[Python-Dev] A cute new way to get an infinite loop (original) (raw)

Armin Rigo arigo at tunes.org
Sat Sep 25 16:07:23 CEST 2004

Hi Bob,

On Fri, Sep 24, 2004 at 11:36:10PM -0400, Bob Ippolito wrote:

> >>> x = [] > >>> x.extend(-y for y in x) > Segmentation fault

No algorithm that requires infinite memory will run for an infinite amount of time on a finite computer.

The segfault is immediate. And the example is different, as Ronald pointed out: the list 'x' is empty!

Uh oh. We have a real bug in listextend(): the list being extended is in a semi-invalid state when it's calling tp_iternext() on the 2nd iterable. This might call back Python code, which can inspect the list. The above example does just that. Crash.

"Semi-invalid" means that all invariants are respected but the final items in the list are NULL. Reading them crashes. And I'm not even talking about the nasty things you can do if you modify the list while it's being extended :-)

The safest solution would be to use a regular app1() to add each item as the iterable produce them instead of optimizing this case. I'm not sure we need the high-flying optimization of listextend() in this case (this is the case where the iterable we extend the list with is neither a list nor a tuple). I believe that the speed of app1() would be acceptable, given the fixed bug and the overall decrease of code complexity (though that should be measured).

Armin

More information about the Python-Dev mailing list