Segmentation fault and misaligned pointer dereference with Rayon

[DGolubets]

Bug Description

I have a bug in a simple program using into_par_iter and cloning Py there.

First I get this:

[1]    187673 segmentation fault (core dumped)  python tests/test_nearby.py

On subsequent attempts I get:

thread '<unnamed>' panicked at /home/dmitry/.cargo/registry/src/index.crates.io-6f17d22bba15001f/pyo3-ffi-0.21.2/src/object.rs:111:12:
misaligned pointer dereference: address must be a multiple of 0x8 but is 0x748c219f768c
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
thread caused non-unwinding panic. aborting.
[1]    186383 IOT instruction (core dumped)  python tests/test_nearby.py

Steps to Reproduce

1. Rust code:

#[pyclass]
struct Foo(u32);

#[pymethods]
impl Foo {
    #[new]
    fn new(value: u32) -> Self {
        Foo(value)
    }
}

#[pyfunction]
fn isegv(py: Python<'_>, foo: Py<Foo>) -> PyResult<Vec<Py<Foo>>> {
    let res = (0..100).into_par_iter().map(|_| foo.clone()).collect();
    Ok(res)
}

2. maturin develop
3. python test.py

for i in range(0, 10000):
    isegv(Foo(i))

Backtrace

thread '<unnamed>' panicked at /home/dmitry/.cargo/registry/src/index.crates.io-6f17d22bba15001f/pyo3-ffi-0.21.2/src/object.rs:111:12:
misaligned pointer dereference: address must be a multiple of 0x8 but is 0x7d97710db68c
stack backtrace:
   0: rust_begin_unwind
             at /rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04/library/std/src/panicking.rs:647:5
   1: core::panicking::panic_nounwind_fmt::runtime
             at /rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04/library/core/src/panicking.rs:110:18
   2: core::panicking::panic_nounwind_fmt
             at /rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04/library/core/src/panicking.rs:122:9
   3: core::panicking::panic_misaligned_pointer_dereference
             at /rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04/library/core/src/panicking.rs:221:5
   4: pyo3_ffi::object::Py_TYPE
             at /home/dmitry/.cargo/registry/src/index.crates.io-6f17d22bba15001f/pyo3-ffi-0.21.2/src/object.rs:111:12
   5: pyo3_ffi::object::PyObject_TypeCheck
             at /home/dmitry/.cargo/registry/src/index.crates.io-6f17d22bba15001f/pyo3-ffi-0.21.2/src/object.rs:287:6
   6: pyo3::type_object::PyTypeInfo::is_type_of_bound
             at /home/dmitry/.cargo/registry/src/index.crates.io-6f17d22bba15001f/pyo3-0.21.2/src/type_object.rs:118:18
   7: <T as pyo3::type_object::PyTypeCheck>::type_check
             at /home/dmitry/.cargo/registry/src/index.crates.io-6f17d22bba15001f/pyo3-0.21.2/src/type_object.rs:160:9
   8: <pyo3::instance::Bound<pyo3::types::any::PyAny> as pyo3::types::any::PyAnyMethods>::downcast
             at /home/dmitry/.cargo/registry/src/index.crates.io-6f17d22bba15001f/pyo3-0.21.2/src/types/any.rs:2127:12
   9: <pyo3::instance::Bound<T> as pyo3::conversion::FromPyObject>::extract_bound
             at /home/dmitry/.cargo/registry/src/index.crates.io-6f17d22bba15001f/pyo3-0.21.2/src/instance.rs:1841:9
  10: <T as pyo3::conversion::FromPyObjectBound>::from_py_object_bound
             at /home/dmitry/.cargo/registry/src/index.crates.io-6f17d22bba15001f/pyo3-0.21.2/src/conversion.rs:313:9
  11: <pyo3::instance::Bound<pyo3::types::any::PyAny> as pyo3::types::any::PyAnyMethods>::extract
             at /home/dmitry/.cargo/registry/src/index.crates.io-6f17d22bba15001f/pyo3-0.21.2/src/types/any.rs:2188:9
  12: <pyo3::instance::Py<T> as pyo3::conversion::FromPyObject>::extract_bound
