bpo-31095: fix potential crash during GC.#2974
Conversation
Some tp_dealloc methods of GC types didn't call PyObject_GC_UnTrack().
serhiy-storchaka
left a comment
There was a problem hiding this comment.
LGTM (besides two details).
But this touches delicate things, and I think this PR needs a review of yet one core developer.
Modules/_functoolsmodule.c
Outdated
| static void | ||
| lru_cache_dealloc(lru_cache_object *obj) | ||
| { | ||
| _PyObject_GC_UNTRACK(obj); |
There was a problem hiding this comment.
_PyObject_GC_UNTRACK() shouldn't be used in types that can be subclassed because it can't be called repeatedly. Otherwise the subclass's destructor would need to call _PyObject_GC_TRACK() before calling parent's destructor:
static void
lru_cache_subclass_dealloc(lru_cache_subclass_object *obj)
{
_PyObject_GC_UNTRACK(obj);
Py_XDECREF(obj->foo);
Py_XDECREF(obj->bar);
_PyObject_GC_TRACK(obj);
lru_cache_dealloc((lru_cache_object *)obj);
}
This looks too fragile.
Modules/_functoolsmodule.c
Outdated
| lru_cache_dealloc(lru_cache_object *obj) | ||
| { | ||
| _PyObject_GC_UNTRACK(obj); | ||
| lru_list_elem *list = lru_cache_unlink_list(obj); |
There was a problem hiding this comment.
Declaration after code is C99 syntax. The code will need rewriting for backporting to 2.7.
Python/Python-ast.c
Outdated
| static void | ||
| ast_dealloc(AST_object *self) | ||
| { | ||
| _PyObject_GC_UNTRACK(self); |
There was a problem hiding this comment.
The same as for lru_cache. _ast.AST is subclassable.
benjaminp
left a comment
There was a problem hiding this comment.
lgtm. This suggests that we need a systematic way to deal with this problem, though.
vstinner
left a comment
There was a problem hiding this comment.
I suggest to add a comment explaining why an explicit Untrack is required.
|
A Python core developer has requested some changes be made to your pull request before we can consider merging it. If you could please address their requests along with any other requests in other reviews from core developers that would be appreciated. Once you have made the requested changes, please leave a comment on this pull request containing the phrase |
tiran
left a comment
There was a problem hiding this comment.
SSL and elementtree changes LGTM
(cherry picked from commit a6296d3)
|
GH-3195 is a backport of this pull request to the 3.6 branch. |
(cherry picked from commit a6296d3)
see the following sites for details: * https://bugs.python.org/issue31095 * python/cpython#2974 Fixes #35.
see the following sites for details:
* https://bugs.python.org/issue31095
* python/cpython#2974
see the following sites for details:
* https://bugs.python.org/issue31095
* python/cpython#2974
see the following sites for details:
* https://bugs.python.org/issue31095
* python/cpython#2974
|
Thanks @methane for the PR 🌮🎉.. I'm working now to backport this PR to: 2.7. |
|
Sorry, @methane, I could not cleanly backport this to |
|
The commit 4cde4bd is the backport to Python 2.7. |
call PyObject_GC_UnTrack() in tp_dealloc() see the following sites for details: * https://bugs.python.org/issue31095 * python/cpython#2974
call PyObject_GC_UnTrack() in tp_dealloc() see the following sites for details: * https://bugs.python.org/issue31095 * python/cpython#2974
call PyObject_GC_UnTrack() in tp_dealloc() see the following sites for details: * https://bugs.python.org/issue31095 * python/cpython#2974
call PyObject_GC_UnTrack() in tp_dealloc()
see the following sites for details:
* https://bugs.python.org/issue31095
* python/cpython#2974
call PyObject_GC_UnTrack() in tp_dealloc()
see the following sites for details:
* https://bugs.python.org/issue31095
* python/cpython#2974
see the following sites for details:
* https://bugs.python.org/issue31095
* python/cpython#2974
see the following sites for details:
* https://bugs.python.org/issue31095
* python/cpython#2974
Some tp_dealloc methods of GC types didn't call PyObject_GC_UnTrack().
https://bugs.python.org/issue31095