homepage

Hi -- I'm getting a segfault running the attached crasher.py script.
Valgrind traces it down to an Invalid free() / delete / delete[] in
_PyUnicode_Ready().
Reproduce:
==========
Rev: 870c0ef7e8a2
Build: ./configure --without-pymalloc CFLAGS="-O0 -g" && make
$ ./python crasher.py 
Segmentation fault
$ valgrind --db-attach=yes --suppressions=./Misc/valgrind-python.supp ./python crasher.py
==3476== Memcheck, a memory error detector
==3476== Copyright (C) 2002-2010, and GNU GPL'd, by Julian Seward et al.
==3476== Using Valgrind-3.6.1 and LibVEX; rerun with -h for copyright info
==3476== Command: ./python crasher.py
==3476== 
==3476== Invalid free() / delete / delete[]
==3476== at 0x4C2748D: free (vg_replace_malloc.c:366)
==3476== by 0x44763C: _PyUnicode_Ready (unicodeobject.c:1405)
==3476== by 0x44ACF8: PyUnicode_FromFormatV (unicodeobject.c:2500)
==3476== by 0x4A1CF4: PyErr_Format (errors.c:621)
==3476== by 0x42F8FE: type_getattro (typeobject.c:2551)
==3476== by 0x43493A: wrap_binaryfunc (typeobject.c:4317)
==3476== by 0x550008: wrapper_call (descrobject.c:1067)
==3476== by 0x532C93: PyObject_Call (abstract.c:2150)
==3476== by 0x49012B: PyEval_CallObjectWithKeywords (ceval.c:3920)
==3476== by 0x54F136: wrapperdescr_call (descrobject.c:309)
==3476== by 0x532C93: PyObject_Call (abstract.c:2150)
==3476== by 0x491A1E: ext_do_call (ceval.c:4355)
==3476== Address 0x4 is not stack'd, malloc'd or (recently) free'd
==3476==

3.2 also crashes. 2.7 runs fine. So it's certainly not related
to the new Unicode API.

I've traced it down to this line:
>>> getattr(type, '__getattribute__')(type, type)
Segmentation fault
Setting to 'normal', since there are apparently more of these.

One-line crasher:
 type.__getattribute__(type, type)
Python 2.7 does not crash reliably, but is not exempt from the bug:
 type.__getattribute__(type, 1.1j)

New changeset b7bad204b34f by Benjamin Peterson in branch '3.2':
check to make sure the attribute is a string (#14334)
http://hg.python.org/cpython/rev/b7bad204b34f
New changeset e44591015cf0 by Benjamin Peterson in branch 'default':
merge 3.2 (#14334)
http://hg.python.org/cpython/rev/e44591015cf0 

New changeset d1cf6008a565 by Benjamin Peterson in branch '2.7':
check to make sure the attribute is a string (#14334)
http://hg.python.org/cpython/rev/d1cf6008a565 

It doesn't crash for me anymore.

well, on 2.6 and 2.7 the following has weird output and crashes:
def test(obj):
 try:
 type(obj).__getattribute__(obj, (1,))
 except AttributeError as e:
 print(e)
class C:
 pass
test(str)
test(C)
test(C())

New changeset 3d4d52e47431 by Benjamin Peterson in branch '2.7':
check for string attribute names in old-style classes (closes #14334)
http://hg.python.org/cpython/rev/3d4d52e47431