Mirror
/
cpython
mirror of https://github.com/python/cpython
4
1
Fork 0
Code Issues Releases Wiki Activity

bpo-44184: Apply GH-26274 to the non-GC-type branch of subtype_dealloc (GH-27165) 

The non-GC-type branch of subtype_dealloc is using the type of an object after freeing in the same unsafe way as GH-26274 fixes. (I believe the old news entry covers this change well enough.)

https://bugs.python.org/issue44184
This commit is contained in:
T. Wouters 2021-07-16 00:40:57 +02:00 committed by GitHub
parent 82b218f36c
commit 074e7659f2
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 11 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
Objects/typeobject.c
View File

@ -1368,14 +1368,22 @@ subtype_dealloc(PyObject *self)
/* Extract the type again; tp_del may have changed it */
type = Py_TYPE(self);
// Don't read type memory after calling basedealloc() since basedealloc()
// can deallocate the type and free its memory.
int type_needs_decref = (type->tp_flags & Py_TPFLAGS_HEAPTYPE
&& !(base->tp_flags & Py_TPFLAGS_HEAPTYPE));
/* Call the base tp_dealloc() */
assert(basedealloc);
basedealloc(self);
/* Only decref if the base type is not already a heap allocated type.
Otherwise, basedealloc should have decref'd it already */
if (type->tp_flags & Py_TPFLAGS_HEAPTYPE && !(base->tp_flags & Py_TPFLAGS_HEAPTYPE))
/* Can't reference self beyond this point. It's possible tp_del switched
our type from a HEAPTYPE to a non-HEAPTYPE, so be careful about
reference counting. Only decref if the base type is not already a heap
allocated type. Otherwise, basedealloc should have decref'd it already */
if (type_needs_decref) {
Py_DECREF(type);
}
/* Done */
return;