Repository navigation
3.14a7 regression: Segfault with PyQt6 in _Py_TYPE #132454
Description
Crash report
What happened?
With Python 3.14 Alpha 6, PyQt6 seems to work perfectly fine. On Alpha 7, however, a python3 -c "from PyQt6 import QtCore" immediately segfaults:
Program received signal SIGSEGV, Segmentation fault.
0x00007ffff75e765e in _Py_TYPE (ob=0xffffffffffffffff) at /usr/include/python3.14/object.h:270
270 return ob->ob_type;in:
#0 0x00007ffff75e765e in _Py_TYPE (ob=0xffffffffffffffff) at /usr/include/python3.14/object.h:270
#1 createClassType (client=client@entry=0x7ffff7537a40 <sipModuleAPI_QtCore>, ctd=0x7ffff7509960 <sipTypeDef_QtCore_PyQtMutexLocker>,
mod_dict=mod_dict@entry=0x7ffff7675670) at [...]/pyqt6-sip_[...]/sip_core.c:5721
#2 0x00007ffff75ee1d3 in sip_api_init_module (client=0x7ffff7537a40 <sipModuleAPI_QtCore>, mod_dict=0x7ffff7675670)
at [...]/pyqt6-sip_[...]/sip_core.c:1667
#3 0x00007ffff739e960 in PyInit_QtCore () from [...]/python3.14/site-packages/PyQt6/[QtCore.abi3.so](http://qtcore.abi3.so/)
#4 0x00005555558046db in _PyImport_RunModInitFunc (p0=p0@entry=0x7ffff739e820 <PyInit_QtCore>, info=info@entry=0x7fffffffc2c0,
p_res=p_res@entry=0x7fffffffc230) at ./Python/importdl.c:430Full traceback
On the current `main` branch, 9634085:#0 0x00007ffff75e765e in _Py_TYPE (ob=0xffffffffffffffff) at /usr/include/python3.14/object.h:270
#1 createClassType (client=client@entry=0x7ffff7537a40 <sipModuleAPI_QtCore>, ctd=0x7ffff7509960 <sipTypeDef_QtCore_PyQtMutexLocker>, mod_dict=mod_dict@entry=0x7ffff7675910) at /tmp/pip-install-t41fe3xw/pyqt6-sip_d2261e560e79460e8c0f8c7429b3599e/sip_core.c:5721
#2 0x00007ffff75ee1d3 in sip_api_init_module (client=0x7ffff7537a40 <sipModuleAPI_QtCore>, mod_dict=0x7ffff7675910) at /tmp/pip-install-t41fe3xw/pyqt6-sip_d2261e560e79460e8c0f8c7429b3599e/sip_core.c:1667
#3 0x00007ffff739e960 in PyInit_QtCore () from /home/florian/proj/cpython/.venv/lib/python3.14/site-packages/PyQt6/QtCore.abi3.so
#4 0x000055555580581b in _PyImport_RunModInitFunc (p0=p0@entry=0x7ffff739e820 <PyInit_QtCore>, info=info@entry=0x7fffffffc2f0, p_res=p_res@entry=0x7fffffffc260) at ./Python/importdl.c:430
#5 0x000055555580237b in import_run_extension (tstate=tstate@entry=0x555555b97588 <_PyRuntime+330792>, p0=p0@entry=0x7ffff739e820 <PyInit_QtCore>, info=info@entry=0x7fffffffc2f0, spec=spec@entry=0x7ffff76062c0, modules=<optimized out>) at Python/import.c:2003
#6 0x0000555555803051 in _imp_create_dynamic_impl (module=module@entry=0x7ffff7c66f30, spec=0x7ffff76062c0, file=<optimized out>) at Python/import.c:4704
#7 0x00005555558030cf in _imp_create_dynamic (module=0x7ffff7c66f30, args=args@entry=0x7ffff77e9a60, nargs=nargs@entry=1) at Python/clinic/import.c.h:488
#8 0x00005555556bd9ed in cfunction_vectorcall_FASTCALL (func=0x7ffff7c858b0, args=0x7ffff77e9a60, nargsf=<optimized out>, kwnames=<optimized out>) at Objects/methodobject.c:454
#9 0x000055555566a1bd in _PyVectorcall_Call (tstate=tstate@entry=0x555555b97588 <_PyRuntime+330792>, func=0x5555556bd990 <cfunction_vectorcall_FASTCALL>, callable=callable@entry=0x7ffff7c858b0, tuple=tuple@entry=0x7ffff77e9a40, kwargs=kwargs@entry=0x7ffff77dce90)
at Objects/call.c:273
#10 0x000055555566a431 in _PyObject_Call (tstate=0x555555b97588 <_PyRuntime+330792>, callable=callable@entry=0x7ffff7c858b0, args=args@entry=0x7ffff77e9a40, kwargs=kwargs@entry=0x7ffff77dce90) at Objects/call.c:348
#11 0x000055555566a469 in PyObject_Call (callable=callable@entry=0x7ffff7c858b0, args=args@entry=0x7ffff77e9a40, kwargs=kwargs@entry=0x7ffff77dce90) at Objects/call.c:373
#12 0x00005555557a15a9 in _PyEval_EvalFrameDefault (tstate=<optimized out>, frame=0x7ffff7b5f500, throwflag=0) at Python/generated_cases.c.h:2461
#13 0x00005555557bbc02 in _PyEval_EvalFrame (tstate=tstate@entry=0x555555b97588 <_PyRuntime+330792>, frame=frame@entry=0x7ffff7b5f1e8, throwflag=throwflag@entry=0) at ./Include/internal/pycore_ceval.h:119
#14 0x00005555557bbdc7 in _PyEval_Vector (tstate=0x555555b97588 <_PyRuntime+330792>, func=0x7ffff7c89250, locals=locals@entry=0x0, args=0x7fffffffc8a0, argcount=<optimized out>, kwnames=0x0) at Python/ceval.c:1913
#15 0x0000555555668520 in _PyFunction_Vectorcall (func=<optimized out>, stack=<optimized out>, nargsf=<optimized out>, kwnames=<optimized out>) at Objects/call.c:413
#16 0x000055555566886f in _PyObject_VectorcallTstate (tstate=tstate@entry=0x555555b97588 <_PyRuntime+330792>, callable=callable@entry=0x7ffff7c89250, args=args@entry=0x7fffffffc8a0, nargsf=nargsf@entry=2, kwnames=kwnames@entry=0x0)
at ./Include/internal/pycore_call.h:169
#17 0x00005555556696d2 in object_vacall (tstate=tstate@entry=0x555555b97588 <_PyRuntime+330792>, base=base@entry=0x0, callable=0x7ffff7c89250, vargs=vargs@entry=0x7fffffffc920) at Objects/call.c:819
#18 0x000055555566980b in PyObject_CallMethodObjArgs (obj=0x0, name=<optimized out>) at Objects/call.c:880
#19 0x000055555580053a in import_find_and_load (tstate=tstate@entry=0x555555b97588 <_PyRuntime+330792>, abs_name=abs_name@entry=0x7ffff77b3b50) at Python/import.c:3692
#20 0x000055555580412a in PyImport_ImportModuleLevelObject (name=name@entry=0x7ffff77b3b50, globals=globals@entry=0x0, locals=locals@entry=0x0, fromlist=fromlist@entry=0x0, level=level@entry=0) at Python/import.c:3774
#21 0x0000555555793422 in builtin___import___impl (module=module@entry=0x7ffff7c64230, name=name@entry=0x7ffff77b3b50, globals=globals@entry=0x0, locals=locals@entry=0x0, fromlist=fromlist@entry=0x0, level=level@entry=0) at Python/bltinmodule.c:285
#22 0x0000555555793572 in builtin___import__ (module=0x7ffff7c64230, args=<optimized out>, args@entry=0x7ffff77b3b30, nargs=nargs@entry=1, kwnames=kwnames@entry=0x0) at Python/clinic/bltinmodule.c.h:110
#23 0x00005555556bd848 in cfunction_vectorcall_FASTCALL_KEYWORDS (func=0x7ffff7c64350, args=0x7ffff77b3b30, nargsf=<optimized out>, kwnames=0x0) at Objects/methodobject.c:470
#24 0x000055555566a1bd in _PyVectorcall_Call (tstate=tstate@entry=0x555555b97588 <_PyRuntime+330792>, func=0x5555556bd7f5 <cfunction_vectorcall_FASTCALL_KEYWORDS>, callable=callable@entry=0x7ffff7c64350, tuple=tuple@entry=0x7ffff77b3b10,
kwargs=kwargs@entry=0x7ffff77dc7d0) at Objects/call.c:273
#25 0x000055555566a431 in _PyObject_Call (tstate=0x555555b97588 <_PyRuntime+330792>, callable=callable@entry=0x7ffff7c64350, args=args@entry=0x7ffff77b3b10, kwargs=kwargs@entry=0x7ffff77dc7d0) at Objects/call.c:348
#26 0x000055555566a469 in PyObject_Call (callable=callable@entry=0x7ffff7c64350, args=args@entry=0x7ffff77b3b10, kwargs=kwargs@entry=0x7ffff77dc7d0) at Objects/call.c:373
#27 0x00005555557a15a9 in _PyEval_EvalFrameDefault (tstate=<optimized out>, frame=0x7ffff7b5f158, throwflag=0) at Python/generated_cases.c.h:2461
