x1189ppmsydhwsmssr0x65nygj7-python3-3.11.4/lib/python3.11/unittest/suite.py", line 84 in __call__
 File "/nix/store/cxsw4x1189ppmsydhwsmssr0x65nygj7-python3-3.11.4/lib/python3.11/unittest/runner.py", line 217 in run
 File "/home/anders/zulip/test/python-segfault/venv/lib/python3.11/site-packages/django/test/runner.py", line 983 in run_suite
 File "/home/anders/zulip/test/python-segfault/venv/lib/python3.11/site-packages/django/test/runner.py", line 1061 in run_tests
 File "/home/anders/zulip/test/python-segfault/venv/lib/python3.11/site-packages/django/core/management/commands/test.py", line 68 in handle
 File "/home/anders/zulip/test/python-segfault/venv/lib/python3.11/site-packages/django/core/management/base.py", line 458 in execute
 File "/home/anders/zulip/test/python-segfault/venv/lib/python3.11/site-packages/django/core/management/base.py", line 412 in run_from_argv
 File "/home/anders/zulip/test/python-segfault/venv/lib/python3.11/site-packages/django/core/management/commands/test.py", line 24 in run_from_argv
 File "/home/anders/zulip/test/python-segfault/venv/lib/python3.11/site-packages/django/core/management/__init__.py", line 436 in execute
 File "/home/anders/zulip/test/python-segfault/venv/lib/python3.11/site-packages/django/core/management/__init__.py", line 442 in execute_from_command_line
 File "/home/anders/zulip/test/python-segfault/venv/lib/python3.11/site-packages/django/__main__.py", line 9 in <module>
 File "/home/anders/zulip/test/python-segfault/venv/lib/python3.11/site-packages/coverage/execfile.py", line 211 in run
 ...
Segmentation fault (core dumped)

AddressSanitizer traceback

This is from the current 3.11 branch, commit 1bbf60d.

