Skip to content

Free-threaded build crashes when destructor ran in the middle of dict/list resize #160697

Open

Description

@Eclips4

Crash report

import threading

class Evil:
    def __del__(self):
        d[object()] = 0

class C:
    pass

d = {}
t = threading.Thread(target=d.get, args=(0,))
t.start()
t.join()

for _ in range(1000):
    o = C()
    o.__dict__ = {"x": Evil()}
    o.__dict__ = {}
    for k in list(d):
        del d[k]
    for i in rang

Found this while trying to formally verify parts of CPython :)

CPython versions tested on:

3.15, 3.14, 3.16, CPython main branch

Operating systems tested on:

Linux

Output from running 'python -VV' on the command line:

No response

Linked PRs

Activity

  1. added
    type-crashA hard crash of the interpreter, possibly with a core dump
    3.14bugs and security fixes
    3.15bugs and security fixes
    3.16new features, bugs and security fixes
    on Oct 26, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    3.14bugs and security fixes3.15bugs and security fixes3.16new features, bugs and security fixesinterpreter-core(Objects, Python, Grammar, and Parser dirs)topic-free-threadingtype-crashA hard crash of the interpreter, possibly with a core dump

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions