]> git.ipfire.org Git - thirdparty/Python/cpython.git/commit
gh-122527: Fix a crash on deallocation of `PyStructSequence` (GH-122577)
authorSam Gross <colesbury@gmail.com>
Fri, 2 Aug 2024 16:11:44 +0000 (12:11 -0400)
committerGitHub <noreply@github.com>
Fri, 2 Aug 2024 16:11:44 +0000 (18:11 +0200)
commit4b63cd170e5dd840bffc80922f09f2d69932ff5c
treeffecccece47cd87b293893edda840c2b65295b99
parent7aca84e557d0a6d242f322c493d53947a56bde91
gh-122527: Fix a crash on deallocation of `PyStructSequence` (GH-122577)

The `PyStructSequence` destructor would crash if it was deallocated after
its type's dictionary was cleared by the GC, because it couldn't compute
the "real size" of the instance. This could occur with relatively
straightforward code in the free-threaded build or with a reference
cycle involving the type in the default build, due to differing orders
in which `tp_clear()` was called.

Account for the non-sequence fields in `tp_basicsize` and use that,
along with `Py_SIZE()`, to compute the "real" size of a
`PyStructSequence` in the dealloc function. This avoids the accesses to
the type's dictionary during dealloc, which were unsafe.
Lib/test/test_structseq.py
Lib/test/test_sys.py
Misc/NEWS.d/next/Core_and_Builtins/2024-08-01-19-13-58.gh-issue-122527.eztso6.rst [new file with mode: 0644]
Objects/structseq.c