Segfault with lambda nested in comprehension

[JelleZijlstra]

def gen_params():
    def bound():
        return [lambda: T for T in (T, [1])[1]]
    T = ...

This segfaults on current main.

Stack trace:

(lldb) bt
* thread #1, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x8)
  * frame #0: 0x000000010008bcc4 python.exe`Py_TYPE(ob=0x0000000000000000) at object.h:204:16 [opt]
    frame #1: 0x000000010008d414 python.exe`Py_IS_TYPE(ob=<unavailable>, type=0x00000001004210b8) at object.h:235:12 [opt]
    frame #2: 0x000000010008e4c0 python.exe`_PyCode_ConstantKey(op=0x0000000000000000) at codeobject.c:2163:11 [opt]
    frame #3: 0x000000010008e688 python.exe`_PyCode_ConstantKey(op=0x0000000102a42620) at codeobject.c:2225:24 [opt]
    frame #4: 0x000000010016deec python.exe`_PyCompile_ConstCacheMergeOne(const_cache=0x000000010282d610, obj=0x000000016fdfefd8) at compile.c:6943:21 [opt]
    frame #5: 0x0000000100149330 python.exe`makecode(umd=0x0000000102b04820, a=0x000000016fdff050, const_cache=0x000000010282d610, constslist=0x0000000102a419a0, maxdepth=5, nlocalsplus=2, code_flags=19, filename=0x00000001028761b0) at assemble.c:568:9 [opt]
    frame #6: 0x000000010014905c python.exe`_PyAssemble_MakeCodeObject(umd=0x0000000102b04820, const_cache=0x000000010282d610, consts=0x0000000102a419a0, maxdepth=5, instrs=<unavailable>, nlocalsplus=2, code_flags=19, filename=0x00000001028761b0) at assemble.c:597:14 [opt]
    frame #7: 0x000000010016f1ec python.exe`optimize_and_assemble_code_unit(u=0x0000000102b04600, const_cache=0x000000010282d610, code_flags=19, filename=0x00000001028761b0) at compile.c:7219:10 [opt]
    frame #8: 0x000000010016f030 python.exe`optimize_and_assemble(c=0x000000010288b610, addNone=1) at compile.c:7246:12 [opt]
    frame #9: 0x0000000100170f84 python.exe`compiler_function(c=0x000000010288b610, s=0x0000000102063f10, is_async=0) at compile.c:2166:10 [opt]
    frame #10: 0x000000010016faec python.exe`compiler_visit_stmt(c=0x000000010288b610, s=0x0000000102063f10) at compile.c:3518:16 [opt]
    frame #11: 0x0000000100170f40 python.exe`compiler_function(c=0x000000010288b610, s=0x0000000104008530, is_async=0) at compile.c:2158:9 [opt]
    frame #12: 0x000000010016faec python.exe`compiler_visit_stmt(c=0x000000010288b610, s=0x0000000104008530) at compile.c:3518:16 [opt]
    frame #13: 0x000000010016e438 python.exe`compiler_codegen(c=0x000000010288b610, mod=0x0000000104008590) at compile.c:1684:9 [opt]
    frame #14: 0x000000010016dcdc python.exe`compiler_mod(c=0x000000010288b610, mod=<unavailable>) at compile.c:1702:9 [opt]
    frame #15: 0x000000010016dbf8 python.exe`_PyAST_Compile(mod=0x0000000104008590, filename=<unavailable>, pflags=<unavailable>, optimize=<unavailable>, arena=<unavailable>) at compile.c:575:24 [opt]
    frame #16: 0x00000001001bae6c python.exe`run_mod(mod=<unavailable>, filename=<unavailable>, globals=0x000000010282ce30, locals=0x000000010282ce30, flags=<unavailable>, arena=<unavailable>) at pythonrun.c:1707:24 [opt]
    frame #17: 0x00000001001b9e90 python.exe`PyRun_InteractiveOneObjectEx(fp=0x0000000209e4b848, filename=0x00000001028761b0, flags=0x000000016fdff550) at pythonrun.c:260:9 [opt]
    frame #18: 0x00000001001b9878 python.exe`_PyRun_InteractiveLoopObject(fp=0x0000000209e4b848, filename=0x00000001028761b0, flags=0x000000016fdff550) at pythonrun.c:137:15 [opt]
    frame #19: 0x00000001001b96f8 python.exe`_PyRun_AnyFileObject(fp=0x0000000209e4b848, filename=0x00000001028761b0, closeit=0, flags=0x000000016fdff550) at pythonrun.c:72:15 [opt]
    frame #20: 0x00000001001b9c64 python.exe`PyRun_AnyFileExFlags(fp=0x0000000209e4b848, filename=<unavailable>, closeit=0, flags=0x000000016fdff550) at pythonrun.c:104:15 [opt]
    frame #21: 0x00000001001d8d78 python.exe`pymain_run_stdin(config=0x000000010054a2c0) at main.c:520:15 [opt]
    frame #22: 0x00000001001d8444 python.exe`pymain_run_python(exitcode=0x000000016fdff5ec) at main.c:613:21 [opt]
    frame #23: 0x00000001001d82ac python.exe`Py_RunMain at main.c:689:5 [opt]
    frame #24: 0x00000001001d8524 python.exe`pymain_main(args=0x000000016fdff650) at main.c:719:12 [opt]
    frame #25: 0x00000001001d8568 python.exe`Py_BytesMain(argc=<unavailable>, argv=<unavailable>) at main.c:743:12 [opt]
    frame #26: 0x0000000100003e94 python.exe`main(argc=<unavailable>, argv=<unavailable>) at python.c:15:12 [opt]
    frame #27: 0x000000010086108c dyld`start + 520

I got crashes here at some point too while working on PEP 695; I think it means there's something wrong with how the cellvars/freevars are tracked.

cc @carljm.

Linked PRs

• gh-104377: fix cell in comprehension that is free in outer scope #104394