$ python -m coverage run --timid -m django test --settings=myapp.settings
/home/vagrant/python-segfault/venv/lib/python3.11/site-packages/django/conf/__init__.py:241: RemovedInDjango50Warning: The default value of USE_TZ will change from False to True in Django 5.0. Set USE_TZ to False in your project settings if you want to keep the current default behavior.
 warnings.warn(
Found 1 test(s).
System check identified no issues (0 silenced).
150
151
…
199
200
=================================================================
==4327==ERROR: AddressSanitizer: heap-use-after-free on address 0x62900558c25d at pc 0x55fd433dca1a bp 0x7fff5dc37490 sp 0x7fff5dc37488
READ of size 1 at 0x62900558c25d thread T0
 #0 0x55fd433dca19 in frame_dealloc /srv/zulip/anders/cpython/Objects/frameobject.c:854:5
 #1 0x55fd434fcfd9 in _PyTrash_thread_destroy_chain /srv/zulip/anders/cpython/Objects/object.c:2276:9
 #2 0x55fd434fcfd9 in _PyTrash_end /srv/zulip/anders/cpython/Objects/object.c:2302:9
 #3 0x55fd43a02ece in tb_dealloc /srv/zulip/anders/cpython/Python/traceback.c:176:5
 #4 0x55fd434fd7de in _Py_Dealloc /srv/zulip/anders/cpython/Objects/object.c:2390:5
 #5 0x55fd43385e52 in Py_DECREF /srv/zulip/anders/cpython/./Include/object.h:527:9
 #6 0x55fd4338f02e in BaseException_clear /srv/zulip/anders/cpython/Objects/exceptions.c:88:5
 #7 0x55fd43582b66 in subtype_clear /srv/zulip/anders/cpython/Objects/typeobject.c:1297:16
 #8 0x55fd43a48c0f in delete_garbage /srv/zulip/anders/cpython/Modules/gcmodule.c:1013:24
 #9 0x55fd43a48c0f in gc_collect_main /srv/zulip/anders/cpython/Modules/gcmodule.c:1287:5
 #10 0x55fd43a45b8f in gc_collect_with_callback /srv/zulip/anders/cpython/Modules/gcmodule.c:1400:14
 #11 0x55fd43a4ce31 in gc_collect_generations /srv/zulip/anders/cpython/Modules/gcmodule.c:1455:17
 #12 0x55fd43a4ce31 in _PyObject_GC_Link /srv/zulip/anders/cpython/Modules/gcmodule.c:2270:9
 #13 0x55fd43a4d79d in gc_alloc /srv/zulip/anders/cpython/Modules/gcmodule.c:2290:5
 #14 0x55fd43a4d615 in _PyObject_GC_New /srv/zulip/anders/cpython/Modules/gcmodule.c:2298:20
 #15 0x55fd433750e3 in PyWrapper_New /srv/zulip/anders/cpython/Objects/descrobject.c:1460:10
 #16 0x55fd43371a6c in wrapperdescr_get /srv/zulip/anders/cpython/Objects/descrobject.c:220:12
 #17 0x55fd43564a44 in super_getattro /srv/zulip/anders/cpython/Objects/typeobject.c:8869:24
 #18 0x55fd434f511c in PyObject_GetAttr /srv/zulip/anders/cpython/Objects/object.c:916:18
 #19 0x55fd434f8901 in _PyObject_GetMethod /srv/zulip/anders/cpython/Objects/object.c:1164:19
 #20 0x55fd437db452 in _PyEval_EvalFrameDefault /srv/zulip/anders/cpython/Python/ceval.c:4492:30
 #21 0x55fd437b8af6 in _PyEval_EvalFrame /srv/zulip/anders/cpython/./Include/internal/pycore_ceval.h:73:16
 #22 0x55fd437b83f1 in _PyEval_Vector /srv/zulip/anders/cpython/Python/ceval.c:6439:24
 #23 0x55fd433379fb in _PyFunction_Vectorcall /srv/zulip/anders/cpython/Objects/call.c
 #24 0x55fd43342c6e in _PyObject_VectorcallTstate /srv/zulip/anders/cpython/./Include/internal/pycore_call.h:92:11
 #25 0x55fd4333f514 in method_vectorcall /srv/zulip/anders/cpython/Objects/classobject.c:59:18
 #26 0x55fd433377d4 in _PyObject_VectorcallTstate /srv/zulip/anders/cpython/./Include/internal/pycore_call.h:92:11
 #27 0x55fd433377d4 in PyObject_CallOneArg /srv/zulip/anders/cpython/Objects/call.c:376:12
 #28 0x55fd435c571a in call_attribute /srv/zulip/anders/cpython/Objects/typeobject.c:7673:11
 #29 0x55fd435ad736 in slot_tp_getattr_hook /srv/zulip/anders/cpython/Objects/typeobject.c:7709:15
 #30 0x55fd434f511c in PyObject_GetAttr /srv/zulip/anders/cpython/Objects/object.c:916:18
 #31 0x55fd437dae27 in _PyEval_EvalFrameDefault /srv/zulip/anders/cpython/Python/ceval.c:3466:29
 #32 0x55fd437b8af6 in _PyEval_EvalFrame /srv/zulip/anders/cpython/./Include/internal/pycore_ceval.h:73:16
 #33 0x55fd437b83f1 in _PyEval_Vector /srv/zulip/anders/cpython/Python/ceval.c:6439:24
 #34 0x55fd433379fb in _PyFunction_Vectorcall /srv/zulip/anders/cpython/Objects/call.c
 #35 0x55fd43333966 in _PyObject_FastCallDictTstate /srv/zulip/anders/cpython/Objects/call.c:141:15
 #36 0x55fd43338483 in _PyObject_Call_Prepend /srv/zulip/anders/cpython/Objects/call.c:482:24
 #37 0x55fd435afad0 in slot_tp_init /srv/zulip/anders/cpython/Objects/typeobject.c:7863:15
 #38 0x55fd4355cce0 in type_call /srv/zulip/anders/cpython/Objects/typeobject.c:1112:19
 #39 0x55fd43334063 in _PyObject_MakeTpCall /srv/zulip/anders/cpython/Objects/call.c:214:18
 #40 0x55fd43336d3a in _PyObject_VectorcallTstate /srv/zulip/anders/cpython/./Include/internal/pycore_call.h:90:16
 #41 0x55fd43336c2e in PyObject_Vectorcall /srv/zulip/anders/cpython/Objects/call.c:299:12
 #42 0x55fd437e1005 in _PyEval_EvalFrameDefault /srv/zulip/anders/cpython/Python/ceval.c
 #43 0x55fd437b8af6 in _PyEval_EvalFrame /srv/zulip/anders/cpython/./Include/internal/pycore_ceval.h:73:16
 #44 0x55fd437b83f1 in _PyEval_Vector /srv/zulip/anders/cpython/Python/ceval.c:6439:24
 #45 0x55fd433379fb in _PyFunction_Vectorcall /srv/zulip/anders/cpython/Objects/call.c
 #46 0x55fd43342c6e in _PyObject_VectorcallTstate /srv/zulip/anders/cpython/./Include/internal/pycore_call.h:92:11
 #47 0x55fd4333f514 in method_vectorcall /srv/zulip/anders/cpython/Objects/classobject.c:59:18
 #48 0x55fd43336802 in _PyVectorcall_Call /srv/zulip/anders/cpython/Objects/call.c:257:24
 #49 0x55fd433370b5 in _PyObject_Call /srv/zulip/anders/cpython/Objects/call.c:328:16
 #50 0x55fd4333765b in PyObject_Call /srv/zulip/anders/cpython/Objects/call.c:355:12
 #51 0x55fd437e68c3 in do_call_core /srv/zulip/anders/cpython/Python/ceval.c
 #52 0x55fd437e68c3 in _PyEval_EvalFrameDefault /srv/zulip/anders/cpython/Python/ceval.c:5381:22
 #53 0x55fd437b8af6 in _PyEval_EvalFrame /srv/zulip/anders/cpython/./Include/internal/pycore_ceval.h:73:16
 #54 0x55fd437b83f1 in _PyEval_Vector /srv/zulip/anders/cpython/Python/ceval.c:6439:24
 #55 0x55fd433379fb in _PyFunction_Vectorcall /srv/zulip/anders/cpython/Objects/call.c
 #56 0x55fd43342c6e in _PyObject_VectorcallTstate /srv/zulip/anders/cpython/./Include/internal/pycore_call.h:92:11
 #57 0x55fd4333f514 in method_vectorcall /srv/zulip/anders/cpython/Objects/classobject.c:59:18
 #58 0x55fd43336802 in _PyVectorcall_Call /srv/zulip/anders/cpython/Objects/call.c:257:24
 #59 0x55fd433370b5 in _PyObject_Call /srv/zulip/anders/cpython/Objects/call.c:328:16
 #60 0x55fd4333765b in PyObject_Call /srv/zulip/anders/cpython/Objects/call.c:355:12
 #61 0x55fd437e68c3 in do_call_core /srv/zulip/anders/cpython/Python/ceval.c
 #62 0x55fd437e68c3 in _PyEval_EvalFrameDefault /srv/zulip/anders/cpython/Python/ceval.c:5381:22
 #63 0x55fd437b8af6 in _PyEval_EvalFrame /srv/zulip/anders/cpython/./Include/internal/pycore_ceval.h:73:16
 #64 0x55fd437b83f1 in _PyEval_Vector /srv/zulip/anders/cpython/Python/ceval.c:6439:24
 #65 0x55fd433379fb in _PyFunction_Vectorcall /srv/zulip/anders/cpython/Objects/call.c
 #66 0x55fd433377d4 in _PyObject_VectorcallTstate /srv/zulip/anders/cpython/./Include/internal/pycore_call.h:92:11
 #67 0x55fd433377d4 in PyObject_CallOneArg /srv/zulip/anders/cpython/Objects/call.c:376:12
 #68 0x55fd433768f5 in property_descr_get /srv/zulip/anders/cpython/Objects/descrobject.c:1630:12
 #69 0x55fd434f6db1 in _PyObject_GenericGetAttrWithDict /srv/zulip/anders/cpython/Objects/object.c:1278:19
 #70 0x55fd434f6a3c in PyObject_GenericGetAttr /srv/zulip/anders/cpython/Objects/object.c:1368:12
 #71 0x55fd434f511c in PyObject_GetAttr /srv/zulip/anders/cpython/Objects/object.c:916:18
 #72 0x55fd437dae27 in _PyEval_EvalFrameDefault /srv/zulip/anders/cpython/Python/ceval.c:3466:29
 #73 0x55fd437b8af6 in _PyEval_EvalFrame /srv/zulip/anders/cpython/./Include/internal/pycore_ceval.h:73:16
 #74 0x55fd437b83f1 in _PyEval_Vector /srv/zulip/anders/cpython/Python/ceval.c:6439:24
 #75 0x55fd433379fb in _PyFunction_Vectorcall /srv/zulip/anders/cpython/Objects/call.c
 #76 0x55fd4357a005 in _PyObject_VectorcallTstate /srv/zulip/anders/cpython/./Include/internal/pycore_call.h:92:11
 #77 0x55fd435c53ec in vectorcall_unbound /srv/zulip/anders/cpython/Objects/typeobject.c:1650:12
 #78 0x55fd435c53ec in vectorcall_method /srv/zulip/anders/cpython/Objects/typeobject.c:1681:24
 #79 0x55fd435c3663 in slot_mp_subscript /srv/zulip/anders/cpython/Objects/typeobject.c:7404:1
 #80 0x55fd432b37d7 in PyObject_GetItem /srv/zulip/anders/cpython/Objects/abstract.c:157:26
 #81 0x55fd437da9d9 in _PyEval_EvalFrameDefault /srv/zulip/anders/cpython/Python/ceval.c:2137:29
 #82 0x55fd437b8af6 in _PyEval_EvalFrame /srv/zulip/anders/cpython/./Include/internal/pycore_ceval.h:73:16
 #83 0x55fd437b83f1 in _PyEval_Vector /srv/zulip/anders/cpython/Python/ceval.c:6439:24
 #84 0x55fd433379fb in _PyFunction_Vectorcall /srv/zulip/anders/cpython/Objects/call.c
 #85 0x55fd43342c6e in _PyObject_VectorcallTstate /srv/zulip/anders/cpython/./Include/internal/pycore_call.h:92:11
 #86 0x55fd4333f514 in method_vectorcall /srv/zulip/anders/cpython/Objects/classobject.c:59:18
 #87 0x55fd433377d4 in _PyObject_VectorcallTstate /srv/zulip/anders/cpython/./Include/internal/pycore_call.h:92:11
 #88 0x55fd433377d4 in PyObject_CallOneArg /srv/zulip/anders/cpython/Objects/call.c:376:12
 #89 0x55fd435c571a in call_attribute /srv/zulip/anders/cpython/Objects/typeobject.c:7673:11
 #90 0x55fd435ad7fc in slot_tp_getattr_hook /srv/zulip/anders/cpython/Objects/typeobject.c:7714:15
 #91 0x55fd434f511c in PyObject_GetAttr /srv/zulip/anders/cpython/Objects/object.c:916:18
 #92 0x55fd437dae27 in _PyEval_EvalFrameDefault /srv/zulip/anders/cpython/Python/ceval.c:3466:29
 #93 0x55fd437b8af6 in _PyEval_EvalFrame /srv/zulip/anders/cpython/./Include/internal/pycore_ceval.h:73:16
 #94 0x55fd437b83f1 in _PyEval_Vector /srv/zulip/anders/cpython/Python/ceval.c:6439:24
 #95 0x55fd433379fb in _PyFunction_Vectorcall /srv/zulip/anders/cpython/Objects/call.c
 #96 0x55fd433368db in _PyVectorcall_Call /srv/zulip/anders/cpython/Objects/call.c:245:16
 #97 0x55fd433370b5 in _PyObject_Call /srv/zulip/anders/cpython/Objects/call.c:328:16
 #98 0x55fd4333765b in PyObject_Call /srv/zulip/anders/cpython/Objects/call.c:355:12
 #99 0x55fd437e68c3 in do_call_core /srv/zulip/anders/cpython/Python/ceval.c
 #100 0x55fd437e68c3 in _PyEval_EvalFrameDefault /srv/zulip/anders/cpython/Python/ceval.c:5381:22
 #101 0x55fd437b8af6 in _PyEval_EvalFrame /srv/zulip/anders/cpython/./Include/internal/pycore_ceval.h:73:16
 #102 0x55fd437b83f1 in _PyEval_Vector /srv/zulip/anders/cpython/Python/ceval.c:6439:24
 #103 0x55fd433379fb in _PyFunction_Vectorcall /srv/zulip/anders/cpython/Objects/call.c
 #104 0x55fd433368db in _PyVectorcall_Call /srv/zulip/anders/cpython/Objects/call.c:245:16
 #105 0x55fd433370b5 in _PyObject_Call /srv/zulip/anders/cpython/Objects/call.c:328:16
 #106 0x55fd4333765b in PyObject_Call /srv/zulip/anders/cpython/Objects/call.c:355:12
 #107 0x55fd437e68c3 in do_call_core /srv/zulip/anders/cpython/Python/ceval.c
 #108 0x55fd437e68c3 in _PyEval_EvalFrameDefault /srv/zulip/anders/cpython/Python/ceval.c:5381:22
 #109 0x55fd437b8af6 in _PyEval_EvalFrame /srv/zulip/anders/cpython/./Include/internal/pycore_ceval.h:73:16
 #110 0x55fd437b83f1 in _PyEval_Vector /srv/zulip/anders/cpython/Python/ceval.c:6439:24
 #111 0x55fd433379fb in _PyFunction_Vectorcall /srv/zulip/anders/cpython/Objects/call.c
 #112 0x55fd433368db in _PyVectorcall_Call /srv/zulip/anders/cpython/Objects/call.c:245:16
 #113 0x55fd433370b5 in _PyObject_Call /srv/zulip/anders/cpython/Objects/call.c:328:16
 #114 0x55fd4333765b in PyObject_Call /srv/zulip/anders/cpython/Objects/call.c:355:12
 #115 0x55fd437e68c3 in do_call_core /srv/zulip/anders/cpython/Python/ceval.c
 #116 0x55fd437e68c3 in _PyEval_EvalFrameDefault /srv/zulip/anders/cpython/Python/ceval.c:5381:22
 #117 0x55fd437b8af6 in _PyEval_EvalFrame /srv/zulip/anders/cpython/./Include/internal/pycore_ceval.h:73:16
 #118 0x55fd437b83f1 in _PyEval_Vector /srv/zulip/anders/cpython/Python/ceval.c:6439:24
 #119 0x55fd433379fb in _PyFunction_Vectorcall /srv/zulip/anders/cpython/Objects/call.c
 #120 0x55fd433368db in _PyVectorcall_Call /srv/zulip/anders/cpython/Objects/call.c:245:16
 #121 0x55fd433370b5 in _PyObject_Call /srv/zulip/anders/cpython/Objects/call.c:328:16
 #122 0x55fd4333765b in PyObject_Call /srv/zulip/anders/cpython/Objects/call.c:355:12
 #123 0x55fd437e68c3 in do_call_core /srv/zulip/anders/cpython/Python/ceval.c
 #124 0x55fd437e68c3 in _PyEval_EvalFrameDefault /srv/zulip/anders/cpython/Python/ceval.c:5381:22
 #125 0x55fd437b8af6 in _PyEval_EvalFrame /srv/zulip/anders/cpython/./Include/internal/pycore_ceval.h:73:16
 #126 0x55fd437b83f1 in _PyEval_Vector /srv/zulip/anders/cpython/Python/ceval.c:6439:24
 #127 0x55fd433379fb in _PyFunction_Vectorcall /srv/zulip/anders/cpython/Objects/call.c
 #128 0x55fd433368db in _PyVectorcall_Call /srv/zulip/anders/cpython/Objects/call.c:245:16
 #129 0x55fd433370b5 in _PyObject_Call /srv/zulip/anders/cpython/Objects/call.c:328:16
 #130 0x55fd4333765b in PyObject_Call /srv/zulip/anders/cpython/Objects/call.c:355:12
 #131 0x55fd437e68c3 in do_call_core /srv/zulip/anders/cpython/Python/ceval.c
 #132 0x55fd437e68c3 in _PyEval_EvalFrameDefault /srv/zulip/anders/cpython/Python/ceval.c:5381:22
 #133 0x55fd437b8af6 in _PyEval_EvalFrame /srv/zulip/anders/cpython/./Include/internal/pycore_ceval.h:73:16
 #134 0x55fd437b83f1 in _PyEval_Vector /srv/zulip/anders/cpython/Python/ceval.c:6439:24
 #135 0x55fd433379fb in _PyFunction_Vectorcall /srv/zulip/anders/cpython/Objects/call.c
 #136 0x55fd433368db in _PyVectorcall_Call /srv/zulip/anders/cpython/Objects/call.c:245:16
 #137 0x55fd433370b5 in _PyObject_Call /srv/zulip/anders/cpython/Objects/call.c:328:16
 #138 0x55fd4333765b in PyObject_Call /srv/zulip/anders/cpython/Objects/call.c:355:12
 #139 0x55fd437e68c3 in do_call_core /srv/zulip/anders/cpython/Python/ceval.c
 #140 0x55fd437e68c3 in _PyEval_EvalFrameDefault /srv/zulip/anders/cpython/Python/ceval.c:5381:22
 #141 0x55fd437b8af6 in _PyEval_EvalFrame /srv/zulip/anders/cpython/./Include/internal/pycore_ceval.h:73:16
 #142 0x55fd437b83f1 in _PyEval_Vector /srv/zulip/anders/cpython/Python/ceval.c:6439:24
 #143 0x55fd433379fb in _PyFunction_Vectorcall /srv/zulip/anders/cpython/Objects/call.c
 #144 0x55fd433368db in _PyVectorcall_Call /srv/zulip/anders/cpython/Objects/call.c:245:16
 #145 0x55fd433370b5 in _PyObject_Call /srv/zulip/anders/cpython/Objects/call.c:328:16
 #146 0x55fd4333765b in PyObject_Call /srv/zulip/anders/cpython/Objects/call.c:355:12
 #147 0x55fd437e68c3 in do_call_core /srv/zulip/anders/cpython/Python/ceval.c
 #148 0x55fd437e68c3 in _PyEval_EvalFrameDefault /srv/zulip/anders/cpython/Python/ceval.c:5381:22
 #149 0x55fd437b8af6 in _PyEval_EvalFrame /srv/zulip/anders/cpython/./Include/internal/pycore_ceval.h:73:16
 #150 0x55fd437b83f1 in _PyEval_Vector /srv/zulip/anders/cpython/Python/ceval.c:6439:24
 #151 0x55fd433379fb in _PyFunction_Vectorcall /srv/zulip/anders/cpython/Objects/call.c
 #152 0x55fd433368db in _PyVectorcall_Call /srv/zulip/anders/cpython/Objects/call.c:245:16
 #153 0x55fd433370b5 in _PyObject_Call /srv/zulip/anders/cpython/Objects/call.c:328:16
 #154 0x55fd4333765b in PyObject_Call /srv/zulip/anders/cpython/Objects/call.c:355:12
 #155 0x55fd437e68c3 in do_call_core /srv/zulip/anders/cpython/Python/ceval.c
 #156 0x55fd437e68c3 in _PyEval_EvalFrameDefault /srv/zulip/anders/cpython/Python/ceval.c:5381:22
 #157 0x55fd437b8af6 in _PyEval_EvalFrame /srv/zulip/anders/cpython/./Include/internal/pycore_ceval.h:73:16
 #158 0x55fd437b83f1 in _PyEval_Vector /srv/zulip/anders/cpython/Python/ceval.c:6439:24
 #159 0x55fd433379fb in _PyFunction_Vectorcall /srv/zulip/anders/cpython/Objects/call.c
 #160 0x55fd43333966 in _PyObject_FastCallDictTstate /srv/zulip/anders/cpython/Objects/call.c:141:15
 #161 0x55fd43338483 in _PyObject_Call_Prepend /srv/zulip/anders/cpython/Objects/call.c:482:24
 #162 0x55fd435ad2f1 in slot_tp_call /srv/zulip/anders/cpython/Objects/typeobject.c:7632:15
 #163 0x55fd43334063 in _PyObject_MakeTpCall /srv/zulip/anders/cpython/Objects/call.c:214:18
 #164 0x55fd43336d3a in _PyObject_VectorcallTstate /srv/zulip/anders/cpython/./Include/internal/pycore_call.h:90:16
 #165 0x55fd43336c2e in PyObject_Vectorcall /srv/zulip/anders/cpython/Objects/call.c:299:12
 #166 0x55fd437e1005 in _PyEval_EvalFrameDefault /srv/zulip/anders/cpython/Python/ceval.c
 #167 0x55fd437b8af6 in _PyEval_EvalFrame /srv/zulip/anders/cpython/./Include/internal/pycore_ceval.h:73:16
 #168 0x55fd437b83f1 in _PyEval_Vector /srv/zulip/anders/cpython/Python/ceval.c:6439:24
 #169 0x55fd433379fb in _PyFunction_Vectorcall /srv/zulip/anders/cpython/Objects/call.c
 #170 0x55fd43333966 in _PyObject_FastCallDictTstate /srv/zulip/anders/cpython/Objects/call.c:141:15
 #171 0x55fd43338483 in _PyObject_Call_Prepend /srv/zulip/anders/cpython/Objects/call.c:482:24
 #172 0x55fd435ad2f1 in slot_tp_call /srv/zulip/anders/cpython/Objects/typeobject.c:7632:15
 #173 0x55fd43334063 in _PyObject_MakeTpCall /srv/zulip/anders/cpython/Objects/call.c:214:18
 #174 0x55fd43336d3a in _PyObject_VectorcallTstate /srv/zulip/anders/cpython/./Include/internal/pycore_call.h:90:16
 #175 0x55fd43336c2e in PyObject_Vectorcall /srv/zulip/anders/cpython/Objects/call.c:299:12
 #176 0x55fd437e1005 in _PyEval_EvalFrameDefault /srv/zulip/anders/cpython/Python/ceval.c
 #177 0x55fd437b8af6 in _PyEval_EvalFrame /srv/zulip/anders/cpython/./Include/internal/pycore_ceval.h:73:16
 #178 0x55fd437b83f1 in _PyEval_Vector /srv/zulip/anders/cpython/Python/ceval.c:6439:24
 #179 0x55fd433379fb in _PyFunction_Vectorcall /srv/zulip/anders/cpython/Objects/call.c
 #180 0x55fd43333966 in _PyObject_FastCallDictTstate /srv/zulip/anders/cpython/Objects/call.c:141:15
 #181 0x55fd43338483 in _PyObject_Call_Prepend /srv/zulip/anders/cpython/Objects/call.c:482:24
 #182 0x55fd435ad2f1 in slot_tp_call /srv/zulip/anders/cpython/Objects/typeobject.c:7632:15
 #183 0x55fd43334063 in _PyObject_MakeTpCall /srv/zulip/anders/cpython/Objects/call.c:214:18
 #184 0x55fd43336d3a in _PyObject_VectorcallTstate /srv/zulip/anders/cpython/./Include/internal/pycore_call.h:90:16
 #185 0x55fd43336c2e in PyObject_Vectorcall /srv/zulip/anders/cpython/Objects/call.c:299:12
 #186 0x55fd437e1005 in _PyEval_EvalFrameDefault /srv/zulip/anders/cpython/Python/ceval.c
 #187 0x55fd437b8af6 in _PyEval_EvalFrame /srv/zulip/anders/cpython/./Include/internal/pycore_ceval.h:73:16
 #188 0x55fd437b83f1 in _PyEval_Vector /srv/zulip/anders/cpython/Python/ceval.c:6439:24
 #189 0x55fd433379fb in _PyFunction_Vectorcall /srv/zulip/anders/cpython/Objects/call.c
 #190 0x55fd43333966 in _PyObject_FastCallDictTstate /srv/zulip/anders/cpython/Objects/call.c:141:15
 #191 0x55fd43338483 in _PyObject_Call_Prepend /srv/zulip/anders/cpython/Objects/call.c:482:24
 #192 0x55fd435ad2f1 in slot_tp_call /srv/zulip/anders/cpython/Objects/typeobject.c:7632:15
 #193 0x55fd43334063 in _PyObject_MakeTpCall /srv/zulip/anders/cpython/Objects/call.c:214:18
 #194 0x55fd43336d3a in _PyObject_VectorcallTstate /srv/zulip/anders/cpython/./Include/internal/pycore_call.h:90:16
 #195 0x55fd43336c2e in PyObject_Vectorcall /srv/zulip/anders/cpython/Objects/call.c:299:12
 #196 0x55fd437e1005 in _PyEval_EvalFrameDefault /srv/zulip/anders/cpython/Python/ceval.c
 #197 0x55fd437b8af6 in _PyEval_EvalFrame /srv/zulip/anders/cpython/./Include/internal/pycore_ceval.h:73:16
 #198 0x55fd437b83f1 in _PyEval_Vector /srv/zulip/anders/cpython/Python/ceval.c:6439:24
 #199 0x55fd433379fb in _PyFunction_Vectorcall /srv/zulip/anders/cpython/Objects/call.c
 #200 0x55fd43333966 in _PyObject_FastCallDictTstate /srv/zulip/anders/cpython/Objects/call.c:141:15
 #201 0x55fd43338483 in _PyObject_Call_Prepend /srv/zulip/anders/cpython/Objects/call.c:482:24
 #202 0x55fd435ad2f1 in slot_tp_call /srv/zulip/anders/cpython/Objects/typeobject.c:7632:15
 #203 0x55fd43334063 in _PyObject_MakeTpCall /srv/zulip/anders/cpython/Objects/call.c:214:18
 #204 0x55fd43336d3a in _PyObject_VectorcallTstate /srv/zulip/anders/cpython/./Include/internal/pycore_call.h:90:16
 #205 0x55fd43336c2e in PyObject_Vectorcall /srv/zulip/anders/cpython/Objects/call.c:299:12
 #206 0x55fd437e1005 in _PyEval_EvalFrameDefault /srv/zulip/anders/cpython/Python/ceval.c
 #207 0x55fd437b8af6 in _PyEval_EvalFrame /srv/zulip/anders/cpython/./Include/internal/pycore_ceval.h:73:16
 #208 0x55fd437b83f1 in _PyEval_Vector /srv/zulip/anders/cpython/Python/ceval.c:6439:24
 #209 0x55fd433379fb in _PyFunction_Vectorcall /srv/zulip/anders/cpython/Objects/call.c
 #210 0x55fd43333966 in _PyObject_FastCallDictTstate /srv/zulip/anders/cpython/Objects/call.c:141:15
 #211 0x55fd43338483 in _PyObject_Call_Prepend /srv/zulip/anders/cpython/Objects/call.c:482:24
 #212 0x55fd435ad2f1 in slot_tp_call /srv/zulip/anders/cpython/Objects/typeobject.c:7632:15
 #213 0x55fd43334063 in _PyObject_MakeTpCall /srv/zulip/anders/cpython/Objects/call.c:214:18
 #214 0x55fd43336d3a in _PyObject_VectorcallTstate /srv/zulip/anders/cpython/./Include/internal/pycore_call.h:90:16
 #215 0x55fd43336c2e in PyObject_Vectorcall /srv/zulip/anders/cpython/Objects/call.c:299:12
 #216 0x55fd437e1005 in _PyEval_EvalFrameDefault /srv/zulip/anders/cpython/Python/ceval.c
 #217 0x55fd437b8af6 in _PyEval_EvalFrame /srv/zulip/anders/cpython/./Include/internal/pycore_ceval.h:73:16
 #218 0x55fd437b83f1 in _PyEval_Vector /srv/zulip/anders/cpython/Python/ceval.c:6439:24
 #219 0x55fd433379fb in _PyFunction_Vectorcall /srv/zulip/anders/cpython/Objects/call.c
 #220 0x55fd43333966 in _PyObject_FastCallDictTstate /srv/zulip/anders/cpython/Objects/call.c:141:15
 #221 0x55fd43338483 in _PyObject_Call_Prepend /srv/zulip/anders/cpython/Objects/call.c:482:24
 #222 0x55fd435ad2f1 in slot_tp_call /srv/zulip/anders/cpython/Objects/typeobject.c:7632:15
 #223 0x55fd43334063 in _PyObject_MakeTpCall /srv/zulip/anders/cpython/Objects/call.c:214:18
 #224 0x55fd43336d3a in _PyObject_VectorcallTstate /srv/zulip/anders/cpython/./Include/internal/pycore_call.h:90:16
 #225 0x55fd43336c2e in PyObject_Vectorcall /srv/zulip/anders/cpython/Objects/call.c:299:12
 #226 0x55fd437e1005 in _PyEval_EvalFrameDefault /srv/zulip/anders/cpython/Python/ceval.c
 #227 0x55fd437b8af6 in _PyEval_EvalFrame /srv/zulip/anders/cpython/./Include/internal/pycore_ceval.h:73:16
 #228 0x55fd437b83f1 in _PyEval_Vector /srv/zulip/anders/cpython/Python/ceval.c:6439:24
 #229 0x55fd433379fb in _PyFunction_Vectorcall /srv/zulip/anders/cpython/Objects/call.c
 #230 0x55fd43333966 in _PyObject_FastCallDictTstate /srv/zulip/anders/cpython/Objects/call.c:141:15
 #231 0x55fd43338483 in _PyObject_Call_Prepend /srv/zulip/anders/cpython/Objects/call.c:482:24
 #232 0x55fd435ad2f1 in slot_tp_call /srv/zulip/anders/cpython/Objects/typeobject.c:7632:15
 #233 0x55fd43334063 in _PyObject_MakeTpCall /srv/zulip/anders/cpython/Objects/call.c:214:18
 #234 0x55fd43336d3a in _PyObject_VectorcallTstate /srv/zulip/anders/cpython/./Include/internal/pycore_call.h:90:16
 #235 0x55fd43336c2e in PyObject_Vectorcall /srv/zulip/anders/cpython/Objects/call.c:299:12
 #236 0x55fd437e1005 in _PyEval_EvalFrameDefault /srv/zulip/anders/cpython/Python/ceval.c
 #237 0x55fd437b8af6 in _PyEval_EvalFrame /srv/zulip/anders/cpython/./Include/internal/pycore_ceval.h:73:16
 #238 0x55fd437b83f1 in _PyEval_Vector /srv/zulip/anders/cpython/Python/ceval.c:6439:24
 #239 0x55fd433379fb in _PyFunction_Vectorcall /srv/zulip/anders/cpython/Objects/call.c
 #240 0x55fd43333966 in _PyObject_FastCallDictTstate /srv/zulip/anders/cpython/Objects/call.c:141:15
 #241 0x55fd43338483 in _PyObject_Call_Prepend /srv/zulip/anders/cpython/Objects/call.c:482:24
 #242 0x55fd435ad2f1 in slot_tp_call /srv/zulip/anders/cpython/Objects/typeobject.c:7632:15
 #243 0x55fd43334063 in _PyObject_MakeTpCall /srv/zulip/anders/cpython/Objects/call.c:214:18
 #244 0x55fd43336d3a in _PyObject_VectorcallTstate /srv/zulip/anders/cpython/./Include/internal/pycore_call.h:90:16
 #245 0x55fd43336c2e in PyObject_Vectorcall /srv/zulip/anders/cpython/Objects/call.c:299:12
 #246 0x55fd437e1005 in _PyEval_EvalFrameDefault /srv/zulip/anders/cpython/Python/ceval.c
 #247 0x55fd437b8af6 in _PyEval_EvalFrame /srv/zulip/anders/cpython/./Include/internal/pycore_ceval.h:73:16
 #248 0x55fd437b83f1 in _PyEval_Vector /srv/zulip/anders/cpython/Python/ceval.c:6439:24
 #249 0x55fd433379fb in _PyFunction_Vectorcall /srv/zulip/anders/cpython/Objects/call.c
 #250 0x55fd43333966 in _PyObject_FastCallDictTstate /srv/zulip/anders/cpython/Objects/call.c:141:15
 #251 0x55fd43338483 in _PyObject_Call_Prepend /srv/zulip/anders/cpython/Objects/call.c:482:24
 #252 0x55fd435ad2f1 in slot_tp_call /srv/zulip/anders/cpython/Objects/typeobject.c:7632:15
 #253 0x55fd43334063 in _PyObject_MakeTpCall /srv/zulip/anders/cpython/Objects/call.c:214:18
 #254 0x55fd43336d3a in _PyObject_VectorcallTstate /srv/zulip/anders/cpython/./Include/internal/pycore_call.h:90:16
 #255 0x55fd43336c2e in PyObject_Vectorcall /srv/zulip/anders/cpython/Objects/call.c:299:12
 #256 0x55fd437e1005 in _PyEval_EvalFrameDefault /srv/zulip/anders/cpython/Python/ceval.c
 #257 0x55fd437b8af6 in _PyEval_EvalFrame /srv/zulip/anders/cpython/./Include/internal/pycore_ceval.h:73:16
 #258 0x55fd437b83f1 in _PyEval_Vector /srv/zulip/anders/cpython/Python/ceval.c:6439:24
 #259 0x55fd433379fb in _PyFunction_Vectorcall /srv/zulip/anders/cpython/Objects/call.c
 #260 0x55fd43333966 in _PyObject_FastCallDictTstate /srv/zulip/anders/cpython/Objects/call.c:141:15
 #261 0x55fd43338483 in _PyObject_Call_Prepend /srv/zulip/anders/cpython/Objects/call.c:482:24
 #262 0x55fd435ad2f1 in slot_tp_call /srv/zulip/anders/cpython/Objects/typeobject.c:7632:15
 #263 0x55fd43334063 in _PyObject_MakeTpCall /srv/zulip/anders/cpython/Objects/call.c:214:18
 #264 0x55fd43336d3a in _PyObject_VectorcallTstate /srv/zulip/anders/cpython/./Include/internal/pycore_call.h:90:16

0x62900558c25d is located 93 bytes inside of 16384-byte region [0x62900558c200,0x629005590200)
freed by thread T0 here:
 #0 0x55fd42f60bc2 in free (/srv/zulip/anders/cpython/python+0xa0dbc2) (BuildId: 2805b43d8a9ad47b1cbf8f8d1e83c8be78721c21)
 #1 0x55fd435005fb in _PyObject_ArenaFree /srv/zulip/anders/cpython/Objects/obmalloc.c:176:5
 #2 0x55fd434ffa86 in _PyObject_VirtualFree /srv/zulip/anders/cpython/Objects/obmalloc.c:566:5
 #3 0x55fd439a6efc in _PyThreadState_PopFrame /srv/zulip/anders/cpython/Python/pystate.c:2229:9
 #4 0x55fd43829cbc in _PyEvalFrameClearAndPop /srv/zulip/anders/cpython/Python/ceval.c:6413:5
 #5 0x55fd437b84f9 in _PyEval_Vector /srv/zulip/anders/cpython/Python/ceval.c:6444:5
 #6 0x55fd433379fb in _PyFunction_Vectorcall /srv/zulip/anders/cpython/Objects/call.c
 #7 0x55fd43342c6e in _PyObject_VectorcallTstate /srv/zulip/anders/cpython/./Include/internal/pycore_call.h:92:11
 #8 0x55fd4333f839 in method_vectorcall /srv/zulip/anders/cpython/Objects/classobject.c:67:20
 #9 0x55fd433368db in _PyVectorcall_Call /srv/zulip/anders/cpython/Objects/call.c:245:16
 #10 0x55fd433370b5 in _PyObject_Call /srv/zulip/anders/cpython/Objects/call.c:328:16
 #11 0x55fd4333765b in PyObject_Call /srv/zulip/anders/cpython/Objects/call.c:355:12
 #12 0x55fd437e68c3 in do_call_core /srv/zulip/anders/cpython/Python/ceval.c
 #13 0x55fd437e68c3 in _PyEval_EvalFrameDefault /srv/zulip/anders/cpython/Python/ceval.c:5381:22
 #14 0x55fd437b8af6 in _PyEval_EvalFrame /srv/zulip/anders/cpython/./Include/internal/pycore_ceval.h:73:16
 #15 0x55fd437b83f1 in _PyEval_Vector /srv/zulip/anders/cpython/Python/ceval.c:6439:24
 #16 0x55fd433379fb in _PyFunction_Vectorcall /srv/zulip/anders/cpython/Objects/call.c
 #17 0x55fd43333966 in _PyObject_FastCallDictTstate /srv/zulip/anders/cpython/Objects/call.c:141:15
 #18 0x55fd43338483 in _PyObject_Call_Prepend /srv/zulip/anders/cpython/Objects/call.c:482:24
 #19 0x55fd435ad2f1 in slot_tp_call /srv/zulip/anders/cpython/Objects/typeobject.c:7632:15
 #20 0x55fd43334063 in _PyObject_MakeTpCall /srv/zulip/anders/cpython/Objects/call.c:214:18
 #21 0x55fd433377ff in _PyObject_VectorcallTstate /srv/zulip/anders/cpython/./Include/internal/pycore_call.h:90:16
 #22 0x55fd433377ff in PyObject_CallOneArg /srv/zulip/anders/cpython/Objects/call.c:376:12
 #23 0x55fd436bf2b3 in handle_callback /srv/zulip/anders/cpython/Objects/weakrefobject.c:928:26
 #24 0x55fd436be4cc in PyObject_ClearWeakRefs /srv/zulip/anders/cpython/Objects/weakrefobject.c:974:21
 #25 0x55fd43c380ee in partial_dealloc /srv/zulip/anders/cpython/./Modules/_functoolsmodule.c:179:9
 #26 0x55fd434fd7de in _Py_Dealloc /srv/zulip/anders/cpython/Objects/object.c:2390:5
 #27 0x55fd433e0972 in Py_DECREF /srv/zulip/anders/cpython/./Include/object.h:527:9
 #28 0x55fd433dc796 in frame_dealloc /srv/zulip/anders/cpython/Objects/frameobject.c:875:13
 #29 0x55fd434fd7de in _Py_Dealloc /srv/zulip/anders/cpython/Objects/object.c:2390:5
 #30 0x55fd433e0972 in Py_DECREF /srv/zulip/anders/cpython/./Include/object.h:527:9
 #31 0x55fd433dc950 in frame_dealloc /srv/zulip/anders/cpython/Objects/frameobject.c:878:5

