Python equality operator segfaults for non-set messages (21.2)

[ngg]

What version of protobuf and what language are you using?
Version: 21.2
Language: Python

What operating system (Linux, Windows, ...) and version?
Linux / Windows / macOS all affected

What runtime / compiler are you using (e.g., python version or gcc version)
Python 3.9 / 3.10 both affected

What did you do?

// x.proto
syntax = "proto3";
message A {}
message B {
  A a = 1;
}

# crash.py
import x_pb2
x_pb2.B().a == x_pb2.A()

Steps to reproduce the behavior:

1. Save the files above
2. Run protoc --python_out=. x.proto
3. Run python crash.py

What did you expect to see
Python should not crash

What did you see instead?
Python crashes with a segmentation fault

Stack trace from gdb:

#0  0x00007ffff6dbb30e in _upb_Message_Getexts (msg=0x0, count=0x7fffffffb3a8) at upb/msg.c:116
#1  0x00007ffff6dbb57b in upb_Message_ExtensionCount (msg=0x0) at upb/msg.c:173
#2  0x00007ffff6d8eedb in upb_Message_IsEqual (msg1=0x0, msg2=0x55555595da38, m=0x555555819770) at python/convert.c:339
#3  0x00007ffff6d9842d in PyUpb_Message_IsEqual (m1=0x7ffff68838d0, _m2=0x7ffff6f47ec0) at python/message.c:572
#4  0x00007ffff6d98aeb in PyUpb_Message_RichCompare (_self=0x7ffff68838d0, other=0x7ffff6f47ec0, opid=2) at python/message.c:749

The bug seems to be in upb's python bindings: PyUpb_Message_IsEqual is called which calls PyUpb_Message_GetIfReified for the messages but does not handle null return values and calls upb_Message_IsEqual with a null pointer which also does not handle that case.

[ericsalo]

I cannot reproduce the crash:

$ cat crash.py
import x_pb2
x_pb2.B().a == x_pb2.A()
$ cat x.proto
// x.proto
syntax = "proto3";
message A {}
message B {
A a = 1;
}
$ protoc --version
libprotoc 3.21.2
$ protoc --python_out=. x.proto
$ python3 crash.py
$ python3 --version
Python 3.10.4

[ngg]

The protobuf python package must be at least version 4 to use the upb backend by default. Are you sure you're trying with that? We can reproduce this on multiple machines / operating systems.

$ python3
>>> import google.protobuf
>>> google.protobuf.__version__
'4.21.2'
>>> import google.protobuf.internal.api_implementation
>>> google.protobuf.internal.api_implementation.Type()
'upb'

[ericsalo]

Okay I finally have a test case that successfully crashes. Working on a fix now.

[ericsalo]

I've just pushed a fix so I am closing this ticket. Please let us know if you continue to see problems. Thank you for pointing this out.