ElementTree slice assignment with start greater than stop duplicates a child without owning its second reference

Offen
  • Stimmt etwas nicht?
#161,689 0 Kommentare 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen

Maintainer antworten meist innerhalb von 1 Tag

Dieses Issue hat noch niemand übernommen.

Bewertung

Schwierigkeit
3/5
Geschätzter Aufwand
1-2 Tage
Anfängerfreundlichkeit
62/100
Issue-Typ
Bug
Klarheit
Klar beschrieben
Aktivitätsstatus
Aktiv
Tech-Stack
c, python
Bereich
data

Rechercherichtung

Start in Modules/_elementtree.c near lines 1976-1977, where PySlice_AdjustIndices runs, then compare the insertion loop at about 2026-2030 with the replacement loop at 2033-2037. Check the pure-Python behaviour in Lib/xml/etree/ElementTree.py, which the issue says gives the expected result. Done means the reproducer prints ['a0', 'a1', 'a2', 'a3', 'a4', 'X', 'a5', 'a6'], the refcount of a2 is unchanged, and a regression test is added to Lib/test/test_xml_etree.py.

Vom Indexierungsmodell aus dem Issue-Text verfasst.

Beschreibung

interpreter-core topic-XML type-bug
Bug report

Assigning to a step-1 slice with start > stop should insert at start, as a list does. The C Element implementation shifts from stop but writes from start. This duplicates one child without incrementing its reference count and overwrites another child's slot without releasing its reference.

import sys
import xml.etree.ElementTree as ET
kids = [ET.Element('a%d' % i) for i in range(7)]
e = ET.Element('r')
e[:] = kids
before = sys.getrefcount(kids[2])
e[5:2] = [ET.Element('X')]
tags = [c.tag for c in e]
print(tags, 'refcount change of a2:', sys.getrefcount(kids[2]) - before)

Recorded on 3.15.2 and main:

['a0', 'a1', 'a2', 'a2', 'a3', 'X', 'a5', 'a6'] refcount change of a2: 0

Expected, also obtained with the pure-Python Element implementation:

['a0', 'a1', 'a2', 'a3', 'a4', 'X', 'a5', 'a6']

The duplicate a2 has no additional owned reference. Releasing the parent therefore decrements it twice, potentially freeing it while kids still holds it. The record confirms this lifetime error separately; the reproducer above shows the wrong slots and missing reference without adding an allocator-reuse demonstration.

Cause: Modules/_elementtree.c:1976-1977 uses PySlice_AdjustIndices without normalizing a backward empty slice. The insertion loop at :2026-2030 shifts from stop, whereas replacement at :2033-2037 starts at start. Normalize stop to start for a positive step with stop < start, as list slice assignment does. No reentrancy or threads are required.

CPython versions tested on:

3.15, CPython main branch

Operating systems tested on:

Linux

Found while building a Lean 4 model of CPython (https://broyojo.com/python-formalization/). AI tools (Claude and Codex) helped investigate the findings and prepare this report. The examples were rerun on CPython 3.15.2 and main, and the report received technical review. Record: textlibs-etree-slice-backward-dup

Linked PRs
  • gh-161736
Vorherrschende Sprache
Python
Sterne
78.2k
Forks
36.6k
Ø Merge
19 Std. 57 Min.
Gemergte PRs (30 T.)
630

Entwicklungsumgebung

In Codespaces öffnen

Startet den Dev-Container des Projekts im Browser, mit Ihrem eigenen GitHub-Konto.

Erste Schritte

  1. Lesen Sie das ganze Issue und danach den Beitragsleitfaden des Projekts.
  2. Schreiben Sie ins Issue, dass Sie es übernehmen — das erspart doppelte Arbeit.
  3. Forken Sie das Repository und arbeiten Sie in einem Branch.
  4. Öffnen Sie einen Pull Request, der die Issue-Nummer nennt.

Mehr aus python/cpython

Alle Issues in python/cpython

Ähnliche Issues

Weitere Issues zu Python

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.