bpo-40170: Fix PyType_Ready() refleak on static type (GH-23236)

bpo-1635741, bpo-40170: When called on a static type with NULL
tp_base, PyType_Ready() no longer increments the reference count of
the PyBaseObject_Type ("object). PyTypeObject.tp_base is a strong
reference on a heap type, but it is borrowed reference on a static
type.

Fix 99 reference leaks at Python exit (showrefcount 18623 => 18524).

diff --git a/Include/cpython/object.h b/Include/cpython/object.h
index ec6a3647677766c495d2a937a628ff39628aadf7..43b0be37557a3fb514374654a5458a916a589596 100644 (file)
--- a/Include/cpython/object.h
+++ b/Include/cpython/object.h
@@ -244,6 +244,7 @@ struct _typeobject {
     struct PyMethodDef *tp_methods;
     struct PyMemberDef *tp_members;
     struct PyGetSetDef *tp_getset;
+    // Strong reference on a heap type, borrowed reference on a static type
     struct _typeobject *tp_base;
     PyObject *tp_dict;
     descrgetfunc tp_descr_get;

diff --git a/Objects/typeobject.c b/Objects/typeobject.c
index 4d0a3faeceb89d7e1b658833ce0caf896301438f..fd018b8b032fe6e45c4983d92fe0aab7e3d86a76 100644 (file)
--- a/Objects/typeobject.c
+++ b/Objects/typeobject.c
@@ -5487,8 +5487,13 @@ PyType_Ready(PyTypeObject *type)
     /* Initialize tp_base (defaults to BaseObject unless that's us) */
     base = type->tp_base;
     if (base == NULL && type != &PyBaseObject_Type) {
-        base = type->tp_base = &PyBaseObject_Type;
-        Py_INCREF(base);
+        base = &PyBaseObject_Type;
+        if (type->tp_flags & Py_TPFLAGS_HEAPTYPE) {
+            type->tp_base = (PyTypeObject*)Py_NewRef((PyObject*)base);
+        }
+        else {
+            type->tp_base = base;
+        }
     }
 
     /* Now the only way base can still be NULL is if type is