Skip to content

Assigning __conditional_annotations__ crashes the interpreter #154902

Description

@Lydxn

Crash report

What happened?

In CPython 3.14 and later, assigning to the global __conditional_annotations__ before a variable annotation produces a segfault.

Here is a minimal reproducible example:

__conditional_annotations__ = 0
a: 1

Analyzing the bytecode, the compiler first initializes __conditional_annotations__ to an empty set. Whenever an annotation is declared, a SET_ADD is emitted under the assumption that the underlying type is still a set. But we can re-assign __conditional_annotations__ to another object in between, leading to a type confusion:

BUILD_SET                0
STORE_NAME               0 (__conditional_annotations__)
LOAD_SMALL_INT           0
STORE_NAME               0 (__conditional_annotations__)

LOAD_NAME                0 (__conditional_annotations__)
LOAD_SMALL_INT           0
SET_ADD                  1

CPython versions tested on:

3.14, 3.15

Operating systems tested on:

Linux

Output from running 'python -VV' on the command line:

No response

Metadata

Metadata

Assignees

No one assigned

    Labels

    3.14bugs and security fixes3.15pre-release feature fixes, bugs and security fixes3.16new features, bugs and security fixesinterpreter-core(Objects, Python, Grammar, and Parser dirs)topic-typingtype-crashA hard crash of the interpreter, possibly with a core dump

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions