GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — Hold the owner of a borrowed GraphBLAS handle in TypedOpBase by eriknw · Pull Request #587 · python-graphblas/python-graphblas

Conversation

@eriknw

@eriknw eriknw commented Aug 4, 2026

Copy link
Copy Markdown
Member

SelectOp._from_indexunary reuses the IndexUnaryOp's GrB_IndexUnaryOp
rather than allocating a second one, and marked the borrowing typed op
_owns_gb_obj_inst = False so that only one side would free it. Nothing
kept the owner alive, though: register_anonymous drops the IndexUnaryOp
on the way out, so its typed op is collected and frees the handle while the
SelectOp is still pointing at it.

The result is a dangling pointer rather than a NULL one. __del__ frees
through a synthesized cell, ffi.new(f"{c_type_name}*", gb_obj), so
GrB_*_free clears that temporary and leaves the op's own gb_obj holding
the old address.

Reproduced at 6f1eb02:

def _ne_thunk(x, i, j, thunk):
    return x != thunk
sel = SelectOp.register_anonymous(_ne_thunk)
gc.collect()
Vector.from_coo([0, 1, 2], [1, 5, 9]).select(sel, 5).new()
-> UninitializedObject

Whether it raises depends on whether anything happens to retain the
IndexUnaryOp. With x > thunk it survives, because a traceback caught
inside the per-dtype compile loop keeps a frame that references it.

Replace the per-instance opt-out with _gb_obj_owner, naming the owning
typed op. That suppresses our free and keeps the handle alive for as long
as we can reach it; disclaiming ownership without naming an owner is what
left the handle dangling. The opt-out being replaced was added in 6f1eb02
to stop a double free, so the sequence is leak, double free, opt-out,
dangling handle, and now an owned reference.


Stack created with GitHub Stacks CLI • Give Feedback 💬

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions
@eriknw
eriknw marked this pull request as ready for review August 4, 2026 16:07
@eriknw
eriknw force-pushed the 07-selectop-borrowed-handle-lifetime branch from 5c6a883 to 62aa452 Compare August 4, 2026 16:12
@eriknw
eriknw force-pushed the 07-selectop-borrowed-handle-lifetime branch 2 times, most recently from 011d167 to bdfc46d Compare August 5, 2026 03:18
@eriknw
eriknw force-pushed the 07-selectop-borrowed-handle-lifetime branch from bdfc46d to 99a59d4 Compare August 5, 2026 17:44
@eriknw
eriknw force-pushed the 07-selectop-borrowed-handle-lifetime branch from 99a59d4 to 67a9305 Compare August 5, 2026 18:03
Base automatically changed from 06-numpy-monoid-identities to main August 5, 2026 18:05
@eriknw
eriknw force-pushed the 07-selectop-borrowed-handle-lifetime branch from 67a9305 to 1c41f2b Compare August 5, 2026 18:05
@eriknw
eriknw changed the base branch from main to 42-arm-pickle3-numpy1-skip August 6, 2026 07:58
@eriknw
eriknw force-pushed the 07-selectop-borrowed-handle-lifetime branch from 1c41f2b to cfb2cb7 Compare August 6, 2026 07:59
@eriknw
eriknw force-pushed the 07-selectop-borrowed-handle-lifetime branch from cfb2cb7 to 886374b Compare August 6, 2026 15:39
@eriknw
eriknw force-pushed the 07-selectop-borrowed-handle-lifetime branch from 886374b to 0eff3f4 Compare August 6, 2026 15:41
@eriknw
eriknw changed the base branch from 42-arm-pickle3-numpy1-skip to 43-ci-local-rng August 6, 2026 20:35
@eriknw
eriknw force-pushed the 07-selectop-borrowed-handle-lifetime branch from 0eff3f4 to e1d701a Compare August 6, 2026 20:36
@eriknw
eriknw force-pushed the 07-selectop-borrowed-handle-lifetime branch from e1d701a to 092ab62 Compare August 6, 2026 20:42
@eriknw
eriknw force-pushed the 07-selectop-borrowed-handle-lifetime branch from 092ab62 to 252c82c Compare August 7, 2026 02:48
Base automatically changed from 43-ci-local-rng to main August 7, 2026 05:09
@eriknw
eriknw force-pushed the 07-selectop-borrowed-handle-lifetime branch from 252c82c to 22af6b1 Compare August 7, 2026 05:09
@eriknw
eriknw force-pushed the 07-selectop-borrowed-handle-lifetime branch from 22af6b1 to 4f0dabb Compare August 26, 2026 17:30
This was referenced Aug 26, 2026
Adapt to SuiteSparse:GraphBLAS 10.5.0 and read its version from the library #628
Merged
Cover SuiteSparse:GraphBLAS 10.4 and 10.5 in the CI psg pool #629
Merged
@eriknw
Hold the owner of a borrowed GraphBLAS handle in TypedOpBase
249a147
`SelectOp._from_indexunary` reuses the IndexUnaryOp's `GrB_IndexUnaryOp`
rather than allocating a second one, and marked the borrowing typed op
`_owns_gb_obj_inst = False` so that only one side would free it. Nothing
kept the owner alive, though: `register_anonymous` drops the IndexUnaryOp
on the way out, so its typed op is collected and frees the handle while the
SelectOp is still pointing at it.

The result is a dangling pointer rather than a NULL one. `__del__` frees
through a synthesized cell, `ffi.new(f"{c_type_name}*", gb_obj)`, so
`GrB_*_free` clears that temporary and leaves the op's own `gb_obj` holding
the old address.

Reproduced at 6f1eb02:

    def _ne_thunk(x, i, j, thunk):
        return x != thunk
    sel = SelectOp.register_anonymous(_ne_thunk)
    gc.collect()
    Vector.from_coo([0, 1, 2], [1, 5, 9]).select(sel, 5).new()
    -> UninitializedObject

Whether it raises depends on whether anything happens to retain the
IndexUnaryOp. With `x > thunk` it survives, because a traceback caught
inside the per-dtype compile loop keeps a frame that references it.

Replace the per-instance opt-out with `_gb_obj_owner`, naming the owning
typed op. That suppresses our free and keeps the handle alive for as long
as we can reach it; disclaiming ownership without naming an owner is what
left the handle dangling. The opt-out being replaced was added in 6f1eb02
to stop a double free, so the sequence is leak, double free, opt-out,
dangling handle, and now an owned reference.
@eriknw
eriknw force-pushed the 07-selectop-borrowed-handle-lifetime branch from 01245a0 to 249a147 Compare September 18, 2026 03:09
@eriknw
Note the borrowed-handle exception on TypedUserSelectOp._owns_gb_obj
3ba0f36
Read on its own, `_owns_gb_obj = True` says every TypedUserSelectOp frees
its handle. The ones `_from_indexunary` builds do not: they borrow the
IndexUnaryOp's `GrB_IndexUnaryOp` and set `_gb_obj_owner`, which suppresses
the free.

Worth a comment because the mistake is silent. Freeing from both sides is a
use-after-free, and a freed handle usually still reads as valid: with the
ownership removed, select kept returning correct results even after 30
fresh allocations churned the allocator. No test would catch it.
@eriknw
eriknw merged commit 6a967a7 into main Sep 18, 2026
27 of 28 checks passed

Uh oh!

There was an error while loading. Please reload this page.

@eriknw
eriknw deleted the 07-selectop-borrowed-handle-lifetime branch September 18, 2026 17:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

1 participant

@eriknw
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.