             at /home/dmitry/.cargo/registry/src/index.crates.io-6f17d22bba15001f/pyo3-0.21.2/src/instance.rs:1828:9
  13: <T as pyo3::conversion::FromPyObjectBound>::from_py_object_bound
             at /home/dmitry/.cargo/registry/src/index.crates.io-6f17d22bba15001f/pyo3-0.21.2/src/conversion.rs:313:9
  14: <pyo3::instance::Bound<pyo3::types::any::PyAny> as pyo3::types::any::PyAnyMethods>::extract
             at /home/dmitry/.cargo/registry/src/index.crates.io-6f17d22bba15001f/pyo3-0.21.2/src/types/any.rs:2188:9
  15: <T as pyo3::impl_::extract_argument::PyFunctionArgument>::extract
             at /home/dmitry/.cargo/registry/src/index.crates.io-6f17d22bba15001f/pyo3-0.21.2/src/impl_/extract_argument.rs:36:9
  16: pyo3::impl_::extract_argument::extract_argument
             at /home/dmitry/.cargo/registry/src/index.crates.io-6f17d22bba15001f/pyo3-0.21.2/src/impl_/extract_argument.rs:121:11
  17: py_similar_nearby::__pyfunction_isegv
             at ./src/lib.rs:88:31
  18: pyo3::impl_::trampoline::fastcall_with_keywords::{{closure}}
             at /home/dmitry/.cargo/registry/src/index.crates.io-6f17d22bba15001f/pyo3-0.21.2/src/impl_/trampoline.rs:45:29
  19: pyo3::impl_::trampoline::trampoline::{{closure}}
             at /home/dmitry/.cargo/registry/src/index.crates.io-6f17d22bba15001f/pyo3-0.21.2/src/impl_/trampoline.rs:187:54
  20: std::panicking::try::do_call
             at /rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04/library/std/src/panicking.rs:554:40
  21: __rust_try
  22: std::panicking::try
             at /rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04/library/std/src/panicking.rs:518:19
  23: std::panic::catch_unwind
             at /rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04/library/std/src/panic.rs:142:14
  24: pyo3::impl_::trampoline::trampoline
             at /home/dmitry/.cargo/registry/src/index.crates.io-6f17d22bba15001f/pyo3-0.21.2/src/impl_/trampoline.rs:187:9
  25: pyo3::impl_::trampoline::fastcall_with_keywords
             at /home/dmitry/.cargo/registry/src/index.crates.io-6f17d22bba15001f/pyo3-0.21.2/src/impl_/trampoline.rs:45:13
  26: py_similar_nearby::<impl py_similar_nearby::isegv::MakeDef>::_PYO3_DEF::trampoline
             at ./src/lib.rs:87:1
  27: <unknown>
  28: _PyEval_EvalFrameDefault
  29: <unknown>
  30: PyEval_EvalCode
  31: <unknown>
  32: <unknown>
  33: <unknown>
  34: _PyRun_SimpleFileObject
  35: _PyRun_AnyFileObject
  36: Py_RunMain
  37: Py_BytesMain
  38: __libc_start_call_main
             at ./csu/../sysdeps/nptl/libc_start_call_main.h:58:16
  39: __libc_start_main_impl
             at ./csu/../csu/libc-start.c:392:3
  40: _start
note: Some details are omitted, run with `RUST_BACKTRACE=full` for a verbose backtrace.
thread caused non-unwinding panic. aborting.
[1]    188723 IOT instruction (core dumped)  RUST_BACKTRACE=1 python tests/test_nearby.py

Your operating system and version

Ubuntu 22.04.4 LTS

Your Python version (python --version)

3.10.12

Your Rust version (rustc --version)

1.77.2

Your PyO3 version

0.21.2

How did you install python? Did you use a virtualenv?

Apt.
Yes, I use virtualenv.

Additional Info

The following version without clone doesn't have the problem:

#[pyfunction]
fn idontsegv(py: Python<'_>, foo: Py<Foo>) -> PyResult<Vec<Foo>> {
    let res = (0..100).into_par_iter().map(|i| Foo(i)).collect();
    Ok(res)
}

[davidhewitt]

Thanks for reporting - I think this is a duplicate of #4105, which we intend to resolve as part of #4095.