Segmentation fault on Python 3.13 when running under ASan

Description

Repo snapshot: https://github.com/jcrist/msgspec/tree/ddea2a07833bf5bd0db49ec056ecbc612aff6b26
Changes applied: https://github.com/jcrist/msgspec/pull/909/files
Workflow run: https://github.com/jcrist/msgspec/actions/runs/18891966978/job/53921422350?pr=909#step:10:32
Command: LD_PRELOAD=`gcc -print-file-name=libasan.so` coverage run -m pytest -s -m "not mypy and not pyright"
Output:

============================= test session starts ==============================
platform linux -- Python 3.13.7, pytest-8.4.2, pluggy-1.6.0
rootdir: /home/runner/work/msgspec/msgspec
configfile: pyproject.toml
collected 6184 items / 2 deselected / 6182 selected

<clipped>
tests/test_schema.py ....................................................................................................................
Fatal Python error: Segmentation fault

Current thread 0x00007f6d7392e7c0 (most recent call first):
  File "/home/runner/work/msgspec/msgspec/tests/test_struct.py", line 2249 in test_defstruct_dict
  File "/opt/hostedtoolcache/Python/3.13.7/x64/lib/python3.13/site-packages/_pytest/python.py", line 157 in pytest_pyfunc_call
  File "/opt/hostedtoolcache/Python/3.13.7/x64/lib/python3.13/site-packages/pluggy/_callers.py", line 121 in _multicall
  File "/opt/hostedtoolcache/Python/3.13.7/x64/lib/python3.13/site-packages/pluggy/_manager.py", line 120 in _hookexec
  File "/opt/hostedtoolcache/Python/3.13.7/x64/lib/python3.13/site-packages/pluggy/_hooks.py", line 512 in __call__
  File "/opt/hostedtoolcache/Python/3.13.7/x64/lib/python3.13/site-packages/_pytest/python.py", line 1671 in runtest
  File "/opt/hostedtoolcache/Python/3.13.7/x64/lib/python3.13/site-packages/_pytest/runner.py", line 178 in pytest_runtest_call
  File "/opt/hostedtoolcache/Python/3.13.7/x64/lib/python3.13/site-packages/pluggy/_callers.py", line 121 in _multicall
  File "/opt/hostedtoolcache/Python/3.13.7/x64/lib/python3.13/site-packages/pluggy/_manager.py", line 120 in _hookexec
  File "/opt/hostedtoolcache/Python/3.13.7/x64/lib/python3.13/site-packages/pluggy/_hooks.py", line 512 in __call__
  File "/opt/hostedtoolcache/Python/3.13.7/x64/lib/python3.13/site-packages/_pytest/runner.py", line 246 in <lambda>
  File "/opt/hostedtoolcache/Python/3.13.7/x64/lib/python3.13/site-packages/_pytest/runner.py", line 344 in from_call
  File "/opt/hostedtoolcache/Python/3.13.7/x64/lib/python3.13/site-packages/_pytest/runner.py", line 245 in call_and_report
  File "/opt/hostedtoolcache/Python/3.13.7/x64/lib/python3.13/site-packages/_pytest/runner.py", line 136 in runtestprotocol
  File "/opt/hostedtoolcache/Python/3.13.7/x64/lib/python3.13/site-packages/_pytest/runner.py", line 117 in pytest_runtest_protocol
  File "/opt/hostedtoolcache/Python/3.13.7/x64/lib/python3.13/site-packages/pluggy/_callers.py", line 121 in _multicall
  File "/opt/hostedtoolcache/Python/3.13.7/x64/lib/python3.13/site-packages/pluggy/_manager.py", line 120 in _hookexec
  File "/opt/hostedtoolcache/Python/3.13.7/x64/lib/python3.13/site-packages/pluggy/_hooks.py", line 512 in __call__
  File "/opt/hostedtoolcache/Python/3.13.7/x64/lib/python3.13/site-packages/_pytest/main.py", line 367 in pytest_runtestloop
  File "/opt/hostedtoolcache/Python/3.13.7/x64/lib/python3.13/site-packages/pluggy/_callers.py", line 121 in _multicall
  File "/opt/hostedtoolcache/Python/3.13.7/x64/lib/python3.13/site-packages/pluggy/_manager.py", line 120 in _hookexec
  File "/opt/hostedtoolcache/Python/3.13.7/x64/lib/python3.13/site-packages/pluggy/_hooks.py", line 512 in __call__
  File "/opt/hostedtoolcache/Python/3.13.7/x64/lib/python3.13/site-packages/_pytest/main.py", line 343 in _main
  File "/opt/hostedtoolcache/Python/3.13.7/x64/lib/python3.13/site-packages/_pytest/main.py", line 289 in wrap_session
  File "/opt/hostedtoolcache/Python/3.13.7/x64/lib/python3.13/site-packages/_pytest/main.py", line 336 in pytest_cmdline_main
  File "/opt/hostedtoolcache/Python/3.13.7/x64/lib/python3.13/site-packages/pluggy/_callers.py", line 121 in _multicall
  File "/opt/hostedtoolcache/Python/3.13.7/x64/lib/python3.13/site-packages/pluggy/_manager.py", line 120 in _hookexec
  File "/opt/hostedtoolcache/Python/3.13.7/x64/lib/python3.13/site-packages/pluggy/_hooks.py", line 512 in __call__
  File "/opt/hostedtoolcache/Python/3.13.7/x64/lib/python3.13/site-packages/_pytest/config/__init__.py", line 175 in main
  File "/opt/hostedtoolcache/Python/3.13.7/x64/lib/python3.13/site-packages/_pytest/config/__init__.py", line 201 in console_main
  File "/opt/hostedtoolcache/Python/3.13.7/x64/lib/python3.13/site-packages/pytest/__main__.py", line 9 in <module>
  File "/opt/hostedtoolcache/Python/3.13.7/x64/lib/python3.13/site-packages/coverage/execfile.py", line 213 in run
  File "/opt/hostedtoolcache/Python/3.13.7/x64/lib/python3.13/site-packages/coverage/cmdline.py", line 1023 in do_run
  File "/opt/hostedtoolcache/Python/3.13.7/x64/lib/python3.13/site-packages/coverage/cmdline.py", line 834 in command_line
  File "/opt/hostedtoolcache/Python/3.13.7/x64/lib/python3.13/site-packages/coverage/cmdline.py", line 1135 in main
  File "/opt/hostedtoolcache/Python/3.13.7/x64/bin/coverage", line 7 in <module>

