I've been able to track this down to clang's handling of CxString. For some reason, the destructor of one of those is called twice upon __del__, so there may be some sharing here?

Bug introduced in cpython by commit 32119e10b792ad7ee4e5f951a2d89ddbaf111cc5, esp. the changes in Modules/_ctypes/_ctypes.c.

Is that a CPython bug or a juts something clang should be adapted to?

Hard to say. The problem triggers in clang code base around that function 

    https://github.com/llvm-mirror/clang/blob/release_80/bindings/python/clang/cindex.py#L230

Basically `from_result` is called through the `errcheck` field from `ctypes`.
The error is raised because `conf.lib.clang_getCString(res)` creates sharing between a field of `res` and the newly created object.

So my take on this would be: it's clang's fault, but I'd be happy if you could shed light on why it used to work prioro to that cpython commit?

> So my take on this would be: it's clang's fault, but I'd be happy if you could shed light on why it used to work prioro to that cpython commit?

I'm sorry but I don't know the answer for this. Perhaps Petr might know.

Last findings, in the following

```
    if (self->b_size > sizeof(void*)) {
        void *new_ptr = PyMem_Malloc(self->b_size);
        if (new_ptr == NULL)
            return NULL;
        memcpy(new_ptr, self->b_ptr, self->b_size);
        copied_self = (CDataObject *)PyCData_AtAddress(
            (PyObject *)Py_TYPE(self), new_ptr);
        copied_self->b_needsfree = 1;`
    } else {
        copied_self = self;
        Py_INCREF(copied_self);
    }
```

from ``StructUnionType_paramfunc``, if ``self->b_ptr`` contains pointer, the ``memcpy`` creates sharing, and this is dangerous: if a ``__del__`` happens to free the original pointer, we end up with a dangling reference in ``new_ptr``. As far as I can tell, this is what happens in the clang bindings code.

I'm not familiar with this code, and I won't be able to focus on this today :(
The deadline for the Python 3.8 beta1 release is in 3 hours. I'll report this upstream; maybe someone will have time to help.

Bug opened upstream https://bugs.python.org/issue37140

This is now blocked on python3-lit, bz1728067.

This bug appears to have been reported against 'rawhide' during the Fedora 31 development cycle.
Changing version to 31.

The coordinated rebuild of Python 3.8 has started in the `f32-python` side tag.

If you figure out how to rebuild this package, please don't rebuild it in regular rawhide, but use the side tag instead:

    on branch master:
    $ fedpkg build --target=f32-python

To wait for a build to show up in the side tag, do:

    $ koji wait-repo f32-python --build=<nvr>

Where <nvr> is name-version-release of the source package, e.g. python-foo-1.1-2.fc32.

An updated mock config is posted at:
http://copr.fedorainfracloud.org/coprs/g/python/python3.8/

Note that it will take a while before the essential packages are rebuilt, so don't expect all your dependencies to be available right away.

Thanks. Let us know if you need up to date info, or if you have any questions.



PS this message is mass posted to all the bugs that block the PYTHON38 bug. If this is also a Fedora 31 FTBFS bug and you manage to fix it, you can do a f31 build as usual:

    on branch f31:
    $ fedpkg build

Package needed a build without check, then a build with check.

python-lit-0.8.0-7.fc32 is now available in f32-python

Miro, I'm still experiencing the same error (grep "double free" in https://kojipkgs.fedoraproject.org//work/tasks/6134/37196134/build.log) even with updated f32-python. I see that https://bugs.python.org/issue37140  / https://github.com/python/cpython/pull/13796 has not been merged yet, so we'll have to wait

Victor, could you help us make this happen for b4?

The f32-python side tag has been merged. In order to rebuild the package, do it in regular rawhide, but please wait until python3-3.8 is tagged:

  $ koji wait-repo f32-build --build python3-3.8.0~b3-3.fc32


If your built already started in f32-python, after it is finished, please tag it to rawhide with:

  $ koji tag-build f32-pending <nvr>

For example:

  $ koji tag-build f32-pending libreoffice-6.3.0.4-3.fc32

Thanks!

(This comment is mass posted to all bugzillas blocking the PYTHON38 tracking bug.)

(Python 3.8 has landed in the rawhide buildroot.)

I wrote a fix upstream:
https://bugs.python.org/issue37140#msg350874

It will be part of the next Python 3.8.0rc1 release. If the fix is needed earlier in Fedora Rawhide, we may backport the fix downstream, or disable the Python binding in clang, until python3 is upgrade to Python 3.8.0rc1 in Rawhide.

I'll backport it.

https://src.fedoraproject.org/rpms/python3/pull-request/132

> https://src.fedoraproject.org/rpms/python3/pull-request/132

Oh wow, Miro already included my fix as part of his PR to update Python 3.8 to 3.8.0beta4. Miro: you are amazing and magic!

Thanks Miro for including the ctypes fix.

I tested bug.py attached to https://bugs.python.org/issue37140 I modified the script: LIBCLANG_FILENAME = '/usr/lib64/libclang.so.8'. On an up to date Fedora Rawhide, the script does no long crash!

* python3-3.8.0~b4-1.fc32.x86_64
* clang-libs-8.0.0-4.fc32.x86_64