bpo-44184: Fix subtype_dealloc() for freed type by vstinner · Pull Request #26274 · python/cpython
Fix a crash at Python exit when a deallocator function removes the last strong reference to a heap type. Don't read type memory after calling basedealloc() since basedealloc() can deallocate the type and free its memory.
miss-islington pushed a commit to miss-islington/cpython that referenced this pull request
Fix a crash at Python exit when a deallocator function removes the last strong reference to a heap type. Don't read type memory after calling basedealloc() since basedealloc() can deallocate the type and free its memory. _PyMem_IsPtrFreed() argument is now constant. (cherry picked from commit 615069e) Co-authored-by: Victor Stinner <vstinner@python.org>
vstinner added a commit that referenced this pull request
Fix a crash at Python exit when a deallocator function removes the last strong reference to a heap type. Don't read type memory after calling basedealloc() since basedealloc() can deallocate the type and free its memory. _PyMem_IsPtrFreed() argument is now constant. (cherry picked from commit 615069e) Co-authored-by: Victor Stinner <vstinner@python.org> Co-authored-by: Victor Stinner <vstinner@python.org>
Yhg1s added a commit to Yhg1s/cpython that referenced this pull request
… it is also trying to use a type after it's potentially been freed.
miss-islington pushed a commit to miss-islington/cpython that referenced this pull request
miss-islington pushed a commit to miss-islington/cpython that referenced this pull request
miss-islington pushed a commit to miss-islington/cpython that referenced this pull request
Fix a crash at Python exit when a deallocator function removes the last strong reference to a heap type. Don't read type memory after calling basedealloc() since basedealloc() can deallocate the type and free its memory. _PyMem_IsPtrFreed() argument is now constant. (cherry picked from commit 615069e) Co-authored-by: Victor Stinner <vstinner@python.org>
Yhg1s added a commit that referenced this pull request
GH-27165) (GH-27174) The non-GC-type branch of subtype_dealloc is using the type of an object after freeing in the same unsafe way as GH-26274 fixes. (I believe the old news entry covers this change well enough.) https://bugs.python.org/issue44184 (cherry picked from commit 074e765) Co-authored-by: T. Wouters <thomas@python.org>
Yhg1s added a commit that referenced this pull request
GH-27165) (GH-27175) The non-GC-type branch of subtype_dealloc is using the type of an object after freeing in the same unsafe way as GH-26274 fixes. (I believe the old news entry covers this change well enough.) https://bugs.python.org/issue44184 (cherry picked from commit 074e765) Co-authored-by: T. Wouters <thomas@python.org>
miss-islington added a commit that referenced this pull request
Fix a crash at Python exit when a deallocator function removes the last strong reference to a heap type. Don't read type memory after calling basedealloc() since basedealloc() can deallocate the type and free its memory. _PyMem_IsPtrFreed() argument is now constant. (cherry picked from commit 615069e) Co-authored-by: Victor Stinner <vstinner@python.org>