Extension modules: msgspec._core, native_internal, mypy, mypy.api, yaml._yaml, msgpack._cmsgpack (total: 6)
AddressSanitizer:DEADLYSIGNAL
=================================================================
==2689==ERROR: AddressSanitizer: SEGV on unknown address 0x03e900000a81 (pc 0x7f6d7289eb2c bp 0x525000abb290 sp 0x525000abb250 T0)
==2689==The signal is caused by a READ memory access.
    #0 0x7f6d7289eb2c in pthread_kill (/lib/x86_64-linux-gnu/libc.so.6+0x9eb2c) (BuildId: 274eec488d230825a136fa9c4d85370fed7a0a5e)
    #1 0x7f6d7284527d in gsignal (/lib/x86_64-linux-gnu/libc.so.6+0x4527d) (BuildId: 274eec488d230825a136fa9c4d85370fed7a0a5e)
    #2 0x7f6d7284532f  (/lib/x86_64-linux-gnu/libc.so.6+0x4532f) (BuildId: 274eec488d230825a136fa9c4d85370fed7a0a5e)
    #3 0x7f6d72e24bf3 in PyObject_IS_GC Python/gc.c:1795
    #4 0x7f6d72e6bc2b in _PyObject_GC_MAY_BE_TRACKED Include/internal/pycore_gc.h:97
    #5 0x7f6d72e6bc2b in make_dict_from_instance_attributes Objects/dictobject.c:6736
    #6 0x7f6d72e6bbc1 in _PyObject_MaterializeManagedDict_LockHeld Objects/dictobject.c:6758
    #7 0x7f6d72ddd861 in _PyObject_MaterializeManagedDict Objects/dictobject.c:6785
    #8 0x7f6d72ddd861 in ensure_managed_dict Objects/dictobject.c:7274
    #9 0x7f6d72ddd861 in PyObject_GenericGetDict Objects/dictobject.c:7336
    #10 0x7f6d72de4204 in _PyObject_GenericGetAttrWithDict Objects/object.c:1665
    #11 0x7f6d72de4204 in PyObject_GetOptionalAttr Objects/object.c:1296
    #12 0x7f6d72e15ac4 in builtin_hasattr_impl Python/bltinmodule.c:1256
    #13 0x7f6d72e15ac4 in builtin_hasattr Python/clinic/bltinmodule.c.h:609
    #14 0x7f6d72de2c06 in cfunction_vectorcall_FASTCALL Objects/methodobject.c:424
    #15 0x7f6d72dba4d2 in _PyObject_VectorcallTstate Include/internal/pycore_call.h:168
    #16 0x7f6d72dba4d2 in PyObject_Vectorcall Objects/call.c:327
    #17 0x7f6d72d2966a in _PyEval_EvalFrameDefault Python/generated_cases.c.h:813
    #18 0x7f6d72dbc722 in _PyObject_VectorcallTstate Include/internal/pycore_call.h:168
    #19 0x7f6d72dbc722 in method_vectorcall Objects/classobject.c:71
    #20 0x7f6d72d2815a in _PyEval_EvalFrameDefault Python/generated_cases.c.h:1355
    #21 0x7f6d72dbb389 in _PyFunction_Vectorcall Objects/call.c:413
    #22 0x7f6d72dbb389 in _PyObject_VectorcallDictTstate Objects/call.c:146
    #23 0x7f6d72dbb389 in _PyObject_Call_Prepend Objects/call.c:504
    #24 0x7f6d72e7cf01 in slot_tp_call Objects/typeobject.c:9570
    #25 0x7f6d72dba3e6 in _PyObject_MakeTpCall Objects/call.c:242
    #26 0x7f6d72d2f906 in _PyEval_EvalFrameDefault Python/generated_cases.c.h:1502
    #27 0x7f6d72dbb389 in _PyFunction_Vectorcall Objects/call.c:413
    #28 0x7f6d72dbb389 in _PyObject_VectorcallDictTstate Objects/call.c:146
    #29 0x7f6d72dbb389 in _PyObject_Call_Prepend Objects/call.c:504
    #30 0x7f6d72e7cf01 in slot_tp_call Objects/typeobject.c:9570
    #31 0x7f6d72dbbaee in _PyObject_Call Objects/call.c:361
    #32 0x7f6d72dbbaee in PyObject_Call Objects/call.c:373
    #33 0x7f6d72d2815a in _PyEval_EvalFrameDefault Python/generated_cases.c.h:1355
    #34 0x7f6d72dbb389 in _PyFunction_Vectorcall Objects/call.c:413
    #35 0x7f6d72dbb389 in _PyObject_VectorcallDictTstate Objects/call.c:146
    #36 0x7f6d72dbb389 in _PyObject_Call_Prepend Objects/call.c:504
    #37 0x7f6d72e7cf01 in slot_tp_call Objects/typeobject.c:9570
    #38 0x7f6d72dba3e6 in _PyObject_MakeTpCall Objects/call.c:242
    #39 0x7f6d72d2f906 in _PyEval_EvalFrameDefault Python/generated_cases.c.h:1502
    #40 0x7f6d72dbb389 in _PyFunction_Vectorcall Objects/call.c:413
    #41 0x7f6d72dbb389 in _PyObject_VectorcallDictTstate Objects/call.c:146
    #42 0x7f6d72dbb389 in _PyObject_Call_Prepend Objects/call.c:504
    #43 0x7f6d72e7cf01 in slot_tp_call Objects/typeobject.c:9570
    #44 0x7f6d72dba3e6 in _PyObject_MakeTpCall Objects/call.c:242
    #45 0x7f6d72d2f906 in _PyEval_EvalFrameDefault Python/generated_cases.c.h:1502
    #46 0x7f6d72dbb389 in _PyFunction_Vectorcall Objects/call.c:413
    #47 0x7f6d72dbb389 in _PyObject_VectorcallDictTstate Objects/call.c:146
    #48 0x7f6d72dbb389 in _PyObject_Call_Prepend Objects/call.c:504
    #49 0x7f6d72e7cf01 in slot_tp_call Objects/typeobject.c:9570
    #50 0x7f6d72dba3e6 in _PyObject_MakeTpCall Objects/call.c:242
    #51 0x7f6d72d2f906 in _PyEval_EvalFrameDefault Python/generated_cases.c.h:1502
    #52 0x7f6d72ea85b3 in PyEval_EvalCode Python/ceval.c:604
    #53 0x7f6d72ea7142 in builtin_exec_impl Python/bltinmodule.c:1143
    #54 0x7f6d72ea7142 in builtin_exec Python/clinic/bltinmodule.c.h:556
    #55 0x7f6d72de29c2 in cfunction_vectorcall_FASTCALL_KEYWORDS Objects/methodobject.c:440
    #56 0x7f6d72dba4d2 in _PyObject_VectorcallTstate Include/internal/pycore_call.h:168
    #57 0x7f6d72dba4d2 in PyObject_Vectorcall Objects/call.c:327
    #58 0x7f6d72d2966a in _PyEval_EvalFrameDefault Python/generated_cases.c.h:813
    #59 0x7f6d72ea85b3 in PyEval_EvalCode Python/ceval.c:604
    #60 0x7f6d72ec6bbc in run_eval_code_obj Python/pythonrun.c:1381
    #61 0x7f6d72ec65f4 in run_mod Python/pythonrun.c:1466
    #62 0x7f6d72ec6514 in pyrun_file Python/pythonrun.c:1295
    #63 0x7f6d72ec636b in _PyRun_SimpleFileObject Python/pythonrun.c:517
    #64 0x7f6d72ec6187 in _PyRun_AnyFileObject Python/pythonrun.c:77
    #65 0x7f6d72ecfb06 in pymain_run_file_obj Modules/main.c:410
    #66 0x7f6d72ecfb06 in pymain_run_file Modules/main.c:429
    #67 0x7f6d72ecfb06 in pymain_run_python Modules/main.c:696
    #68 0x7f6d72ecfb06 in Py_RunMain Modules/main.c:775
    #69 0x7f6d72ecf66a in Py_BytesMain Modules/main.c:829
    #70 0x7f6d7282a1c9  (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 274eec488d230825a136fa9c4d85370fed7a0a5e)
    #71 0x7f6d7282a28a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 274eec488d230825a136fa9c4d85370fed7a0a5e)
    #72 0x56119b7d5094 in _start (/opt/hostedtoolcache/Python/3.13.7/x64/bin/python3.13+0x1094) (BuildId: bf9669d2008ecbbbcbb359aa705bc419c1858020)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (/lib/x86_64-linux-gnu/libc.so.6+0x9eb2c) (BuildId: 274eec488d230825a136fa9c4d85370fed7a0a5e) in pthread_kill
==2689==ABORTING
tests/test_struct.py ...................................................................................................................................................................................................................................................................

