pybind miss NONE type checking cause core dump

[ericyuanhui]

Reproduction Script and Input

Reproduction script:

/home/eric/install/lbug_debug/lbug_tcdml03_gdb.py

Relevant input:

rows = [
    {"id": "r0", "c_list": ["a", "b"]},
    {"id": "r1", "c_list": ["single"]},
    {"id": "r2", "c_list": []},
    {"id": "r3", "c_list": None},
    {"id": "r4", "c_list": ["x", "y"]},
]

The query is:

UNWIND $rows AS row
WITH row WHERE row.`id` IS NOT NULL AND row.`id` <> ""
MERGE (e:`lbuginvest` {`id`: row.`id`})
SET e.`c_list` = row.`c_list`;

The list values in the preceding rows cause the pybind parameter binder to infer a type approximately equivalent to:

LIST<STRUCT<id: STRING, c_list: LIST<STRING>>>

When processing the fourth row, r3, the target type of c_list has already been inferred as LIST<STRING>, while its actual Python value is None.

Core Dump Evidence

Core dump:

/home/eric/core_dump/core-python-26849-1785470797

It was generated by the uv-managed Python 3.13 interpreter. The relevant crash-thread stack trace is:

pybind11::str::check_
pybind11::isinstance<pybind11::str>
PyConnection::transformPythonValueAs
PyConnection::transformPythonValueFromParameterAs
PyConnection::transformPythonValueFromParameterAs
PyConnection::transformPythonValueFromParameterAs
transformPythonParameters
PyConnection::prepare

Relevant local variables from the stack frames:

val   = _Py_NoneStruct
type  = LIST<STRING>
child = 0xf1c300 <_mi_page_empty>

The crash occurs in pybind11::str::check_. It attempts to read the Python object type of child, but child is not a valid Python object. It is mimalloc's empty-page sentinel.

lbug_tcdml03_gdb.py