]> git.ipfire.org Git - thirdparty/Python/cpython.git/commit
[3.13] gh-122527: Fix a crash on deallocation of `PyStructSequence` (GH-122577) ...
authorMiss Islington (bot) <31488909+miss-islington@users.noreply.github.com>
Mon, 2 Sep 2024 10:47:18 +0000 (12:47 +0200)
committerGitHub <noreply@github.com>
Mon, 2 Sep 2024 10:47:18 +0000 (12:47 +0200)
commit57ba3b0c6e87264fc42ecf31780ec7c598380347
treef22eeb0c8c8244254705ef7b17b6d5639f174a80
parent3455d8560ae7be1f314593b16d20562294f9e50b
[3.13] gh-122527: Fix a crash on deallocation of `PyStructSequence` (GH-122577) (#122625)

gh-122527: Fix a crash on deallocation of `PyStructSequence` (GH-122577)

The `PyStructSequence` destructor would crash if it was deallocated after
its type's dictionary was cleared by the GC, because it couldn't compute
the "real size" of the instance. This could occur with relatively
straightforward code in the free-threaded build or with a reference
cycle involving the type in the default build, due to differing orders
in which `tp_clear()` was called.

Account for the non-sequence fields in `tp_basicsize` and use that,
along with `Py_SIZE()`, to compute the "real" size of a
`PyStructSequence` in the dealloc function. This avoids the accesses to
the type's dictionary during dealloc, which were unsafe.
(cherry picked from commit 4b63cd170e5dd840bffc80922f09f2d69932ff5c)

Co-authored-by: Sam Gross <colesbury@gmail.com>
Lib/test/test_structseq.py
Lib/test/test_sys.py
Misc/NEWS.d/next/Core_and_Builtins/2024-08-01-19-13-58.gh-issue-122527.eztso6.rst [new file with mode: 0644]
Objects/structseq.c