This issue tracker has been migrated to GitHub, and is currently read-only.
For more information, see the GitHub FAQs in the Python's Developer Guide.

classification
Title: Abort with "negative ref count"
Type: Stage:
Components: Interpreter Core Versions: Python 2.3
process
Status: closed Resolution: fixed
Dependencies: Superseder:
Assigned To: gvanrossum Nosy List: doerwalter, gvanrossum, nnorwitz, skip.montanaro, tim.peters
Priority: normal Keywords:

Created on 2003-01-15 12:23 by doerwalter, last changed 2022-04-10 16:06 by admin. This issue is now closed.

Files
File name Uploaded Description Edit
m.py doerwalter, 2003-01-15 15:16
neg.py nnorwitz, 2003-01-15 20:37 updated, slightly shorter test file
temp.py tim.peters, 2003-02-05 22:08 Very short test case
Messages (12)
msg14069 - (view) Author: Walter Dörwald (doerwalter) * (Python committer) Date: 2003-01-15 12:23
Python 2.3a1 and the current CVS version abort with the
following error message when executing the attached
test script:
Fatal Python error:
D:\Python-current\dist\src\Objects\descrobject.c:10
object at 007C3208 has negative ref count -1

This happens only in the debug build, both on Linux
(with configure --enable-unicode=ucs4 --with-pydebug
and 2.3a1) and on Windows (with the debug build and
current CVS).
msg14070 - (view) Author: Neal Norwitz (nnorwitz) * (Python committer) Date: 2003-01-15 15:04
Logged In: YES 
user_id=33168

Walter, there's no file attached.
msg14071 - (view) Author: Neal Norwitz (nnorwitz) * (Python committer) Date: 2003-01-15 20:37
Logged In: YES 
user_id=33168

I'm not running w/--enable-unicode=ucs4, but I still get the
problem.  I've simplified the test, but only a little so far. 
The problem did not affect 2.2.2, only 2.3.
msg14072 - (view) Author: Neal Norwitz (nnorwitz) * (Python committer) Date: 2003-01-15 21:37
Logged In: YES 
user_id=33168

8/6/2002 works without complaints, 8/8/2002 breaks, 8/7/2002
breaks with a different error message: 
Objects/typeobject.c:466: subtype_dealloc: Assertion
`g->gc.gc_refs != (-2)' failed.

All dates are American, ie, August, 6-8.  The change
corresponds to Object/typeobject.c:

8/6 - 2.165 works
8/7 - 2.166 assertion listed above
8/8 - 2.167 assertion in bug report (current)

Guido made all the changes, assigning to him. :-)
msg14073 - (view) Author: Guido van Rossum (gvanrossum) * (Python committer) Date: 2003-01-15 21:52
Logged In: YES 
user_id=6380

Bah. Trashcan code. :-(

OK, I'll look at it.

When I have time.
msg14074 - (view) Author: Tim Peters (tim.peters) * (Python committer) Date: 2003-02-05 22:08
Logged In: YES 
user_id=31435

Attached a very short test case.
msg14075 - (view) Author: Guido van Rossum (gvanrossum) * (Python committer) Date: 2003-02-05 22:46
Logged In: YES 
user_id=6380

Fixed in CVS, typeobject.c 2.203. Much thanks to Tim, who
understands the trashgcan code much better than I do.
Explanation is in the code. I checked that none of the three
examples breaks with the new code.
msg14076 - (view) Author: Skip Montanaro (skip.montanaro) * (Python triager) Date: 2003-02-06 03:22
Logged In: YES 
user_id=44345

I'm still seeing a negative ref count error with a fresh debug build after
cvs up...

(gdb) p *old_value
$1 = {
  _ob_next = 0xdbdbdbdb, 
  _ob_prev = 0xdbdbdbdb, 
  ob_refcnt = -606348326, 
  ob_type = 0xdbdbdbdb
}

#0  0x9001b52c in kill ()
#1  0x9005ceec in abort ()
#2  0x00012ad8 in Py_AtExit (func=0x4bfe0 <_Py_NegativeRefcount+88>) at Python/pythonrun.c:1334
#3  0x0004bfe0 in _Py_NegativeRefcount (fname=0x1266ac "Objects/dictobject.c", lineno=373, op=0x473258) at Objects/object.c:104
#4  0x0006cd90 in insertdict (mp=0x4da428, key=0x54ba28, hash=1490138787, value=0x134aac) at Objects/dictobject.c:373
#5  0x0006fddc in PyDict_Merge (a=0x4da428, b=0x4752d8, override=1) at Objects/dictobject.c:1142
#6  0x0006fb3c in PyDict_Update (a=0x4da428, b=0x4752d8) at Objects/dictobject.c:1102
#7  0x00051188 in merge_class_dict (dict=0x4da428, aclass=0x465ce0) at Objects/object.c:1641
#8  0x0005131c in merge_class_dict (dict=0x4da428, aclass=0x465d28) at Objects/object.c:1665
#9  0x00051ae4 in PyObject_Dir (arg=0x472278) at Objects/object.c:1796
#10 0x000cfca0 in builtin_dir (self=0x0, args=0x4c89a0) at Python/bltinmodule.c:396
#11 0x000c4470 in PyCFunction_Call (func=0x404df8, arg=0x4c89a0, kw=0x0) at Objects/methodobject.c:73
#12 0x000b8630 in call_function (pp_stack=0xbfffbb50, oparg=1) at Python/ceval.c:3285
#13 0x000b2e04 in eval_frame (f=0x4a1a38) at Python/ceval.c:2041
...
msg14077 - (view) Author: Tim Peters (tim.peters) * (Python committer) Date: 2003-02-06 03:33
Logged In: YES 
user_id=31435

Skip, which program were you running?  I don't see any 
calls to dir() in any of the programs attached to this bug 
report, so I doubt that this bug report has anything to do 
with what you're seeing.
msg14078 - (view) Author: Skip Montanaro (skip.montanaro) * (Python triager) Date: 2003-02-06 03:44
Logged In: YES 
user_id=44345

I was running a unittest script for the nascent csv module.  After posting,
I noticed that there was a bug in the test code (at the Python level), but 
the C code underneath seems fairly solid. (Based on Object Craft's csv
module which is pretty stable.)
msg14079 - (view) Author: Tim Peters (tim.peters) * (Python committer) Date: 2003-02-06 03:56
Logged In: YES 
user_id=31435

Please open a new bug report then.  The cause of what 
you're seeing almost certainly has nothing to do with this 
bug report (for starters, you're nowhere near 
subtype_dealloc()), so mixing it in here is just going to 
cause ongoing confusion (as it already has).
msg14080 - (view) Author: Skip Montanaro (skip.montanaro) * (Python triager) Date: 2003-02-06 04:43
Logged In: YES 
user_id=44345

my apologies.  too quick with the assumptions.
History
Date User Action Args
2022-04-10 16:06:08adminsetgithub: 37773
2003-01-15 12:23:39doerwaltercreate