GeezerVisonThe World Wide Web, restored to 800 pixels of glory. | |||
| Home|About|Gaming cabinet|Archives|How it works|Starter sites | |||
GeezerVison is showing github.com — gh-142349: Fix refcount corruption in lazy import specialization by pablogsal · Pull Request #144733 · python/cpython Conversation
|
If that were true then there would not be crashes no? |
All reactions
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
Unless the problem is actually something different, yes :) I would like to know which it is. |
All reactions
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
ca6f0f9 to
2fe3763
Compare
_PyDict_LookupIndexAndValue() returns a borrowed reference via _Py_dict_lookup(), but specialize_load_global_lock_held() called Py_DECREF(value) on it when bailing out for lazy imports. Each time the adaptive counter fired while a lazy import was still in globals, this stole one reference from the dict's object. With 8+ threads racing through LOAD_GLOBAL during concurrent lazy import resolution, enough triggers accumulated to drive the refcount to zero while the dict and other threads still referenced the object, causing use-after-free.
2fe3763 to
c7defe2
Compare
Narrator: and the problem was indeed something different. Kind of |
All reactions
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
python#144733) Remove spurious Py_DECREF on borrowed ref in LOAD_GLOBAL specialization _PyDict_LookupIndexAndValue() returns a borrowed reference via _Py_dict_lookup(), but specialize_load_global_lock_held() called Py_DECREF(value) on it when bailing out for lazy imports. Each time the adaptive counter fired while a lazy import was still in globals, this stole one reference from the dict's object. With 8+ threads racing through LOAD_GLOBAL during concurrent lazy import resolution, enough triggers accumulated to drive the refcount to zero while the dict and other threads still referenced the object, causing use-after-free.
Add a regression test ensuring that circular lazy imports raise a proper error (ImportCycleError) instead of crashing with a segfault. The crash was fixed in pythongh-144733 but no test was added at the time.
Add a regression test ensuring that circular lazy imports raise a proper error (ImportCycleError) instead of crashing with a segfault. The crash was fixed in pythongh-144733 but no test was added at the time.
python#144733) Remove spurious Py_DECREF on borrowed ref in LOAD_GLOBAL specialization _PyDict_LookupIndexAndValue() returns a borrowed reference via _Py_dict_lookup(), but specialize_load_global_lock_held() called Py_DECREF(value) on it when bailing out for lazy imports. Each time the adaptive counter fired while a lazy import was still in globals, this stole one reference from the dict's object. With 8+ threads racing through LOAD_GLOBAL during concurrent lazy import resolution, enough triggers accumulated to drive the refcount to zero while the dict and other threads still referenced the object, causing use-after-free.
…) (python#144838) Add a regression test ensuring that circular lazy imports raise a proper error (ImportCycleError) instead of crashing with a segfault. The crash was fixed in pythongh-144733 but no test was added at the time.
python#144733) Remove spurious Py_DECREF on borrowed ref in LOAD_GLOBAL specialization _PyDict_LookupIndexAndValue() returns a borrowed reference via _Py_dict_lookup(), but specialize_load_global_lock_held() called Py_DECREF(value) on it when bailing out for lazy imports. Each time the adaptive counter fired while a lazy import was still in globals, this stole one reference from the dict's object. With 8+ threads racing through LOAD_GLOBAL during concurrent lazy import resolution, enough triggers accumulated to drive the refcount to zero while the dict and other threads still referenced the object, causing use-after-free.
…) (python#144838) Add a regression test ensuring that circular lazy imports raise a proper error (ImportCycleError) instead of crashing with a segfault. The crash was fixed in pythongh-144733 but no test was added at the time.
Reviewers
Uh oh!
There was an error while loading. Please reload this page.
Assignees
No one assignedLabels
Projects
Milestone
No milestoneDevelopment
Successfully merging this pull request may close these issues.
Uh oh!
There was an error while loading. Please reload this page.
3 participants
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.