Skip to content

[3.13]gh-137894: Fix segmentation fault in deeply nested filter() iterator chains #137895

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 2,672 commits into from

Conversation

tangyuan0821
Copy link
Contributor

@tangyuan0821 tangyuan0821 commented Aug 18, 2025

Summary

Fixed a critical segmentation fault bug in Python 3.13 where creating deeply nested chains of filter() iterators would crash the interpreter instead of raising a proper Python exception. The fix adds a tp_clear method to the filter object to prevent stack overflow during garbage collection of cyclic references.

Problem

When creating deeply nested filter() iterator chains (e.g., applying filter() thousands of times in a loop), Python 3.13 would crash with a segmentation fault instead of raising a RecursionError. This violates Python's fundamental principle that user code should never be able to crash the interpreter.

Example problematic code:

i = filter(bool, range(1000000))
for _ in range(100000):
    i = filter(bool, i)
print(list(i))  # Segmentation fault in Python 3.13

Expected behavior: Should raise RecursionError or similar Python exception
Actual behavior: Segmentation fault (interpreter crash)

Root Cause

The filter object type in Python/bltinmodule.c was missing a tp_clear method implementation. During garbage collection of deeply nested filter iterator chains, the garbage collector would attempt to deallocate objects through recursive calls to filter_dealloc(), eventually exceeding the C stack limit and causing a segmentation fault.

Solution

Added a tp_clear method to the filter object type:

  1. Implemented filter_clear() function:

    static int
    filter_clear(filterobject *lz)
    {
        Py_CLEAR(lz->it);
        Py_CLEAR(lz->func);
        return 0;
    }
  2. Updated PyFilter_Type definition:

    // Changed from:
    0,                                  /* tp_clear */
    // To:
    (inquiry)filter_clear,              /* tp_clear */

The tp_clear method allows the garbage collector to break reference cycles safely without relying on deep recursive deallocation, preventing stack overflow crashes.

miss-islington and others added 30 commits June 19, 2025 13:04
…thonGH-135597) (pythonGH-135711)

Docs: Emphasize parameter name in `pkgutil.iter_importers` (pythonGH-135597)
(cherry picked from commit ff639af)

Co-authored-by: Rafael Fontenelle <rffontenelle@users.noreply.github.com>
… (pythonGH-135719)

Docs: Add missing lines between regex and text (pythonGH-134505)
(cherry picked from commit 7541902)

Co-authored-by: Rafael Fontenelle <rffontenelle@users.noreply.github.com>
…GH-135274) (python#135715)

pythongh-135273: Unify `ZoneInfo.from_file` signatures (pythonGH-135274)

Align `ZoneInfo.from_file` pure-Python signature with Argument Clinic signature.
(cherry picked from commit 7cc8949)

Co-authored-by: Andrii Hrimov <andrew.hrimov@gmail.com>
…onGH-135697) (pythonGH-135758)

Docs: Document `PyExceptionClass` functions in the C API (pythonGH-135697)

* Docs: Document `PyExceptionClass_Name`

`PyExceptionClass_Name` is an undocumented function in the limited API.

* Document `PyExceptionClass_Check`
(cherry picked from commit 59963e8)

Co-authored-by: Yuki Kobayashi <drsuaimqjgar@gmail.com>
…thonGH-135770) (python#135777)

pythongh-135756: Fix nonexistent parameter in tkinter docs (pythonGH-135770)

Remove nonexistent color parameter from tkinter.commondialog.Dialog.show() method documentation.
(cherry picked from commit 4ddf505)

Co-authored-by: Marcell Perger <102254594+MarcellPerger1@users.noreply.github.com>
…s missing (pythonGH-135816) (python#135826)

pythongh-135815: skip `netrc` security checks if `os.getuid` is missing (pythonGH-135816)
(cherry picked from commit b57b619)

Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>
…f in tests (pythonGH-134987) (python#135842)

pythongh-134986: Catch PermissionError when trying to call perf in tests (pythonGH-134987)

Using Ubuntu 24.04 on the Windows Subsystem for Linux, perf will raise a
`PermissionError` instead of `FileNotFoundError`. This commit modifies
the tests to catch that.
(cherry picked from commit 6ab842f)

Co-authored-by: Emma Smith <emma@emmatyping.dev>
…ive/Default max_size (pythongh-135778)

We weren't handling non-positive maxsize values (including the default) properly
in Queue.full().  This change fixes that and adjusts an associated assert.

(cherry picked from commit c5ea8e8, AKA pythongh-135724)
…honGH-135510) (pythonGH-135867)

Docs: Use `arguments` to replace `args` in `argparse.rst` (pythonGH-135510)
(cherry picked from commit caad163)

Co-authored-by: Yongzi Li <204532581+Yzi-Li@users.noreply.github.com>
Co-authored-by: sobolevn <mail@sobolevn.me>
…35713) (python#135881)

pythongh-135494: Fix python -m test --pgo -x test_re (python#135713)

Fix regrtest to support excluding tests from --pgo tests.

(cherry picked from commit 15c6d63)
…arge integers (pythonGH-135506) (python#135886)

pythongh-135487: fix `reprlib.Repr.repr_int` when given very large integers (pythonGH-135506)
(cherry picked from commit e5f03b9)

Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>
…pythonGH-135889) (python#135895)

pythongh-135878: Fix crash in `types.SimpleNamespace.__repr__` (pythonGH-135889)
(cherry picked from commit b3ab94a)

Co-authored-by: sobolevn <mail@sobolevn.me>
Co-authored-by: Peter Bierma <zintensitydev@gmail.com>
…to `_interpreters.set___main___attrs` (pythongh-135903)

(cherry picked from commit 4e6f0d1, AKA pythongh-135856)
…*` macros (pythonGH-135762) (pythonGH-135917)

(cherry picked from commit ca87a47)

Co-authored-by: Peter Bierma <zintensitydev@gmail.com>
Co-authored-by: Brian Schubert <brianm.schubert@gmail.com>
Co-authored-by: Petr Viktorin <encukou@gmail.com>
…_interpchannelsmodule` (pythonGH-135840) (python#135919)

(cherry picked from commit dd59c78)
… productionlist (pythonGH-129977) (pythonGH-135941)

Docs: Add cross-reference for `positional_item` in the `calls` productionlist (pythonGH-129977)

Add missing hyperlink for `positional_item`
(cherry picked from commit d215491)

Co-authored-by: HarryLHW <123lhw321@gmail.com>
… with zero timeout (pythongh-135872) (pythongh-135947)

The free threading build could spin unnecessarily on `_Py_yield()` if the initial
compare and swap failed.
(cherry picked from commit cbfaf41)

Co-authored-by: Joseph Tibbertsma <josephtibbertsma@gmail.com>
…honGH-134393) (pythonGH-135949)

Docs: Fix indentation in `slice` class of `functions.rst` (pythonGH-134393)

Paragraph should not be under `slice.step`. It applies to the whole class.

(cherry picked from commit 6227662)

Co-authored-by: Rob Reynolds <13379223+reynoldsnlp@users.noreply.github.com>
…record. (pythonGH-135858) (pythonGH-135911)

Co-authored-by: Vinay Sajip <vinay_sajip@yahoo.co.uk>
pythonGH-135957) (python#135963)

pythongh-135956: Remove duplicate word in _pydatetime docstring (pythonGH-135957)

_pydatetime.isoformat docstring repeats 'giving'.
(cherry picked from commit e3ea6f2)

Co-authored-by: Terry Jan Reedy <tjreedy@udel.edu>
… howto (pythonGH-135964) (python#135978)

pythongh-135965: Delete duplicate word in isolating-extensions howto (pythonGH-135964)

Change use use to use.
(cherry picked from commit ffb2a02)

Co-authored-by: Weilin Du <108666168+LamentXU123@users.noreply.github.com>
…ion (pythonGH-135152) (pythonGH-135986)

pythongh-135110: Fix misleading `generator.close()` documentation (pythonGH-135152)

The documentation incorrectly stated that generator.close() 'raises' a
GeneratorExit exception. This was misleading because the method doesn't
raise the exception to the caller - it sends the exception internally
to the generator and returns None.
(cherry picked from commit 0d76dcc)

Co-authored-by: Connor Denihan <188690869+cdenihan@users.noreply.github.com>
…) (python#136000)

IDLE: Update NEWS2x.txt with 2.7.0 release date (pythonGH-129908)
(cherry picked from commit 642e5df)

Co-authored-by: Stan Ulbrych <89152624+StanFromIreland@users.noreply.github.com>
…-135990) (python#136002)

pythongh-135995: Fix missing char in palmos encoding (pythonGH-135990)

0x8b correctly encodes to ‹, but 0x9b was mistakenly marked as a control character instead of ›.
---------
(cherry picked from commit 58a42de)

Co-authored-by: Nathan Korth <nkorth@users.noreply.github.com>
Co-authored-by: blurb-it[bot] <43283697+blurb-it[bot]@users.noreply.github.com>
Co-authored-by: Brian Schubert <brianm.schubert@gmail.com>
Co-authored-by: Terry Jan Reedy <tjreedy@udel.edu>
…e directory (pythonGH-135967) (python#136013)

The iOS testbed now treats the app_packages folder as a site folder. This ensures it is
on the path, but also ensures any .pth files are processed on app startup.
(cherry picked from commit b38810b)
…) (python#136015)

Adds iOS binary stubs for invoking `strip`
(cherry picked from commit 0c6c09b)

Co-authored-by: Russell Keith-Magee <russell@keith-magee.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.