Crash (i.e. cause the interpreter to stop working and force close) Python

Question

I would like to see who can make Python have a fatal crash with the most creative code. This means that when the program runs, Windows for example, will take over and pop up with something like “IDLE has stopped working”, or Linux will do whatever Linux does when a program crashes.

Rules:

1. This must be made in Python 2.7 or above (So old bugs aren't exploited that have been fixed in future versions of Python).

2. The definition of "crash" is "make IDLE or Python exit in an unintended way." This does not mean "make IDLE or Python halt and give a traceback". This also means exit, sys.quit, abort etc are not valid answers. For example, this will not be accepted:

   import sys
   try:
        print c # Crashes Here, as c is not defined.
    except NameError, SyntaxError:
        print "Oh No!"
        sys.exit()
   

3. Making Python stop responding is not accepted.

4. The code must be explained on what it does to crash. A link to a bug report is fine.

The most upvoted answer after 10 days wins! Begin!!

EDIT: May I make it clear that the objective is not to make Python just halt executing the program with a traceback. The objective is to make Python completely crash or stop working. This means that if this task is successfully accomplished, Windows would give this (I'm not crashing Word here, it's just an example of what should happen for a different program):

or this:

Answer 1

Should have been a code-golfing contest ;) - I guess the creativity is the statement the code makes: "I just don't know what's happening here..."

Copy and paste the following character in IDLE running on Windows:

The crash has something to do with the character being encoded as UTF-16 by Windows and the unsuccessful conversion to a UTF-8 character by IDLE...

Edit: python bug #13153

Answer 2

ctypes abuse:

import ctypes;ctypes.string_at(1)

This casts 1 to an address and dereferences it. On any sane system (i.e. one on which 0x00000001 is not a mapped address), this will segfault instantly.

Answer 3

60

import sys
sys.setrecursionlimit(1<<30)
f=lambda f:f(f)
f(f)

Not my own idea. Copied from the Python Wiki here.

This causes an infinite recursion, and is not stopped by the interpreter because we changed the recursion limit.

Answer 4

signal abuse (non-Windows only):

import os;os.kill(0,4)

On most systems (on which SIGILL = 4) this will kill Python with an "illegal instruction" error.

Or you can kill the program using the killer alarm clock:

import signal;signal.alarm(1)

After one second, Python dies with the cryptic message "Alarm clock".

Answer 5

In Python 3.3:

exec(type((lambda:0).__code__)(0,1,0,0,0,b'',(),(),(),'','',1,b''))

In Python 2.7 code objects are slightly different:

exec type((lambda:0).func_code)(0,1,0,0,'Q',(),(),(),'','',0,'')

Yes, you can pass any old rubbish to the byte code interpreter and it executes it (Python issue #17187).

Answer 6

Recursive iterators use the C stack, not the Python stack (issue #14010 and issue #14507):

i=''
for _ in range(9**6):i=filter(int,i)
del i

Answer 7

One easy way to crash the interpreter is to trick it into deallocating None:

import ctypes, sys
(ctypes.c_char*4).from_address(id(None))[:] = '\0'*4

As a bonus, here's a clever way to segfault Python 2:

import ctypes, struct, sys
inner = ()
outer = (inner,)
c_outer = (ctypes.c_char * sys.getsizeof(outer)).from_address(id(outer))
inner_index = c_outer[:].find(struct.pack('P', id(inner)))
c_outer[inner_index:inner_index+struct.calcsize('P')] = struct.pack('P', id(outer))
print outer

What exactly this does is left as an exercise to the reader.

Answer 8

Someone thought they could prevent new FlagsType objects from being created by setting FlagsType.tp_new = NULL, but they forgot to remove the method (issue #13204):

import sys
t=type(sys.flags)
t.__new__(t)

(sys.version_info has the same bug.)

Answer 9

Use of alloca in ctypes module (issue #13096):

from ctypes import *
POINTER('a'*9**8)

Answer 10

One possible way which crashes my Python with MemoryError:

x=[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]