compiling an AST with an invalid TypeAlias causes a segmentation fault

[15r10nk]

Bug report

Bug description:

The code for the following AST is:

type foo['x'] = Callable

compiling the AST for the given code results in a segmentation fault

from ast import *

m = Module(
    body=[
        TypeAlias(
            name=Subscript(
                value=Name(id="foo", ctx=Load()),
                slice=Constant(value="x"),
                ctx=Store(),
            ),
            type_params=[],
            value=Name(id="Callable", ctx=Load()),
        )
    ],
    type_ignores=[],
)

compile(fix_missing_locations(m), "<file>", "exec")

output (Python 3.12.0rc2+):

fish: Job 1, 'venv3.12/bin/python bug.py' terminated by signal SIGSEGV (Adressbereichsfehler)

Compiling the code gives the correct syntax error.

compile("type foo['x'] = Callable","<file>","exec")

output (Python 3.12.0rc2+):

Traceback (most recent call last):
  File "/home/frank/projects/executing/bug.py", line 1, in <module>
    compile("type foo['x'] = Callable","<file>","exec")
  File "<file>", line 1
    type foo['x'] = Callable
             ^^^
SyntaxError: invalid syntax

CPython versions tested on:

3.12

Operating systems tested on:

No response

Linked PRs

• gh-109341: Fix crash on compiling invalid AST including TypeAlias #109349
• [3.12] gh-109341: Fix crash on compiling invalid AST including TypeAlias (GH-109349) #109381

[JelleZijlstra]

I found a similar crash with the walrus:

m = ast.Module(
    body=[
        ast.Expr(
            value=ast.ListComp(
                elt=ast.NamedExpr(
                    target=ast.Constant(value=1),
                    value=ast.Constant(value=3),
                ),
                generators=[
                    ast.comprehension(
                        target=ast.Name(id="x", ctx=ast.Store()),
                        iter=ast.Name(id="y", ctx=ast.Load()),
                        ifs=[],
                        is_async=0,
                    )
                ],
            )
        )
    ],
    type_ignores=[],
)

with self.assertRaises(SyntaxError):
    compile(ast.fix_missing_locations(m), "<file>", "exec")

That one should be backported further though so I'll fix it separately.

[JelleZijlstra]

I found the other issue (now #109351) by looking for assert()s in Python/symtable.c that looked like they might be triggered by an invalid AST. I didn't see any others, but enough fuzzing might uncover more.