ElementTree slice assignment with start greater than stop duplicates a child without owning its second reference

Abierto
  • ¿Algo no está bien?
#161,689 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
3/5
Tiempo estimado
1-2 días
Aptitud para principiantes
62/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
c, python
Área
data

Línea de trabajo

Start in Modules/_elementtree.c near lines 1976-1977, where PySlice_AdjustIndices runs, then compare the insertion loop at about 2026-2030 with the replacement loop at 2033-2037. Check the pure-Python behaviour in Lib/xml/etree/ElementTree.py, which the issue says gives the expected result. Done means the reproducer prints ['a0', 'a1', 'a2', 'a3', 'a4', 'X', 'a5', 'a6'], the refcount of a2 is unchanged, and a regression test is added to Lib/test/test_xml_etree.py.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

interpreter-core topic-XML type-bug
Bug report

Assigning to a step-1 slice with start > stop should insert at start, as a list does. The C Element implementation shifts from stop but writes from start. This duplicates one child without incrementing its reference count and overwrites another child's slot without releasing its reference.

import sys
import xml.etree.ElementTree as ET
kids = [ET.Element('a%d' % i) for i in range(7)]
e = ET.Element('r')
e[:] = kids
before = sys.getrefcount(kids[2])
e[5:2] = [ET.Element('X')]
tags = [c.tag for c in e]
print(tags, 'refcount change of a2:', sys.getrefcount(kids[2]) - before)

Recorded on 3.15.2 and main:

['a0', 'a1', 'a2', 'a2', 'a3', 'X', 'a5', 'a6'] refcount change of a2: 0

Expected, also obtained with the pure-Python Element implementation:

['a0', 'a1', 'a2', 'a3', 'a4', 'X', 'a5', 'a6']

The duplicate a2 has no additional owned reference. Releasing the parent therefore decrements it twice, potentially freeing it while kids still holds it. The record confirms this lifetime error separately; the reproducer above shows the wrong slots and missing reference without adding an allocator-reuse demonstration.

Cause: Modules/_elementtree.c:1976-1977 uses PySlice_AdjustIndices without normalizing a backward empty slice. The insertion loop at :2026-2030 shifts from stop, whereas replacement at :2033-2037 starts at start. Normalize stop to start for a positive step with stop < start, as list slice assignment does. No reentrancy or threads are required.

CPython versions tested on:

3.15, CPython main branch

Operating systems tested on:

Linux

Found while building a Lean 4 model of CPython (https://broyojo.com/python-formalization/). AI tools (Claude and Codex) helped investigate the findings and prepare this report. The examples were rerun on CPython 3.15.2 and main, and the report received technical review. Record: textlibs-etree-slice-backward-dup

Linked PRs
  • gh-161736
Lenguaje dominante
Python
Estrellas
78.2k
Forks
36.6k
Merge medio
19 h 57 min
PR fusionados (30 d)
630

Preparar el entorno

Abrir en Codespaces

Inicia el contenedor de desarrollo del proyecto en tu navegador, con tu propia cuenta de GitHub.

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de python/cpython

Todos los issues de python/cpython

Issues similares

Más issues de Python

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.