Repository navigation
_asyncio.FutureIter crashes when advanced after close() #159099
Description
Crash report
Advancing an _asyncio.FutureIter after calling its close() method causes a null-pointer dereference. FutureIter_close() clears it->future, but FutureIter_am_send() later passes that null pointer into the critical-section machinery and FutureIter_am_send_lock_held() dereferences it.
The equivalent sequence with asyncio.futures._PyFuture raises StopIteration, which is also the expected behavior for advancing a closed generator.
This reproduces consistently in three out of three runs on current main at 0ec3aee262b03276a18aeb23cb9957e1b57c9d08 using a release-style AddressSanitizer build.
import asyncio
loop = asyncio.new_event_loop()
future = asyncio.Future(loop=loop)
iterator = future.__await__()
iterator.close()
next(iterator)Complete AddressSanitizer report
AddressSanitizer:DEADLYSIGNAL
=================================================================
==1==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000068 (pc 0xaaaab637e1f0 bp 0xffffc571d1f0 sp 0xffffc571d1f0 T0)
==1==The signal is caused by a READ memory access.
==1==Hint: address points to the zero page.
#0 0xaaaab637e1f0 in FutureIter_am_send_lock_held Modules/_asynciomodule.c:1806
#1 0xaaaab637e1f0 in FutureIter_am_send Modules/_asynciomodule.c:1835
#2 0xaaaab637e1f0 in FutureIter_iternext Modules/_asynciomodule.c:1845
#3 0xaaaab61c0d10 in builtin_next Python/bltinmodule.c:1780
#4 0xaaaab5ee8fec in _PyObject_VectorcallTstate Include/internal/pycore_call.h:143
#5 0xaaaab5ee8fec in PyObject_Vectorcall Objects/call.c:327
#6 0xaaaab61d1e94 in _Py_VectorCallInstrumentation_StackRefSteal Python/ceval.c:770
#7 0xaaaab5dabcbc in _PyEval_EvalFrameDefault Python/generated_cases.c.h:1906
#8 0xaaaab61def0c in _PyEval_EvalFrame Include/internal/pycore_ceval.h:122
#9 0xaaaab61def0c in _PyEval_Vector Python/ceval.c:2176
#10 0xaaaab61def0c in PyEval_EvalCode Python/ceval.c:681
#11 0xaaaab630064c in run_mod Python/pythonrun.c:1509
#12 0xaaaab6302aac in _PyRun_File Python/pythonrun.c:1332
#13 0xaaaab6302aac in _PyRun_SimpleFile Python/pythonrun.c:544
#14 0xaaaab6304d30 in _PyRun_AnyFile Python/pythonrun.c:92
#15 0xaaaab63723e0 in pymain_run_file_obj Modules/main.c:478
#16 0xaaaab63723e0 in pymain_run_file Modules/main.c:494
#17 0xaaaab63723e0 in pymain_run_python Modules/main.c:812
#18 0xaaaab63723e0 in Py_RunMain Modules/main.c:900
#19 0xaaaab6373284 in pymain_main Modules/main.c:927
#20 0xaaaab6373284 in Py_BytesMain Modules/main.c:951
#21 0xffffa91b84c0 (/lib/aarch64-linux-gnu/libc.so.6+0x284c0) (BuildId: 27027b96e5b8c475fc327aa445bea1c71d37b4e2)
#22 0xffffa91b8594 in __libc_start_main (/lib/aarch64-linux-gnu/libc.so.6+0x28594) (BuildId: 27027b96e5b8c475fc327aa445bea1c71d37b4e2)
#23 0xaaaab5dcd5ac in _start (/src/cpython/python+0x20d5ac) (BuildId: c7b91d0d6fc70a572b6ef078849822c6fb3085ae)
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV Modules/_asynciomodule.c:1806 in FutureIter_am_send_lock_held
==1==ABORTING
For comparison, replacing asyncio.Future with asyncio.futures._PyFuture makes next(iterator) raise StopIteration instead of crashing.
CPython versions tested on:
CPython main branch
Operating systems tested on:
Linux
Output from running python -VV on the command line:
Python 3.16.0a0 (main, Oct 10 2026, 01:00:06) [GCC 13.3.0]
Build platform: Ubuntu 24.04.5 LTS (aarch64)
Activity
NULLpointer dereference inFutureIter_am_send#146065