bpo-39877: Fix take_gil() for daemon threads (GH-19054)

bpo-39877, bpo-39984: If the thread must exit, don't access tstate to
prevent a potential crash: tstate memory has been freed.

diff --git a/Python/ceval_gil.h b/Python/ceval_gil.h
index 9c051ae57b03bcdf813036b83edeb13ba5f9e7eb..f8b06ac68c914494c20c6688cb17c71ee56e3f86 100644 (file)
--- a/Python/ceval_gil.h
+++ b/Python/ceval_gil.h
@@ -281,13 +281,17 @@ _ready:
     if (_Py_atomic_load_relaxed(&ceval->gil_drop_request)) {
         RESET_GIL_DROP_REQUEST(ceval);
     }
-    if (tstate->async_exc != NULL) {
+
+    int must_exit = tstate_must_exit(tstate);
+
+    /* Don't access tstate if the thread must exit */
+    if (!must_exit && tstate->async_exc != NULL) {
         _PyEval_SignalAsyncExc(ceval);
     }
 
     MUTEX_UNLOCK(gil->mutex);
 
-    if (tstate_must_exit(tstate)) {
+    if (must_exit) {
         /* bpo-36475: If Py_Finalize() has been called and tstate is not
            the thread which called Py_Finalize(), exit immediately the
            thread.