PyType_Ready(): Complain if the type is a base type, and gc'able, and

tp_free is NULL or PyObject_Del at the end.  Because it's a base type
it must call tp_free in its dealloc function, and because it's gc'able
it must not call PyObject_Del.

inherit_slots():  Don't inherit tp_free unless the type and its base
agree about whether they're gc'able.  If the type is gc'able and the
base is not, and the base uses the default PyObject_Del for its
tp_free, give the type PyObject_GC_Del for its tp_free (the appropriate
default for a gc'able type).

cPickle.c:  The Pickler and Unpickler types claim to be base classes
and gc'able, but their dealloc functions didn't call tp_free.
Repaired that.  Also call PyType_Ready() on these typeobjects, so
that the correct (PyObject_GC_Del) default memory-freeing function
gets plugged into these types' tp_free slots.

diff --git a/Misc/NEWS b/Misc/NEWS
index 453b163dd8e271eadbb542fb3e38c7dbacb5914b..465f0c6bac2130c7dd20b7c25e3c9c81526aaf5c 100644 (file)
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -2,6 +2,17 @@ What's New in Python 2.2.3 ?
 Release date: XX-XXX-2003
 ============================
 
+- C API:  PyType_Ready():  If a type declares that it participates in gc
+  (Py_TPFLAGS_HAVE_GC), and its base class does not, and its base class's
+  tp_free slot is the default _PyObject_Del, and type does not define
+  a tp_free slot itself, _PyObject_GC_Del is assigned to type->tp_free.
+  Previously _PyObject_Del was inherited, which could at best lead to a
+  segfault.  In addition, if even after this magic the type's tp_free
+  slot is _PyObject_Del or NULL, and the type is a base type
+  (Py_TPFLAGS_BASETYPE), TypeError is raised:  since the type is a base
+  type, its dealloc function must call type->tp_free, and since the type
+  is gc'able, tp_free must not be NULL or _PyObject_Del.
+
 - Windows:  file.truncate(size) failed on large files when size didn't
   fit in 32 bits.  This was fixed by backporting new Windows truncation
   code and tests from 2.3.

diff --git a/Modules/cPickle.c b/Modules/cPickle.c
index 5ecf744ff818768d70698ae4e9d8644c191e4d47..71bffb6dc53b7fb3f31c65f6cf1c864345c47bb5 100644 (file)
--- a/Modules/cPickle.c
+++ b/Modules/cPickle.c
@@ -2369,7 +2369,7 @@ Pickler_dealloc(Picklerobject *self) {
         free(self->write_buf);
     }
 
-    PyObject_GC_Del(self);
+    self->ob_type->tp_free((PyObject *)self);
 }
 
 static int
@@ -4318,7 +4318,7 @@ Unpickler_dealloc(Unpicklerobject *self) {
         free(self->buf);
     }
 
-    PyObject_GC_Del(self);
+    self->ob_type->tp_free((PyObject *)self);
 }
 
 static int
@@ -4606,6 +4606,11 @@ init_stuff(PyObject *module_dict) {
 
 #define INIT_STR(S) UNLESS(S ## _str=PyString_InternFromString(#S)) return -1;
 
+    if (PyType_Ready(&Unpicklertype) < 0)
+       return -1;
+    if (PyType_Ready(&Picklertype) < 0)
+       return -1;
+  
     INIT_STR(__class__);
     INIT_STR(__getinitargs__);
     INIT_STR(__dict__);

diff --git a/Objects/typeobject.c b/Objects/typeobject.c
index 0597921a105e50f0c75aea6ad6f79e9f9f3dcea3..ade9171a59912b1c478e33170197627ef131de95 100644 (file)
--- a/Objects/typeobject.c
+++ b/Objects/typeobject.c
@@ -2092,8 +2092,25 @@ inherit_slots(PyTypeObject *type, PyTypeObject *base)
                COPYSLOT(tp_descr_set);
                COPYSLOT(tp_init);
                COPYSLOT(tp_alloc);
-               COPYSLOT(tp_free);
                COPYSLOT(tp_is_gc);
+               if ((type->tp_flags & Py_TPFLAGS_HAVE_GC) ==
+                   (base->tp_flags & Py_TPFLAGS_HAVE_GC)) {
+                       /* They agree about gc. */
+                       COPYSLOT(tp_free);
+               }
+               else if ((type->tp_flags & Py_TPFLAGS_HAVE_GC) &&
+                        type->tp_free == NULL &&
+                        base->tp_free == _PyObject_Del) {
+                       /* A bit of magic to plug in the correct default
+                        * tp_free function when a derived class adds gc,
+                        * didn't define tp_free, and the base uses the
+                        * default non-gc tp_free.
+                        */
+                       type->tp_free = _PyObject_GC_Del;
+               }
+               /* else they didn't agree about gc, and there isn't something
+                * obvious to be done -- the type is on its own.
+                */
        }
 }
 
@@ -2189,6 +2206,19 @@ PyType_Ready(PyTypeObject *type)
                        inherit_slots(type, (PyTypeObject *)b);
        }
 
+       /* Sanity check for tp_free. */
+       if (PyType_IS_GC(type) && (type->tp_flags & Py_TPFLAGS_BASETYPE) &&
+           (type->tp_free == NULL || type->tp_free == _PyObject_Del)) {
+               /* This base class needs to call tp_free, but doesn't have
+                * one, or its tp_free is for non-gc'ed objects.
+                */
+               PyErr_Format(PyExc_TypeError, "type '%.100s' participates in "
+                            "gc and is a base type but has inappropriate "
+                            "tp_free slot",
+                            type->tp_name);
+               goto error;
+       }
+
        /* if the type dictionary doesn't contain a __doc__, set it from
           the tp_doc slot.
         */
@@ -2748,7 +2778,7 @@ wrap_init(PyObject *self, PyObject *args, void *wrapped, PyObject *kwds)
        Py_INCREF(Py_None);
        return Py_None;
 }
-  
+
 static PyObject *
 wrap_descr_delete(PyObject *self, PyObject *args, void *wrapped)
 {