GeezerVison

Copy link

Copy Markdown

Member

vstinner requested a review from markshannon as a code owner May 20, 2021 23:46

erlend-aasland approved these changes May 20, 2021

View reviewed changes

pablogsal previously requested changes May 21, 2021

View reviewed changes

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

pablogsal dismissed their stale review May 21, 2021 00:16

import ast
import builtins
import sys
import os

tree = ast.parse("pass")
x = [tree]
x.append(x)

# Put the cycle somewhere to survive until the *last* GC collection
def callback(*args):
    pass
callback.a = x
os.register_at_fork(after_in_child=callback)

diff --git a/Objects/typeobject.c b/Objects/typeobject.c
index af99ab79d1..acbedc64e6 100644
--- a/Objects/typeobject.c
+++ b/Objects/typeobject.c
@@ -5,6 +5,7 @@
 #include "pycore_compile.h"       // _Py_Mangle()
 #include "pycore_initconfig.h"
 #include "pycore_moduleobject.h"  // _PyModule_GetDef()
+#include "pycore_pymem.h"  // _PyModule_GetDef()
 #include "pycore_object.h"
 #include "pycore_pyerrors.h"
 #include "pycore_pystate.h"       // _PyThreadState_GET()
@@ -1459,6 +1460,7 @@ subtype_dealloc(PyObject *self)
        our type from a HEAPTYPE to a non-HEAPTYPE, so be careful about
        reference counting. Only decref if the base type is not already a heap
        allocated type. Otherwise, basedealloc should have decref'd it already */
+    assert(!_PyMem_IsPtrFreed(type->tp_name));
     if (type_needs_decref) {
         Py_DECREF(type);
     }

erlend-aasland approved these changes May 21, 2021

View reviewed changes

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

vstinner deleted the subtype_dealloc branch May 21, 2021 17:19

Fix a crash at Python exit when a deallocator function removes the
last strong reference to a heap type.

Don't read type memory after calling basedealloc() since
basedealloc() can deallocate the type and free its memory.

_PyMem_IsPtrFreed() argument is now constant.
(cherry picked from commit 615069e)

Co-authored-by: Victor Stinner <[email protected]>

Fix a crash at Python exit when a deallocator function removes the
last strong reference to a heap type.

Don't read type memory after calling basedealloc() since
basedealloc() can deallocate the type and free its memory.

_PyMem_IsPtrFreed() argument is now constant.
(cherry picked from commit 615069e)

Co-authored-by: Victor Stinner <[email protected]>

Co-authored-by: Victor Stinner <[email protected]>

… it is also

trying to use a type after it's potentially been freed.

GH-27165)

The non-GC-type branch of subtype_dealloc is using the type of an object after freeing in the same unsafe way as GH-26274 fixes. (I believe the old news entry covers this change well enough.)

https://bugs.python.org/issue44184

…dealloc (pythonGH-27165)

The non-GC-type branch of subtype_dealloc is using the type of an object after freeing in the same unsafe way as pythonGH-26274 fixes. (I believe the old news entry covers this change well enough.)

https://bugs.python.org/issue44184
(cherry picked from commit 074e765)

Co-authored-by: T. Wouters <[email protected]>

…dealloc (pythonGH-27165)

The non-GC-type branch of subtype_dealloc is using the type of an object after freeing in the same unsafe way as pythonGH-26274 fixes. (I believe the old news entry covers this change well enough.)

https://bugs.python.org/issue44184
(cherry picked from commit 074e765)

Co-authored-by: T. Wouters <[email protected]>

Fix a crash at Python exit when a deallocator function removes the
last strong reference to a heap type.

Don't read type memory after calling basedealloc() since
basedealloc() can deallocate the type and free its memory.

_PyMem_IsPtrFreed() argument is now constant.
(cherry picked from commit 615069e)

Co-authored-by: Victor Stinner <[email protected]>

GH-27165) (GH-27174)

The non-GC-type branch of subtype_dealloc is using the type of an object after freeing in the same unsafe way as GH-26274 fixes. (I believe the old news entry covers this change well enough.)

https://bugs.python.org/issue44184
(cherry picked from commit 074e765)

Co-authored-by: T. Wouters <[email protected]>

GH-27165) (GH-27175)

The non-GC-type branch of subtype_dealloc is using the type of an object after freeing in the same unsafe way as GH-26274 fixes. (I believe the old news entry covers this change well enough.)

https://bugs.python.org/issue44184
(cherry picked from commit 074e765)

Co-authored-by: T. Wouters <[email protected]>

Fix a crash at Python exit when a deallocator function removes the
last strong reference to a heap type.

Don't read type memory after calling basedealloc() since
basedealloc() can deallocate the type and free its memory.

_PyMem_IsPtrFreed() argument is now constant.
(cherry picked from commit 615069e)

Co-authored-by: Victor Stinner <[email protected]>