Python 3.11 and QObject.destroyed signals: _PyThreadState_PopFrame: Assertion `tstate->datastack_top >= base' failed

[Florian Bruhin]

Hi,

when testing my application with the current Python 3.11 beta, I've
noticed a bug which seems to be triggered somehow by something PyQt
does: https://github.com/python/cpython/issues/93252

This is the most trivial reproducer I could find:

    from PyQt5.QtCore import QObject

    def run():
        obj = QObject()
        for _ in range(202):
            obj.destroyed.connect(lambda: None)

    run()

Which crashes CPython with:

    python: Python/pystate.c:2201: _PyThreadState_PopFrame: Assertion `tstate->datastack_top >= base' failed.

here: https://github.com/python/cpython/blob/v3.11.0b3/Python/pystate.c#L2201
stacktrace: https://paste.the-compiler.org/view/028a41bd

This was introduced by the following commit to CPython ("Lazily allocate
frame objects"):
https://github.com/python/cpython/commit/ae0a2b756255629140efcbe57fc2e714f0267aa3

Some observations:
- When making obj global rather than wrapping it in a function, the crash is gone.
- With 201 iterations instead of 202, the crash is consistently gone,
  and with 202 iterations, it's consistently there.
- The crash happens with both PyQt5 and PyQt6.
- The crash does *not* happen with PySide2.

I opened a CPython issue here, which has some more history and context:
https://github.com/python/cpython/issues/93252

But understandably, they'd like to see a reproducer which does not
involve PyQt...

Any hints on where to go from there, or what I could try out to
reproduce this with pure CPython (or, if needed, perhaps a hand-written
C extension)? Is there anything special in regards to Python stacks when
it comes to the QObject::destroyed signal? I've tried to reproduce the
issue with other Python functions called from C++ (e.g. via a QTimer)
with no success.

Thanks,
Florian

-- 
            me at the-compiler.org | https://www.qutebrowser.org 
       https://bruhin.software/ | https://github.com/sponsors/The-Compiler/
       GPG: 916E B0C8 FD55 A072 | https://the-compiler.org/pubkey.asc
             I love long mails! | https://email.is-not-s.ms/
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <https://www.riverbankcomputing.com/pipermail/pyqt/attachments/20220708/c105936a/attachment.sig>