Skip to content

Failed assertion in itertoolsmodule.c: itertools_count_impl for count(sys.maxsize) #126595

New issue
New issue
Closed
Closed
Failed assertion in itertoolsmodule.c: itertools_count_impl for count(sys.maxsize)#126595
Assignees
picnixz
Labels
3.12only security fixes3.13only security fixes3.14bugs and security fixesinterpreter-core(Objects, Python, Grammar, and Parser dirs)type-crashA hard crash of the interpreter, possibly with a core dump

Description

@devdanzin
devdanzin
opened on Nov 8, 2024

Crash report

What happened?

Calling itertools.count(sys.maxsize) aborts with the following message:

python -c "from sys import maxsize; from itertools import count; count(maxsize)"
python: ./Modules/itertoolsmodule.c:3325: itertools_count_impl: Assertion `(cnt != PY_SSIZE_T_MAX && long_cnt == NULL && fast_mode) || (cnt == PY_SSIZE_T_MAX && long_cnt != NULL && !fast_mode)' failed.
Aborted (core dumped)

Found using fusil by @vstinner.

CPython versions tested on:

CPython main branch

Operating systems tested on:

Linux, Windows

Output from running 'python -VV' on the command line:

Python 3.14.0a1+ (heads/main:4ea214ea982, Nov 6 2024, 00:52:15) [MSC v.1941 64 bit (AMD64)]

Linked PRs

Activity

  1. devdanzin
    added
    type-crashA hard crash of the interpreter, possibly with a core dump
    on Nov 8, 2024
  2. picnixz
    added
    interpreter-core(Objects, Python, Grammar, and Parser dirs)
    on Nov 8, 2024

  3. picnixz commented on Nov 8, 2024

    @picnixz
    picnixz
    on Nov 8, 2024
    Member

    cc @rhettinger

  4. picnixz
    self-assigned this
    on Nov 9, 2024
  5. picnixz
    added
    3.12only security fixes
    3.13only security fixes
    3.14bugs and security fixes
    on Nov 9, 2024

  6. skirpichev commented on Nov 9, 2024

    @skirpichev
    skirpichev
    on Nov 9, 2024
    Member

    Note, that on non-debug builds there is no crash:

    Python 3.13.0rc1+ (heads/3.13:bd29ce8509, Aug 29 2024, 15:30:15) [GCC 12.2.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> from sys import maxsize
>>> from itertools import count
>>> c = count(maxsize)
>>> next(c)
9223372036854775807
>>> next(c)
9223372036854775808
>>> next(c)
9223372036854775809

    So, I don't think this should be backported.

    On another hand, we have an issue with repl. Continuing the above example:

    >>> count(maxsize)
count(<NULL>)

    This seems to be fixed by pr.

  7. picnixz commented on Nov 9, 2024

    @picnixz
    picnixz
    on Nov 9, 2024
    Member

    Note, that on non-debug builds there is no crash:

    I think we should still backport fixes for non-debug builds because people might want to use debug builds for themselves.

  8. devdanzin commented on Nov 9, 2024

    @devdanzin
    devdanzin
    on Nov 9, 2024
    MemberAuthor
    >>> count(maxsize)
count(<NULL>)

    Nice find! If we take it further, another assertion fails:

    Python 3.14.0a1+ experimental free-threading build (heads/main:6293d00, Nov  9 2024, 07:56:06) [GCC 13.2.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> from sys import maxsize; from itertools import count
>>> c = count(maxsize - 2)
>>> for x in c:
...     print(c, x)
... 
count(9223372036854775806) 9223372036854775805
python: Objects/unicodeobject.c:3046: unicode_fromformat_arg: Assertion `obj' failed.
Aborted (core dumped)

  9. picnixz commented on Nov 9, 2024

    @picnixz
    picnixz
    on Nov 9, 2024
    Member

    Ah the PR does not fix this second assertion on unicode objects. I'll work a bit more. Thanks for finding it.

  10. picnixz commented on Nov 9, 2024

    @picnixz
    picnixz
    on Nov 9, 2024
    Member

    Update: I found the issue. When the counter reaches PY_SSIZE_T_MAX, it does not set its long_cnt field. In particular, if you call repr() just after, the field will still be NULL (it's set by next only). I'm preparing the fix.

  11. vstinner
    added a commit that references this issue on Nov 12, 2024

    gh-126595: fix a crash when calling `itertools.count(sys.maxsize)` (#…

    6e3bb8a
  12. miss-islington
    added a commit that references this issue on Nov 12, 2024

    pythongh-126595: fix a crash when calling `itertools.count(sys.maxsiz…

    8e596cb
  13. vstinner
    added 2 commits that reference this issue on Nov 12, 2024

    [3.12] gh-126595: fix a crash when calling `itertools.count(sys.maxsi…

    46710ca

    [3.13] gh-126595: fix a crash when calling `itertools.count(sys.maxsi…

    865f096

  14. picnixz commented on Nov 12, 2024

    @picnixz
    picnixz
    on Nov 12, 2024
    Member

    Closing since completed and backported. Thank you all.

  15. picnixz
    closed this as completedon Nov 12, 2024
  16. picnixz
    added a commit that references this issue on Dec 8, 2024

    pythongh-126595: fix a crash when calling `itertools.count(sys.maxsiz…

    c0b89e2
  17. ebonnal
    added a commit that references this issue on Jan 12, 2025

    pythongh-126595: fix a crash when calling `itertools.count(sys.maxsiz…

    8418d66
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

3.12only security fixes3.13only security fixes3.14bugs and security fixesinterpreter-core(Objects, Python, Grammar, and Parser dirs)type-crashA hard crash of the interpreter, possibly with a core dump

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions