]> git.ipfire.org Git - thirdparty/Python/cpython.git/commit
[3.12] gh-122527: Fix a crash on deallocation of `PyStructSequence` (GH-122577) ...
authorSam Gross <colesbury@gmail.com>
Fri, 6 Sep 2024 13:46:56 +0000 (09:46 -0400)
committerGitHub <noreply@github.com>
Fri, 6 Sep 2024 13:46:56 +0000 (15:46 +0200)
commit1bfb58cf2ff273534f7b92e9dc32873b77acec95
tree10b61cc9b9daf63b43efa8ca7caffc8fa6b7898b
parent74feab2bae0b5cb70ce236f2682bf167ef8664bd
[3.12] gh-122527: Fix a crash on deallocation of `PyStructSequence` (GH-122577) (#122626)

The `PyStructSequence` destructor would crash if it was deallocated after
its type's dictionary was cleared by the GC, because it couldn't compute
the "real size" of the instance. This could occur with relatively
straightforward code in the free-threaded build or with a reference
cycle involving the type in the default build, due to differing orders
in which `tp_clear()` was called.

Account for the non-sequence fields in `tp_basicsize` and use that,
along with `Py_SIZE()`, to compute the "real" size of a
`PyStructSequence` in the dealloc function. This avoids the accesses to
the type's dictionary during dealloc, which were unsafe.
(cherry picked from commit 4b63cd170e5dd840bffc80922f09f2d69932ff5c)
Lib/test/test_structseq.py
Misc/NEWS.d/next/Core_and_Builtins/2024-08-01-19-13-58.gh-issue-122527.eztso6.rst [new file with mode: 0644]
Objects/structseq.c