Skip to content

bpo-31095: fix potential crash during GC. #2974

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 4 commits into from
Aug 24, 2017
Merged

bpo-31095: fix potential crash during GC. #2974

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
cbce046
bpo-31095: fix potential crash during GC.
methane Aug 1, 2017
0d576ca
Replace _PyObject_GC_UNTRACK with PyObject_GC_UnTrack
methane Aug 3, 2017
4e97f02
bpo-31095: Document PyObject_GC_UnTrack requirement
methane Aug 3, 2017
1b2e354
Add note comments
methane Aug 23, 2017
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions Misc/NEWS.d/next/Core and Builtins/2017-08-01-18-48-30.bpo-31095.bXWZDb.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
Fix potential crash during GC caused by ``tp_dealloc`` which doesn't call
``PyObject_GC_UnTrack()``.
2 changes: 2 additions & 0 deletions Modules/_collectionsmodule.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1717,6 +1717,7 @@ dequeiter_traverse(dequeiterobject *dio, visitproc visit, void *arg)
static void
dequeiter_dealloc(dequeiterobject *dio)
{
PyObject_GC_UnTrack(dio);
Py_XDECREF(dio->deque);
PyObject_GC_Del(dio);
}
Expand Down Expand Up @@ -2097,6 +2098,7 @@ static PyMemberDef defdict_members[] = {
static void
defdict_dealloc(defdictobject *dd)
{
PyObject_GC_UnTrack(dd);
Py_CLEAR(dd->default_factory);
PyDict_Type.tp_dealloc((PyObject *)dd);
}
Expand Down
2 changes: 1 addition & 1 deletion Modules/_elementtree.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2076,14 +2076,14 @@ elementiter_dealloc(ElementIterObject *it)
{
Py_ssize_t i = it->parent_stack_used;
it->parent_stack_used = 0;
PyObject_GC_UnTrack(it);
while (i--)
Py_XDECREF(it->parent_stack[i].parent);
PyMem_Free(it->parent_stack);

Py_XDECREF(it->sought_tag);
Py_XDECREF(it->root_element);

PyObject_GC_UnTrack(it);
PyObject_GC_Del(it);
}

Expand Down
1 change: 1 addition & 0 deletions Modules/_functoolsmodule.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1073,6 +1073,7 @@ lru_cache_clear_list(lru_list_elem *link)
static void
lru_cache_dealloc(lru_cache_object *obj)
{
_PyObject_GC_UNTRACK(obj);
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

_PyObject_GC_UNTRACK() shouldn't be used in types that can be subclassed because it can't be called repeatedly. Otherwise the subclass's destructor would need to call _PyObject_GC_TRACK() before calling parent's destructor:

static void
lru_cache_subclass_dealloc(lru_cache_subclass_object *obj)
{
    _PyObject_GC_UNTRACK(obj);
    Py_XDECREF(obj->foo);
    Py_XDECREF(obj->bar);
    _PyObject_GC_TRACK(obj);
    lru_cache_dealloc((lru_cache_object *)obj);
}

This looks too fragile.

lru_list_elem *list = lru_cache_unlink_list(obj);
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Declaration after code is C99 syntax. The code will need rewriting for backporting to 2.7.

Py_XDECREF(obj->maxsize_O);
Py_XDECREF(obj->func);
Expand Down
1 change: 1 addition & 0 deletions Modules/_io/bytesio.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1084,6 +1084,7 @@ bytesiobuf_traverse(bytesiobuf *self, visitproc visit, void *arg)
static void
bytesiobuf_dealloc(bytesiobuf *self)
{
PyObject_GC_UnTrack(self);
Py_CLEAR(self->source);
Py_TYPE(self)->tp_free(self);
}
Expand Down
2 changes: 2 additions & 0 deletions Modules/_json.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -656,6 +656,7 @@ static void
scanner_dealloc(PyObject *self)
{
/* Deallocate scanner object */
PyObject_GC_UnTrack(self);
scanner_clear(self);
Py_TYPE(self)->tp_free(self);
}
Expand Down Expand Up @@ -1779,6 +1780,7 @@ static void
encoder_dealloc(PyObject *self)
{
/* Deallocate Encoder */
PyObject_GC_UnTrack(self);
encoder_clear(self);
Py_TYPE(self)->tp_free(self);
}
Expand Down
1 change: 1 addition & 0 deletions Modules/_ssl.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2778,6 +2778,7 @@ context_clear(PySSLContext *self)
static void
context_dealloc(PySSLContext *self)
{
PyObject_GC_UnTrack(self);
context_clear(self);
SSL_CTX_free(self->ctx);
#ifdef OPENSSL_NPN_NEGOTIATED
Expand Down
1 change: 1 addition & 0 deletions Modules/_struct.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1589,6 +1589,7 @@ typedef struct {
static void
unpackiter_dealloc(unpackiterobject *self)
{
PyObject_GC_UnTrack(self);
Py_XDECREF(self->so);
PyBuffer_Release(&self->buf);
PyObject_GC_Del(self);
Expand Down
2 changes: 2 additions & 0 deletions Objects/dictobject.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3407,6 +3407,7 @@ dictiter_new(PyDictObject *dict, PyTypeObject *itertype)
static void
dictiter_dealloc(dictiterobject *di)
{
_PyObject_GC_UNTRACK(di);
Py_XDECREF(di->di_dict);
Py_XDECREF(di->di_result);
PyObject_GC_Del(di);
Expand Down Expand Up @@ -3766,6 +3767,7 @@ dictiter_reduce(dictiterobject *di)
static void
dictview_dealloc(_PyDictViewObject *dv)
{
_PyObject_GC_UNTRACK(dv);
Py_XDECREF(dv->dv_dict);
PyObject_GC_Del(dv);
}
Expand Down
1 change: 1 addition & 0 deletions Objects/setobject.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -809,6 +809,7 @@ typedef struct {
static void
setiter_dealloc(setiterobject *si)
{
_PyObject_GC_UNTRACK(si);
Py_XDECREF(si->si_set);
PyObject_GC_Del(si);
}
Expand Down
1 change: 1 addition & 0 deletions Parser/asdl_c.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -633,6 +633,7 @@ def visitModule(self, mod):
static void
ast_dealloc(AST_object *self)
{
_PyObject_GC_UNTRACK(self);
Py_CLEAR(self->dict);
Py_TYPE(self)->tp_free(self);
}
Expand Down
1 change: 1 addition & 0 deletions Python/Python-ast.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -520,6 +520,7 @@ typedef struct {
static void
ast_dealloc(AST_object *self)
{
_PyObject_GC_UNTRACK(self);
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The same as for lru_cache. _ast.AST is subclassable.

Py_CLEAR(self->dict);
Py_TYPE(self)->tp_free(self);
}
Expand Down