previously allocated by thread T0 here:
 #0 0x55fd42f60e6e in __interceptor_malloc (/srv/zulip/anders/cpython/python+0xa0de6e) (BuildId: 2805b43d8a9ad47b1cbf8f8d1e83c8be78721c21)
 #1 0x55fd435005eb in _PyObject_ArenaMalloc /srv/zulip/anders/cpython/Objects/obmalloc.c:170:12
 #2 0x55fd434ffa63 in _PyObject_VirtualAlloc /srv/zulip/anders/cpython/Objects/obmalloc.c:560:12
 #3 0x55fd439a5f54 in allocate_chunk /srv/zulip/anders/cpython/Python/pystate.c:731:26
 #4 0x55fd439a5f54 in push_chunk /srv/zulip/anders/cpython/Python/pystate.c:2184:26
 #5 0x55fd439a5f54 in _PyThreadState_BumpFramePointerSlow /srv/zulip/anders/cpython/Python/pystate.c:2214:35
 #6 0x55fd4382819a in _PyThreadState_BumpFramePointer /srv/zulip/anders/cpython/./Include/internal/pycore_frame.h:218:12
 #7 0x55fd4382d907 in _PyEvalFramePushAndInit /srv/zulip/anders/cpython/Python/ceval.c:6371:34
 #8 0x55fd437b83d8 in _PyEval_Vector /srv/zulip/anders/cpython/Python/ceval.c:6434:34
 #9 0x55fd433379fb in _PyFunction_Vectorcall /srv/zulip/anders/cpython/Objects/call.c
 #10 0x55fd43342c6e in _PyObject_VectorcallTstate /srv/zulip/anders/cpython/./Include/internal/pycore_call.h:92:11
 #11 0x55fd4333f839 in method_vectorcall /srv/zulip/anders/cpython/Objects/classobject.c:67:20
 #12 0x55fd433368db in _PyVectorcall_Call /srv/zulip/anders/cpython/Objects/call.c:245:16
 #13 0x55fd433370b5 in _PyObject_Call /srv/zulip/anders/cpython/Objects/call.c:328:16
 #14 0x55fd4333765b in PyObject_Call /srv/zulip/anders/cpython/Objects/call.c:355:12
 #15 0x55fd437e68c3 in do_call_core /srv/zulip/anders/cpython/Python/ceval.c
 #16 0x55fd437e68c3 in _PyEval_EvalFrameDefault /srv/zulip/anders/cpython/Python/ceval.c:5381:22
 #17 0x55fd437b8af6 in _PyEval_EvalFrame /srv/zulip/anders/cpython/./Include/internal/pycore_ceval.h:73:16
 #18 0x55fd437b83f1 in _PyEval_Vector /srv/zulip/anders/cpython/Python/ceval.c:6439:24
 #19 0x55fd433379fb in _PyFunction_Vectorcall /srv/zulip/anders/cpython/Objects/call.c
 #20 0x55fd43333966 in _PyObject_FastCallDictTstate /srv/zulip/anders/cpython/Objects/call.c:141:15
 #21 0x55fd43338483 in _PyObject_Call_Prepend /srv/zulip/anders/cpython/Objects/call.c:482:24
 #22 0x55fd435ad2f1 in slot_tp_call /srv/zulip/anders/cpython/Objects/typeobject.c:7632:15
 #23 0x55fd43334063 in _PyObject_MakeTpCall /srv/zulip/anders/cpython/Objects/call.c:214:18
 #24 0x55fd433377ff in _PyObject_VectorcallTstate /srv/zulip/anders/cpython/./Include/internal/pycore_call.h:90:16
 #25 0x55fd433377ff in PyObject_CallOneArg /srv/zulip/anders/cpython/Objects/call.c:376:12
 #26 0x55fd436bf2b3 in handle_callback /srv/zulip/anders/cpython/Objects/weakrefobject.c:928:26
 #27 0x55fd436be4cc in PyObject_ClearWeakRefs /srv/zulip/anders/cpython/Objects/weakrefobject.c:974:21
 #28 0x55fd43c380ee in partial_dealloc /srv/zulip/anders/cpython/./Modules/_functoolsmodule.c:179:9
 #29 0x55fd434fd7de in _Py_Dealloc /srv/zulip/anders/cpython/Objects/object.c:2390:5
 #30 0x55fd433e0972 in Py_DECREF /srv/zulip/anders/cpython/./Include/object.h:527:9
 #31 0x55fd433dc796 in frame_dealloc /srv/zulip/anders/cpython/Objects/frameobject.c:875:13
 #32 0x55fd434fd7de in _Py_Dealloc /srv/zulip/anders/cpython/Objects/object.c:2390:5
 #33 0x55fd433e0972 in Py_DECREF /srv/zulip/anders/cpython/./Include/object.h:527:9

SUMMARY: AddressSanitizer: heap-use-after-free /srv/zulip/anders/cpython/Objects/frameobject.c:854:5 in frame_dealloc
Shadow bytes around the buggy address:
 0x0c5280aa97f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 0x0c5280aa9800: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 0x0c5280aa9810: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 0x0c5280aa9820: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 0x0c5280aa9830: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c5280aa9840: fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd fd fd
 0x0c5280aa9850: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 0x0c5280aa9860: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 0x0c5280aa9870: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 0x0c5280aa9880: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 0x0c5280aa9890: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
 Addressable: 00
 Partially addressable: 01 02 03 04 05 06 07 
 Heap left redzone: fa
 Freed heap region: fd
 Stack left redzone: f1
 Stack mid redzone: f2
 Stack right redzone: f3
 Stack after return: f5
 Stack use after scope: f8
 Global redzone: f9
 Global init order: f6
 Poisoned by user: f7
 Container overflow: fc
 Array cookie: ac
 Intra object redzone: bb
 ASan internal: fe
 Left alloca redzone: ca
 Right alloca redzone: cb
==4327==ABORTING

Your environment

• CPython versions tested on: 3.11.4, 3.12.0b3
• Operating system and architecture: NixOS 23.11 x86_64, Debian 12 x86_64

Linked PRs

• gh-106092: Fix use-after-free crash in frame_dealloc #106875
• [3.12] gh-106092: Fix use-after-free crash in frame_dealloc (GH-106875) #107532
• [3.11] gh-106092: Fix use-after-free crash in frame_dealloc (GH-106875) #107533

[andersk]

I think I understand the problem.

_PyFrame_ClearExceptCode is careful to check whether an extra outstanding reference to the PyFrameObject could delay its deallocation, in which case it calls take_ownership to replace the f_frame back-pointer so frame_dealloc doesn’t later dereference f_frame to already-freed memory.

cpython/Python/frame.c

Lines 128 to 137 in f992a60

	if (frame->frame_obj) {
	PyFrameObject *f = frame->frame_obj;
	frame->frame_obj = NULL;
	if (Py_REFCNT(f) > 1) {
	take_ownership(f, frame);
	Py_DECREF(f);
	return;
	}
	Py_DECREF(f);
	}

However, that is not the only reason the PyFrameObject’s deallocation could be delayed! If the maximum nesting level is reached, _PyTrash_begin could decide to store the PyFrameObject in the trashcan to be deallocated later. In that case, frame_dealloc will dereference f_frame to already-freed memory anyway.

Cc @markshannon (GH-27077).