I can reproduce the segfault locally on 3.13.7. However, it disappears when I run the tests with pytest -v. That seems odd.

I fixed this issue as follows

--- a/src/msgspec/_core.c
+++ b/src/msgspec/_core.c
@@ -5173,6 +5173,11 @@ Struct_alloc(PyTypeObject *type) {
     if (obj == NULL) return NULL;
     /* Zero out slot fields */
     memset((char *)obj + sizeof(PyObject), '\0', type->tp_basicsize - sizeof(PyObject));
+#if PY313_PLUS
+    if (type->tp_flags & Py_TPFLAGS_INLINE_VALUES) {
+        _PyObject_InitInlineValues(obj, type);
+    }
+#endif
     return obj;
 }

@shadchin

@shadchin would you mind submitting a PR with your fix?

Done #960

Ported to the community fork msgspec-arise: issue #21, PR #28

Fixed by #960. Closing.

Navigation Menu

Repository navigation

Segmentation fault on Python 3.13 when running under ASan #910

Description

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Segmentation fault on Python 3.13 when running under ASan #910

Description

Description

Activity

provinzkraut commented on Nov 24, 2025

shadchin commented on Nov 27, 2025

provinzkraut commented on Nov 27, 2025

shadchin commented on Nov 27, 2025

Siyet commented on Apr 8, 2026

jcrist commented on Apr 8, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions