Skip to content

use-after-free: functools partial #154189

Closed
Closed
use-after-free: functools partial#154189
Labels
extension-modulesC modules in the Modules dirtype-bugAn unexpected behavior, bug, or error

Description

@johng
johng
opened on Jul 19, 2026

Bug report

Bug description:

Similar to #144475 although this is a use after free gap.

def test_call_safety_against_reentrant_mutation(self):
        partial = self.partial

        def original(*args, **kwargs):
            return "original"

        def replacement(*args, **kwargs):
            return "replacement"

        g = None

        class EvilKey(str):
            armed = False
            def __hash__(self):
                if EvilKey.armed and g is not None:
                    EvilKey.armed = False
                    # Reset g, freeing the old (uniquely referenced) args
                    # tuple.  New args of a different length avoid recycling
                    # that freed block, so any dangling read hits freed memory.
                    g.__setstate__((replacement, (), {"k": 1}, None))
                    gc.collect()
                return str.__hash__(self)
            def __eq__(self, other):
                return str.__eq__(self, other)

        # Stored positionals (non-trivial pto->args) plus a stored keyword so
        # the keyword-merge path -- which hashes the call keywords -- runs.
        stored = tuple(object() for _ in range(5))
        g = partial(original, *stored, k=0)
        del stored

        ek = EvilKey("zzz")
        kwargs = {ek: 2}          # hashed here while disarmed: no re-entrancy
        EvilKey.armed = True
        # Must not crash (use-after-free in the C partial before the fix).
        g(**kwargs)
        self.assertFalse(EvilKey.armed)  # the re-entrant __setstate__ ran

Inside of partial_vectorcall we store a raw pointer of pto->args in pto_args, however with the EvilKey we can reset pto->args causing a UAF gap.

Unsure how much of an issue this is though.

Details ./python.exe -m test test_functools -v -m test_call_safety_against_reentrant_mutation == CPython 3.16.0a0 free-threading build (heads/find-memory-leaks-dirty:69d44f80b5, Jul 19 2026, 20:02:27) [Clang 21.0.0 (clang-2100.0.123.102)] == macOS-26.3.2-arm64-arm-64bit-Mach-O little-endian == Python build: free_threading debug TSAN == cwd: /Users/johng/repos/cpython/build/test_python_worker_6548æ == CPU count: 18 == encodings: locale=UTF-8 FS=utf-8 == resources: all test resources are disabled, use -u option to unskip tests == sanitizers: thread

Using random seed: 952320050
0:00:00 load avg: 4.25 mem: 131.7 MiB Run 1 test sequentially in a single process
0:00:00 load avg: 4.25 mem: 131.7 MiB [1/1] test_functools
test_call_safety_against_reentrant_mutation (test.test_functools.TestPartialC.test_call_safety_against_reentrant_mutation) ... Fatal Python error: Segmentation fault

Stack (most recent call first): File "/Users/johng/repos/cpython/Lib/test/test_functools.py", line 622 in test_call_safety_against_reentrant_mutation File "/Users/johng/repos/cpython/Lib/unittest/case.py", line 637 in _callTestMethod File "/Users/johng/repos/cpython/Lib/unittest/case.py", line 691 in run File "/Users/johng/repos/cpython/Lib/unittest/case.py", line 747 in __call__ File "/Users/johng/repos/cpython/Lib/unittest/suite.py", line 122 in run File "/Users/johng/repos/cpython/Lib/unittest/suite.py", line 84 in __call__ File "/Users/johng/repos/cpython/Lib/unittest/suite.py", line 122 in run File "/Users/johng/repos/cpython/Lib/unittest/suite.py", line 84 in __call__ File "/Users/johng/repos/cpython/Lib/unittest/runner.py", line 256 in run File "/Users/johng/repos/cpython/Lib/test/libregrtest/single.py", line 84 in _run_suite File "/Users/johng/repos/cpython/Lib/test/libregrtest/single.py", line 42 in run_unittest File "/Users/johng/repos/cpython/Lib/test/libregrtest/single.py", line 162 in test_func File "/Users/johng/repos/cpython/Lib/test/libregrtest/single.py", line 118 in regrtest_runner File "/Users/johng/repos/cpython/Lib/test/libregrtest/single.py", line 165 in _load_run_test File "/Users/johng/repos/cpython/Lib/test/libregrtest/single.py", line 210 in _runtest_env_changed_exc File "/Users/johng/repos/cpython/Lib/test/libregrtest/single.py", line 319 in _runtest File "/Users/johng/repos/cpython/Lib/test/libregrtest/single.py", line 348 in run_single_test File "/Users/johng/repos/cpython/Lib/test/libregrtest/main.py", line 390 in run_test File "/Users/johng/repos/cpython/Lib/test/libregrtest/main.py", line 425 in run_tests_sequentially File "/Users/johng/repos/cpython/Lib/test/libregrtest/main.py", line 565 in _run_tests File "/Users/johng/repos/cpython/Lib/test/libregrtest/main.py", line 600 in run_tests File "/Users/johng/repos/cpython/Lib/test/libregrtest/main.py", line 793 in main File "/Users/johng/repos/cpython/Lib/test/libregrtest/main.py", line 801 in main File "/Users/johng/repos/cpython/Lib/test/__main__.py", line 2 in File "/Users/johng/repos/cpython/Lib/runpy.py", line 87 in _run_code File "/Users/johng/repos/cpython/Lib/runpy.py", line 201 in _run_module_as_main

Current thread's C stack trace (most recent call first):
Binary file "/Users/johng/repos/cpython/python.exe", at _Py_DumpStack+0x44 [0x102720a10]
Binary file "/Users/johng/repos/cpython/python.exe", at faulthandler_fatal_error+0x2c4 [0x10274efac]
Binary file "/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/lib/clang/21/lib/darwin/libclang_rt.tsan_osx_dynamic.dylib", at _ZN6__tsanL21CallUserSignalHandlerEPNS_11ThreadStateEbbiPN11__sanitizer23__sanitizer_siginfo_padEPv+0xfc [0x103405274]
Binary file "/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/lib/clang/21/lib/darwin/libclang_rt.tsan_osx_dynamic.dylib", at _Z10sighandleriPN11__sanitizer23__sanitizer_siginfo_padEPv+0x1cc [0x1034054d4]
Binary file "/usr/lib/system/libsystem_platform.dylib", at _sigtramp+0x38 [0x1963f1764]
Binary file "/Users/johng/repos/cpython/python.exe", at partial_vectorcall+0x370 [0x10282204c]
Binary file "/Users/johng/repos/cpython/python.exe", at partial_vectorcall+0x370 [0x10282204c]
Binary file "/Users/johng/repos/cpython/python.exe", at _PyVectorcall_Call+0xe4 [0x10247f7b0]
Binary file "/Users/johng/repos/cpython/python.exe", at _PyEval_EvalFrameDefault+0x837c [0x102628d40]
Binary file "/Users/johng/repos/cpython/python.exe", at _PyEval_Vector+0x350 [0x10261ec5c]
Binary file "/Users/johng/repos/cpython/python.exe", at _PyObject_VectorcallTstate+0x74 [0x10247e938]
Binary file "/Users/johng/repos/cpython/python.exe", at _PyObject_VectorcallPrepend+0x154 [0x102480b4c]
Binary file "/Users/johng/repos/cpython/python.exe", at _PyEval_EvalFrameDefault+0x837c [0x102628d40]
Binary file "/Users/johng/repos/cpython/python.exe", at _PyEval_Vector+0x350 [0x10261ec5c]
Binary file "/Users/johng/repos/cpython/python.exe", at _PyObject_VectorcallDictTstate+0x170 [0x10247eb30]
Binary file "/Users/johng/repos/cpython/python.exe", at _PyObject_Call_Prepend+0xd4 [0x10247fdb4]
Binary file "/Users/johng/repos/cpython/python.exe", at call_method+0x9c [0x10255c8c0]
Binary file "/Users/johng/repos/cpython/python.exe", at _PyObject_MakeTpCall+0x120 [0x10247ed18]
Binary file "/Users/johng/repos/cpython/python.exe", at _Py_VectorCall_StackRefSteal+0x118 [0x10261ee60]
Binary file "/Users/johng/repos/cpython/python.exe", at _PyEval_EvalFrameDefault+0xb8cc [0x10262c290]
Binary file "/Users/johng/repos/cpython/python.exe", at _PyEval_Vector+0x350 [0x10261ec5c]
Binary file "/Users/johng/repos/cpython/python.exe", at _PyObject_VectorcallTstate+0x74 [0x10247e938]
Binary file "/Users/johng/repos/cpython/python.exe", at _PyObject_VectorcallPrepend+0x154 [0x102480b4c]
Binary file "/Users/johng/repos/cpython/python.exe", at _PyEval_EvalFrameDefault+0x798c [0x102628350]
Binary file "/Users/johng/repos/cpython/python.exe", at _PyEval_Vector+0x350 [0x10261ec5c]
Binary file "/Users/johng/repos/cpython/python.exe", at _PyObject_VectorcallDictTstate+0x170 [0x10247eb30]
Binary file "/Users/johng/repos/cpython/python.exe", at _PyObject_Call_Prepend+0xd4 [0x10247fdb4]
Binary file "/Users/johng/repos/cpython/python.exe", at call_method+0x9c [0x10255c8c0]
Binary file "/Users/johng/repos/cpython/python.exe", at _PyObject_MakeTpCall+0x120 [0x10247ed18]
Binary file "/Users/johng/repos/cpython/python.exe", at _Py_VectorCall_StackRefSteal+0x118 [0x10261ee60]
Binary file "/Users/johng/repos/cpython/python.exe", at _PyEval_EvalFrameDefault+0xb8cc [0x10262c290]
Binary file "/Users/johng/repos/cpython/python.exe", at _PyEval_Vector+0x350 [0x10261ec5c]

Extension modules: _testcapi (total: 1)
ThreadSanitizer:DEADLYSIGNAL
==6548==ERROR: ThreadSanitizer: SEGV on unknown address 0x000000000000 (pc 0x0001024eb61c bp 0x00016da153e0 sp 0x00016da153a0 T35112809)
==6548==The signal is caused by a READ memory access.
==6548==Hint: address points to the zero page.
#0 _PyDict_Contains_KnownHash dictobject.c:5315 (python.exe:arm64+0x10010b61c)
#1 partial_vectorcall _functoolsmodule.c:460 (python.exe:arm64+0x100442048)
#2 _PyVectorcall_Call call.c:285 (python.exe:arm64+0x10009f7ac)
#3 _PyEval_EvalFrameDefault generated_cases.c.h:3161 (python.exe:arm64+0x100248d3c)
#4 _PyEval_Vector ceval.c:2172 (python.exe:arm64+0x10023ec58)
#5 _PyObject_VectorcallTstate pycore_call.h:144 (python.exe:arm64+0x10009e934)
#6 _PyObject_VectorcallPrepend call.c:877 (python.exe:arm64+0x1000a0b48)
#7 _PyEval_EvalFrameDefault generated_cases.c.h:3161 (python.exe:arm64+0x100248d3c)
#8 _PyEval_Vector ceval.c:2172 (python.exe:arm64+0x10023ec58)
#9 _PyObject_VectorcallDictTstate call.c:135 (python.exe:arm64+0x10009eb2c)
#10 _PyObject_Call_Prepend call.c:504 (python.exe:arm64+0x10009fdb0)
#11 call_method typeobject.c:3100 (python.exe:arm64+0x10017c8bc)
#12 _PyObject_MakeTpCall call.c:242 (python.exe:arm64+0x10009ed14)
#13 _Py_VectorCall_StackRefSteal ceval.c:726 (python.exe:arm64+0x10023ee5c)
#14 _PyEval_EvalFrameDefault generated_cases.c.h:4559 (python.exe:arm64+0x10024c28c)
#15 _PyEval_Vector ceval.c:2172 (python.exe:arm64+0x10023ec58)
#16 _PyObject_VectorcallTstate pycore_call.h:144 (python.exe:arm64+0x10009e934)
#17 _PyObject_VectorcallPrepend call.c:877 (python.exe:arm64+0x1000a0b48)
#18 _PyEval_EvalFrameDefault generated_cases.c.h:2831 (python.exe:arm64+0x10024834c)
#19 _PyEval_Vector ceval.c:2172 (python.exe:arm64+0x10023ec58)
#20 _PyObject_VectorcallDictTstate call.c:135 (python.exe:arm64+0x10009eb2c)
#21 _PyObject_Call_Prepend call.c:504 (python.exe:arm64+0x10009fdb0)
#22 call_method typeobject.c:3100 (python.exe:arm64+0x10017c8bc)
#23 _PyObject_MakeTpCall call.c:242 (python.exe:arm64+0x10009ed14)
#24 _Py_VectorCall_StackRefSteal ceval.c:726 (python.exe:arm64+0x10023ee5c)
#25 _PyEval_EvalFrameDefault generated_cases.c.h:4559 (python.exe:arm64+0x10024c28c)
#26 _PyEval_Vector ceval.c:2172 (python.exe:arm64+0x10023ec58)
#27 _PyObject_VectorcallTstate pycore_call.h:144 (python.exe:arm64+0x10009e934)
#28 _PyObject_VectorcallPrepend call.c:877 (python.exe:arm64+0x1000a0b48)
#29 _PyEval_EvalFrameDefault generated_cases.c.h:3161 (python.exe:arm64+0x100248d3c)
#30 _PyEval_Vector ceval.c:2172 (python.exe:arm64+0x10023ec58)
#31 _PyObject_VectorcallDictTstate call.c:135 (python.exe:arm64+0x10009eb2c)
#32 _PyObject_Call_Prepend call.c:504 (python.exe:arm64+0x10009fdb0)
#33 call_method typeobject.c:3100 (python.exe:arm64+0x10017c8bc)
#34 _PyObject_MakeTpCall call.c:242 (python.exe:arm64+0x10009ed14)
#35 _Py_VectorCallInstrumentation_StackRefSteal ceval.c:768 (python.exe:arm64+0x10023f3a8)
#36 _PyEval_EvalFrameDefault generated_cases.c.h:1906 (python.exe:arm64+0x1002462d0)
#37 _PyEval_Vector ceval.c:2172 (python.exe:arm64+0x10023ec58)
#38 PyEval_EvalCode ceval.c:679 (python.exe:arm64+0x10023e708)
#39 builtin_exec bltinmodule.c.h:676 (python.exe:arm64+0x1002382a0)
#40 cfunction_vectorcall_FASTCALL_KEYWORDS methodobject.c:465 (python.exe:arm64+0x100126060)
#41 _PyObject_VectorcallTstate pycore_call.h:144 (python.exe:arm64+0x10009e934)
#42 _Py_VectorCallInstrumentation_StackRefSteal ceval.c:768 (python.exe:arm64+0x10023f3a8)
#43 _PyEval_EvalFrameDefault generated_cases.c.h:1906 (python.exe:arm64+0x1002462d0)
#44 _PyEval_Vector ceval.c:2172 (python.exe:arm64+0x10023ec58)
#45 pymain_run_module main.c:420 (python.exe:arm64+0x100351668)
#46 Py_RunMain main.c:891 (python.exe:arm64+0x1003510e8)
#47 pymain_main main.c:921 (python.exe:arm64+0x100351560)
#48 Py_BytesMain main.c:945 (python.exe:arm64+0x1003515b0)
#49 start (dyld:arm64e+0x8d50)

==6548==Register values:
x[0] = 0xdddddddddddddddd x[1] = 0x0000000302c51520 x[2] = 0x87e87aa3ff897c45 x[3] = 0x00000003035f6a80
x[4] = 0x00000001033fc6d8 x[5] = 0x0000000000000063 x[6] = 0x0000000000000070 x[7] = 0x0000000102b31ca0
x[8] = 0x0000000000000000 x[9] = 0x72331224a8250b2b x[10] = 0x011062c8e6dcd17b x[11] = 0x0000000000000002
x[12] = 0x000000000001c5af x[13] = 0x591cdb992c3f488c x[14] = 0x000000008f01dca6 x[15] = 0x011562c8e6dcd17b
x[16] = 0x00000001963f10b0 x[17] = 0x0000000103480820 x[18] = 0x0000000000000000 x[19] = 0x0000000303bf1510
x[20] = 0x0000000302c51520 x[21] = 0x87e87aa3ff897c45 x[22] = 0x00000003020917e8 x[23] = 0x0000000000000000
x[24] = 0x0000000102ad60d8 x[25] = 0x8000000000000000 x[26] = 0x0000000303bf04c0 x[27] = 0x0000000303bf0490
x[28] = 0x0000000000000000 fp = 0x000000016da153e0 lr = 0x000000010282204c sp = 0x000000016da153a0
ThreadSanitizer can not provide additional info.
SUMMARY: ThreadSanitizer: SEGV dictobject.c:5315 in _PyDict_Contains_KnownHash
==6548==ABORTING
Fatal Python error: Aborted

Stack (most recent call first): File "/Users/johng/repos/cpython/Lib/test/test_functools.py", line 622 in test_call_safety_against_reentrant_mutation File "/Users/johng/repos/cpython/Lib/unittest/case.py", line 637 in _callTestMethod File "/Users/johng/repos/cpython/Lib/unittest/case.py", line 691 in run File "/Users/johng/repos/cpython/Lib/unittest/case.py", line 747 in __call__ File "/Users/johng/repos/cpython/Lib/unittest/suite.py", line 122 in run File "/Users/johng/repos/cpython/Lib/unittest/suite.py", line 84 in __call__ File "/Users/johng/repos/cpython/Lib/unittest/suite.py", line 122 in run File "/Users/johng/repos/cpython/Lib/unittest/suite.py", line 84 in __call__ File "/Users/johng/repos/cpython/Lib/unittest/runner.py", line 256 in run File "/Users/johng/repos/cpython/Lib/test/libregrtest/single.py", line 84 in _run_suite File "/Users/johng/repos/cpython/Lib/test/libregrtest/single.py", line 42 in run_unittest File "/Users/johng/repos/cpython/Lib/test/libregrtest/single.py", line 162 in test_func File "/Users/johng/repos/cpython/Lib/test/libregrtest/single.py", line 118 in regrtest_runner File "/Users/johng/repos/cpython/Lib/test/libregrtest/single.py", line 165 in _load_run_test File "/Users/johng/repos/cpython/Lib/test/libregrtest/single.py", line 210 in _runtest_env_changed_exc File "/Users/johng/repos/cpython/Lib/test/libregrtest/single.py", line 319 in _runtest File "/Users/johng/repos/cpython/Lib/test/libregrtest/single.py", line 348 in run_single_test File "/Users/johng/repos/cpython/Lib/test/libregrtest/main.py", line 390 in run_test File "/Users/johng/repos/cpython/Lib/test/libregrtest/main.py", line 425 in run_tests_sequentially File "/Users/johng/repos/cpython/Lib/test/libregrtest/main.py", line 565 in _run_tests File "/Users/johng/repos/cpython/Lib/test/libregrtest/main.py", line 600 in run_tests File "/Users/johng/repos/cpython/Lib/test/libregrtest/main.py", line 793 in main File "/Users/johng/repos/cpython/Lib/test/libregrtest/main.py", line 801 in main File "/Users/johng/repos/cpython/Lib/test/__main__.py", line 2 in File "/Users/johng/repos/cpython/Lib/runpy.py", line 87 in _run_code File "/Users/johng/repos/cpython/Lib/runpy.py", line 201 in _run_module_as_main

Current thread's C stack trace (most recent call first):
Binary file "/Users/johng/repos/cpython/python.exe", at _Py_DumpStack+0x44 [0x102720a10]
Binary file "/Users/johng/repos/cpython/python.exe", at faulthandler_fatal_error+0x2c4 [0x10274efac]
Binary file "/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/lib/clang/21/lib/darwin/libclang_rt.tsan_osx_dynamic.dylib", at _ZN6__tsanL21CallUserSignalHandlerEPNS_11ThreadStateEbbiPN11__sanitizer23__sanitizer_siginfo_padEPv+0xfc [0x103405274]
Binary file "/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/lib/clang/21/lib/darwin/libclang_rt.tsan_osx_dynamic.dylib", at _Z10sighandleriPN11__sanitizer23__sanitizer_siginfo_padEPv+0x1cc [0x1034054d4]
Binary file "/usr/lib/system/libsystem_platform.dylib", at _sigtramp+0x38 [0x1963f1764]
Binary file "/usr/lib/system/libsystem_pthread.dylib", at pthread_kill+0x128 [0x1963e7888]
Binary file "/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/lib/clang/21/lib/darwin/libclang_rt.tsan_osx_dynamic.dylib", at wrap_pthread_kill+0x144 [0x103405bbc]
Binary file "/usr/lib/system/libsystem_c.dylib", at abort+0x7c [0x1962ec850]
Binary file "/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/lib/clang/21/lib/darwin/libclang_rt.tsan_osx_dynamic.dylib", at _ZN11__sanitizer6AtexitEPFvvE+0x0 [0x1033e5dd8]
Binary file "/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/lib/clang/21/lib/darwin/libclang_rt.tsan_osx_dynamic.dylib", at _ZN11__sanitizer3DieEv+0x6c [0x1033e53d0]
Binary file "/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/lib/clang/21/lib/darwin/libclang_rt.tsan_osx_dynamic.dylib", at ZN11__sanitizer13SignalContextC1EPvS1+0x0 [0x1033f2b1c]
Binary file "/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/lib/clang/21/lib/darwin/libclang_rt.tsan_osx_dynamic.dylib", at _ZN6__tsanL21CallUserSignalHandlerEPNS_11ThreadStateEbbiPN11__sanitizer23__sanitizer_siginfo_padEPv+0xfc [0x103405274]
Binary file "/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/lib/clang/21/lib/darwin/libclang_rt.tsan_osx_dynamic.dylib", at _Z10sighandleriPN11__sanitizer23__sanitizer_siginfo_padEPv+0x1cc [0x1034054d4]
Binary file "/usr/lib/system/libsystem_platform.dylib", at _sigtramp+0x38 [0x1963f1764]
Binary file "/Users/johng/repos/cpython/python.exe", at partial_vectorcall+0x370 [0x10282204c]
Binary file "/Users/johng/repos/cpython/python.exe", at partial_vectorcall+0x370 [0x10282204c]
Binary file "/Users/johng/repos/cpython/python.exe", at _PyVectorcall_Call+0xe4 [0x10247f7b0]
Binary file "/Users/johng/repos/cpython/python.exe", at _PyEval_EvalFrameDefault+0x837c [0x102628d40]
Binary file "/Users/johng/repos/cpython/python.exe", at _PyEval_Vector+0x350 [0x10261ec5c]
Binary file "/Users/johng/repos/cpython/python.exe", at _PyObject_VectorcallTstate+0x74 [0x10247e938]
Binary file "/Users/johng/repos/cpython/python.exe", at _PyObject_VectorcallPrepend+0x154 [0x102480b4c]
Binary file "/Users/johng/repos/cpython/python.exe", at _PyEval_EvalFrameDefault+0x837c [0x102628d40]
Binary file "/Users/johng/repos/cpython/python.exe", at _PyEval_Vector+0x350 [0x10261ec5c]
Binary file "/Users/johng/repos/cpython/python.exe", at _PyObject_VectorcallDictTstate+0x170 [0x10247eb30]
Binary file "/Users/johng/repos/cpython/python.exe", at _PyObject_Call_Prepend+0xd4 [0x10247fdb4]
Binary file "/Users/johng/repos/cpython/python.exe", at call_method+0x9c [0x10255c8c0]
Binary file "/Users/johng/repos/cpython/python.exe", at _PyObject_MakeTpCall+0x120 [0x10247ed18]
Binary file "/Users/johng/repos/cpython/python.exe", at _Py_VectorCall_StackRefSteal+0x118 [0x10261ee60]
Binary file "/Users/johng/repos/cpython/python.exe", at _PyEval_EvalFrameDefault+0xb8cc [0x10262c290]
Binary file "/Users/johng/repos/cpython/python.exe", at _PyEval_Vector+0x350 [0x10261ec5c]
Binary file "/Users/johng/repos/cpython/python.exe", at _PyObject_VectorcallTstate+0x74 [0x10247e938]
Binary file "/Users/johng/repos/cpython/python.exe", at _PyObject_VectorcallPrepend+0x154 [0x102480b4c]

Extension modules: _testcapi (total: 1)
[1] 6548 abort ./python.exe -m test test_functools -v -m

CPython versions tested on:

CPython main branch

Operating systems tested on:

macOS

Linked PRs

Activity

  1. johng
    added
    type-bugAn unexpected behavior, bug, or error
    on Jul 19, 2026
  2. picnixz
    added
    extension-modulesC modules in the Modules dir
    on Jul 19, 2026
  3. encukou
    added 2 commits that reference this issue on Jul 24, 2026

    gh-154189: Fix use-after-free in `functools.partial_vectorcall` (GH-1…

    1a742d4

    [3.15] gh-154189: Fix use-after-free in `functools.partial_vectorcall` (

    6246342
  4. encukou
    closed this as completedon Jul 27, 2026
  5. mbeijen
    added a commit that references this issue on Aug 14, 2026

    pythongh-154189: Fix use-after-free in `functools.partial_vectorcall` (…

    231b8c6
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    extension-modulesC modules in the Modules dirtype-bugAn unexpected behavior, bug, or error

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions