Crash report
What happened?
In DEBUG build:
import collections.abc
del collections.abc.MutableSequence
import array
or:
sys.setrecursionlimit(25)
import array
generates a double DECREF on the array ArrayType object due to poisoned module state:
Python/gc.c:96: gc_decref: Assertion "gc_get_refs(g) > 0" failed: refcount is too small
object type name: type
object repr : <class 'array.array'>
Fatal Python error: _PyObject_AssertFailed: _PyObject_AssertFailed
Analysis
So, array_modexec creates the ArrayType and assigns it to array state:
|
CREATE_TYPE(m, state->ArrayType, &array_spec); |
It then goes on to do some other setup tasks, and if any of these fail, it DECREF's state->ArrayType but leaves the type object on the state struct:
|
PyObject *mutablesequence = PyImport_ImportModuleAttrString( |
|
"collections.abc", "MutableSequence"); |
|
if (!mutablesequence) { |
|
Py_DECREF((PyObject *)state->ArrayType); |
|
return -1; |
|
} |
|
PyObject *res = PyObject_CallMethod(mutablesequence, "register", "O", |
|
(PyObject *)state->ArrayType); |
|
Py_DECREF(mutablesequence); |
|
if (!res) { |
|
Py_DECREF((PyObject *)state->ArrayType); |
|
return -1; |
|
} |
Returning -1 error code.
PyModule_ExecDef passes the -1 up the chain:
which ends up with an exception in _bootstrap.py:
|
except: |
|
try: |
|
del sys.modules[spec.name] |
|
except KeyError: |
|
pass |
|
raise |
At this point, the array module refcount falls and it's cleaned up, and array_clear calls:
|
Py_CLEAR(state->ArrayType); |
because the
ArrayType pointer is still in the module
state, this generates the double DECREF
CPython versions tested on:
CPython main branch
Operating systems tested on:
Linux
Output from running 'python -VV' on the command line:
Python 3.16.0a0 (heads/main-dirty:1034e73, Jul 6 2026, 11:11:46) [Clang 22.1.6 ]
Linked PRs
Crash report
What happened?
In DEBUG build:
or:
generates a double DECREF on the array
ArrayTypeobject due to poisoned module state:Analysis
So,
array_modexeccreates theArrayTypeand assigns it to array state:cpython/Modules/arraymodule.c
Line 3400 in 836b206
It then goes on to do some other setup tasks, and if any of these fail, it DECREF's
state->ArrayTypebut leaves the type object on the state struct:cpython/Modules/arraymodule.c
Lines 3409 to 3421 in 836b206
Returning
-1error code.PyModule_ExecDefpasses the -1 up the chain:cpython/Objects/moduleobject.c
Line 793 in 0514489
which ends up with an exception in _bootstrap.py:
cpython/Lib/importlib/_bootstrap.py
Lines 910 to 915 in 0514489
At this point, the array module refcount falls and it's cleaned up, and
array_clearcalls:cpython/Modules/arraymodule.c
Line 3346 in 2d7a74e
because the
ArrayTypepointer is still in the modulestate, this generates the double DECREFCPython versions tested on:
CPython main branch
Operating systems tested on:
Linux
Output from running 'python -VV' on the command line:
Python 3.16.0a0 (heads/main-dirty:1034e73, Jul 6 2026, 11:11:46) [Clang 22.1.6 ]
Linked PRs
arraymodule import crash under a memory pressure #153238