================================================================= ==23898==ERROR: AddressSanitizer: heap-use-after-free on address 0x619000041b48 at pc 0x0001093d7fbe bp 0x7ffee6d13700 sp 0x7ffee6d136f8 READ of size 8 at 0x619000041b48 thread T0 #0 0x1093d7fbd in subtype_dealloc typeobject.c:1456 #1 0x10939e680 in _Py_Dealloc object.c:2288 #2 0x1092d81ac in _Py_DECREF object.h:500 #3 0x1092d8bdb in _Py_XDECREF object.h:567 #4 0x1092de271 in list_dealloc listobject.c:342 #5 0x10939e680 in _Py_Dealloc object.c:2288 #6 0x10932dafc in _Py_DECREF object.h:500 #7 0x10933a41b in _Py_XDECREF object.h:567 #8 0x10933fbfb in dict_dealloc dictobject.c:2068 #9 0x10939e680 in _Py_Dealloc object.c:2288 #10 0x1095bfedc in _Py_DECREF object.h:500 #11 0x1095eb47d in ast_clear Python-ast.c:782 #12 0x1093f6c51 in subtype_clear typeobject.c:1303 #13 0x1098c6e70 in delete_garbage gcmodule.c:1017 #14 0x1098be9af in gc_collect_main gcmodule.c:1300 #15 0x1098bdf9c in _PyGC_CollectNoFail gcmodule.c:2123 #16 0x109812be0 in interpreter_clear pystate.c:328 #17 0x109812e81 in _PyInterpreterState_Clear pystate.c:361 #18 0x1098017b9 in finalize_interp_clear pylifecycle.c:1634 #19 0x10980123b in Py_FinalizeEx pylifecycle.c:1812 #20 0x1098b7143 in Py_RunMain main.c:668 #21 0x1098b83e4 in pymain_main main.c:696 #22 0x1098b8694 in Py_BytesMain main.c:720 #23 0x108eeda71 in main python.c:15 #24 0x7fff20582f3c in start+0x0 (libdyld.dylib:x86_64+0x15f3c) 0x619000041b48 is located 200 bytes inside of 968-byte region [0x619000041a80,0x619000041e48) freed by thread T0 here: #0 0x10a3ad609 in wrap_free+0xa9 (libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x48609) #1 0x10939ff08 in _PyMem_RawFree obmalloc.c:127 #2 0x1093a0ed9 in _PyMem_DebugRawFree obmalloc.c:2540 #3 0x1093a0fb8 in _PyMem_DebugFree obmalloc.c:2673 #4 0x1093a1f8f in PyObject_Free obmalloc.c:721 #5 0x1098c1151 in PyObject_GC_Del gcmodule.c:2345 #6 0x1093db0e7 in type_dealloc typeobject.c:4041 #7 0x10939e680 in _Py_Dealloc object.c:2288 #8 0x1095bfedc in _Py_DECREF object.h:500 #9 0x1095eb1dd in ast_dealloc Python-ast.c:768 #10 0x1093d7f83 in subtype_dealloc typeobject.c:1450 #11 0x10939e680 in _Py_Dealloc object.c:2288 #12 0x1092d81ac in _Py_DECREF object.h:500 #13 0x1092d8bdb in _Py_XDECREF object.h:567 #14 0x1092de271 in list_dealloc listobject.c:342 #15 0x10939e680 in _Py_Dealloc object.c:2288 #16 0x10932dafc in _Py_DECREF object.h:500 #17 0x10933a41b in _Py_XDECREF object.h:567 #18 0x10933fbfb in dict_dealloc dictobject.c:2068 #19 0x10939e680 in _Py_Dealloc object.c:2288 #20 0x1095bfedc in _Py_DECREF object.h:500 #21 0x1095eb47d in ast_clear Python-ast.c:782 #22 0x1093f6c51 in subtype_clear typeobject.c:1303 #23 0x1098c6e70 in delete_garbage gcmodule.c:1017 #24 0x1098be9af in gc_collect_main gcmodule.c:1300 #25 0x1098bdf9c in _PyGC_CollectNoFail gcmodule.c:2123 #26 0x109812be0 in interpreter_clear pystate.c:328 #27 0x109812e81 in _PyInterpreterState_Clear pystate.c:361 #28 0x1098017b9 in finalize_interp_clear pylifecycle.c:1634 #29 0x10980123b in Py_FinalizeEx pylifecycle.c:1812 previously allocated by thread T0 here: #0 0x10a3ad4c0 in wrap_malloc+0xa0 (libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x484c0) #1 0x10939fe4b in _PyMem_RawMalloc obmalloc.c:99 #2 0x1093a2979 in _PyMem_DebugRawAlloc obmalloc.c:2473 #3 0x1093a0490 in _PyMem_DebugRawMalloc obmalloc.c:2506 #4 0x1093a0f08 in _PyMem_DebugMalloc obmalloc.c:2658 #5 0x1093a1e80 in PyObject_Malloc obmalloc.c:697 #6 0x1098c0537 in _PyObject_GC_Alloc gcmodule.c:2250 #7 0x1098c0468 in _PyObject_GC_Malloc gcmodule.c:2277 #8 0x1093d2ccb in PyType_GenericAlloc typeobject.c:1160 #9 0x1093f3dbb in type_new_alloc typeobject.c:2732 #10 0x1093f2652 in type_new_init typeobject.c:3144 #11 0x1093f2364 in type_new_impl typeobject.c:3167 #12 0x1093deb37 in type_new typeobject.c:3312 #13 0x1093db9d7 in type_call typeobject.c:1127 #14 0x10922dd16 in _PyObject_MakeTpCall call.c:215 #15 0x1093dee83 in type_vectorcall typeobject.c:3332 #16 0x109233312 in _PyObject_VectorcallTstate abstract.h:114 #17 0x109231175 in _PyObject_CallFunctionVa call.c:485 #18 0x109230ad1 in PyObject_CallFunction call.c:507 #19 0x1095eadbc in make_type Python-ast.c:935 #20 0x1095ddbc5 in init_types Python-ast.c:1287 #21 0x1095d22b7 in get_ast_state Python-ast.c:19 #22 0x1095d6e13 in astmodule_exec Python-ast.c:10795 #23 0x10937fd73 in PyModule_ExecDef moduleobject.c:407 #24 0x10979fe3a in exec_builtin_or_dynamic import.c:1975 #25 0x1097a3628 in _imp_exec_builtin_impl import.c:2068 #26 0x1097a1c94 in _imp_exec_builtin import.c.h:388 #27 0x10937a205 in cfunction_vectorcall_O methodobject.c:512 #28 0x10922f552 in PyVectorcall_Call call.c:255 #29 0x10922fa21 in _PyObject_Call call.c:290 SUMMARY: AddressSanitizer: heap-use-after-free typeobject.c:1456 in subtype_dealloc Shadow bytes around the buggy address: 0x1c3200008310: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x1c3200008320: fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa 0x1c3200008330: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x1c3200008340: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x1c3200008350: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd =>0x1c3200008360: fd fd fd fd fd fd fd fd fd[fd]fd fd fd fd fd fd 0x1c3200008370: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x1c3200008380: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x1c3200008390: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x1c32000083a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x1c32000083b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb Shadow gap: cc ==23898==ABORTING