Repository navigation
Abort when using a tuple subclass instance as the bases parameter for type #132176
Description
Crash report
What happened?
The interpreter will abort when a new type is created using an instance of a subclass of tuple as the bases parameter due to a PyTuple_CheckExact(bases) assertion:
class weird_tuple(tuple): pass
c = type("c", weird_tuple((str,)), {})
python: Objects/typeobject.c:500: set_tp_bases: Assertion `PyTuple_CheckExact(bases)' failed.
Aborted (core dumped)Found using fusil by @vstinner.
CPython versions tested on:
CPython main branch
Operating systems tested on:
Linux
Output from running 'python -VV' on the command line:
Python 3.14.0a6+ (heads/main:04bc681e7cf, Apr 4 2025, 12:38:19) [GCC 11.4.0]
Activity
xuantengh commentedon Apr 7, 2025
The doc states the 2nd arg when
type()receives 3 arguments should be atuple. Maybe we should raise an exception ifbasescannot pass thePyTuple_CheckExactcheck?devdanzin commentedon Apr 7, 2025
Maybe, but it works in release builds, resulting in a class where
__bases__is the instance of the tuple subclass we passed totype. So there's a chance somebody out there is using this in some way.xuantengh commentedon Apr 7, 2025
Otherwise we should relax the assert with
PyTuple_Check.sobolevn commentedon Apr 7, 2025
I think that it should be an exact tuple for
_Py_SetImmortalcall and it can be a tuple subclass for regular classes. This problem exists since 3.12Thanks for the report! 🤝
pythongh-132176: Fix crash on `type()` when `tuple` subclass passed a…
gh-132176: Fix crash on `type()` when `tuple` subclass passed as `bas…
pythongh-132176: Fix crash on `type()` when `tuple` subclass passed a…
[3.13] gh-132176: Fix crash on `type()` when `tuple` subclass passed …