#28 0x00005555557bbc02 in _PyEval_EvalFrame (tstate=tstate@entry=0x555555b97588 <_PyRuntime+330792>, frame=frame@entry=0x7ffff7b5f080, throwflag=throwflag@entry=0) at ./Include/internal/pycore_ceval.h:119
#29 0x00005555557bbdc7 in _PyEval_Vector (tstate=0x555555b97588 <_PyRuntime+330792>, func=0x7ffff7c893d0, locals=locals@entry=0x0, args=0x7fffffffd080, argcount=<optimized out>, kwnames=0x0) at Python/ceval.c:1913
#30 0x0000555555668520 in _PyFunction_Vectorcall (func=<optimized out>, stack=<optimized out>, nargsf=<optimized out>, kwnames=<optimized out>) at Objects/call.c:413
#31 0x000055555566886f in _PyObject_VectorcallTstate (tstate=tstate@entry=0x555555b97588 <_PyRuntime+330792>, callable=callable@entry=0x7ffff7c893d0, args=args@entry=0x7fffffffd080, nargsf=nargsf@entry=3, kwnames=kwnames@entry=0x0)
at ./Include/internal/pycore_call.h:169
#32 0x00005555556696d2 in object_vacall (tstate=tstate@entry=0x555555b97588 <_PyRuntime+330792>, base=base@entry=0x0, callable=0x7ffff7c893d0, vargs=vargs@entry=0x7fffffffd100) at Objects/call.c:819
#33 0x000055555566980b in PyObject_CallMethodObjArgs (obj=0x0, name=<optimized out>) at Objects/call.c:880
#34 0x0000555555804322 in PyImport_ImportModuleLevelObject (name=name@entry=0x7ffff77d7ec0, globals=<optimized out>, locals=locals@entry=0x7ffff77a7b30, fromlist=fromlist@entry=0x7ffff7c83fc0, level=level@entry=0) at Python/import.c:3842
#35 0x0000555555799f65 in _PyEval_ImportName (tstate=tstate@entry=0x555555b97588 <_PyRuntime+330792>, frame=frame@entry=0x7ffff7b5f020, name=name@entry=0x7ffff77d7ec0, fromlist=fromlist@entry=0x7ffff7c83fc0, level=level@entry=0x555555b4df18 <_PyRuntime+30136>)
at Python/ceval.c:2838
#36 0x00005555557ab3aa in _PyEval_EvalFrameDefault (tstate=<optimized out>, frame=0x7ffff7b5f020, throwflag=0) at Python/generated_cases.c.h:6066
#37 0x00005555557bbc02 in _PyEval_EvalFrame (tstate=tstate@entry=0x555555b97588 <_PyRuntime+330792>, frame=frame@entry=0x7ffff7b5f020, throwflag=throwflag@entry=0) at ./Include/internal/pycore_ceval.h:119
#38 0x00005555557bbdc7 in _PyEval_Vector (tstate=tstate@entry=0x555555b97588 <_PyRuntime+330792>, func=func@entry=0x7ffff77e0650, locals=locals@entry=0x7ffff77a7b30, args=args@entry=0x0, argcount=argcount@entry=0, kwnames=kwnames@entry=0x0) at Python/ceval.c:1913
#39 0x00005555557bbebf in PyEval_EvalCode (co=co@entry=0x7ffff7791140, globals=globals@entry=0x7ffff77a7b30, locals=locals@entry=0x7ffff77a7b30) at Python/ceval.c:829
#40 0x0000555555831f4f in run_eval_code_obj (tstate=tstate@entry=0x555555b97588 <_PyRuntime+330792>, co=co@entry=0x7ffff7791140, globals=globals@entry=0x7ffff77a7b30, locals=locals@entry=0x7ffff77a7b30) at Python/pythonrun.c:1365
#41 0x00005555558320f5 in run_mod (mod=mod@entry=0x555555d2ccd0, filename=filename@entry=0x7ffff77b0770, globals=globals@entry=0x7ffff77a7b30, locals=locals@entry=0x7ffff77a7b30, flags=flags@entry=0x7fffffffd840, arena=arena@entry=0x7ffff77a7fa0,
interactive_src=0x7ffff77dc9a0, generate_new_source=0) at Python/pythonrun.c:1436
#42 0x0000555555832a3c in _PyRun_StringFlagsWithName (str=str@entry=0x7ffff77dca80 "from PyQt6 import QtCore\n", name=name@entry=0x7ffff77b0770, start=start@entry=257, globals=globals@entry=0x7ffff77a7b30, locals=locals@entry=0x7ffff77a7b30,
flags=flags@entry=0x7fffffffd840, generate_new_source=0) at Python/pythonrun.c:1259
#43 0x00005555558344fc in _PyRun_SimpleStringFlagsWithName (command=0x7ffff77dca80 "from PyQt6 import QtCore\n", name=name@entry=0x5555558d156c "<string>", flags=flags@entry=0x7fffffffd840) at Python/pythonrun.c:578
#44 0x000055555585c951 in pymain_run_command (command=<optimized out>) at Modules/main.c:255
#45 0x000055555585d6ec in pymain_run_python (exitcode=exitcode@entry=0x7fffffffd8e4) at Modules/main.c:671
#46 0x000055555585daf9 in Py_RunMain () at Modules/main.c:761
#47 0x000055555585db70 in pymain_main (args=args@entry=0x7fffffffd940) at Modules/main.c:791
#48 0x000055555585dc36 in Py_BytesMain (argc=<optimized out>, argv=<optimized out>) at Modules/main.c:815
#49 0x00005555555d8902 in main (argc=<optimized out>, argv=<optimized out>) at ./Programs/python.c:15I was able to bisect this to 8614f86:
cc @mdboom
I don't have a minimal reproducer unfortunately as I've never used the C API before; but according to the PyQt author:
Just by visual inspection of the code, I think the sequence of calls is...
static PyTypeObject BaseType { ... }; PyType_Ready(&BaseType); PyObject *base_tup = PyTuple_Pack(1, (PyObject *)&BaseType); PyObject *base_ref = PyTuple_GET_ITEM(base_tup, 0); Py_TYPE(base_ref); // Crashes here (because base_ref is -1?)...so I don't think I'm doing anything bad.
CPython versions tested on:
3.14
Operating systems tested on:
Linux
Output from running 'python -VV' on the command line:
Python 3.14.0a7 (tags/v3.14.0a7:29af6cee02f, Apr 12 2025, 21:45:20) [GCC 14.2.1 20250207]
Activity
ZeroIntensity commentedon Apr 12, 2025
At a glance, there's probably some incorrect inheritance. #131529 added a hash field, and from the looks of it, that hash isn't being accounted for in the subtype structure, so the reference count is being treated as the hash (thus the
-1value). It would be nice to see the actual source here; where is PyQt6 hosted?The-Compiler commentedon Apr 12, 2025
The easiest way to get the canonical sources is from PyPI, I believe the interesting parts (
sip_api_init_moduleandcreateClassType) are all insip_core.cwhich is part of PyQt6-sip.The same file also seems to be hosted here: https://github.com/Python-SIP/sip/blob/350f56b80fe8a4d027ad6b301be607cc8c921a19/sipbuild/module/source/13/10/sip_core.c#L5721
neonene commentedon Apr 13, 2025
FYI, I could not confirm the crash on Windows, trying alpha7 with PyPI's PyQt5&6 binaries (
PyTuple_GET_ITEM(bases, 0)did not show-1insip_core.c).The-Compiler commentedon Apr 13, 2025
The PyQt maintainer mentioned:
However, the
pip installlogs point at the correct headers:Full build log
So I don't think that's the actual issue here?
The-Compiler commentedon Apr 13, 2025
Huh. I just tried again, with a fresh CPython v3.14.0a7 build and a clean virtualenv and everything, and suddenly things look good now:
Not sure what to make of this. So maybe there isn't any issue after all?
ZeroIntensity commentedon Apr 13, 2025
Is it possible you used a version built for a prior 3.14 alpha? The ABI changes between alphas, so that would make sense.
The-Compiler commentedon Apr 13, 2025
Not deliberately! I tried a clean build before and could still reproduce the issue, but there must have been some caching going on somewhere.
Originally I noticed the issue on GitHub Actions, and there it was because I'm caching
~/.cache/pipbut didn't have the Python alpha as part of the cache key (and neither did pip, apparently?). After nuking the cache there as well, everything seems to work on CI again, so this probably was it.Sorry for the noise!