Title: Keep a refence to mro in _PyType_Lookup() and super_getattro()
Type: crash Stage: resolved
Components: Interpreter Core Versions: Python 3.3
Status: closed Resolution: fixed
Dependencies: Superseder:
Assigned To: Nosy List: Mark.Shannon, python-dev, vstinner
Priority: normal Keywords: patch

Created on 2012-03-05 12:33 by vstinner, last changed 2012-03-08 23:39 by python-dev. This issue is now closed.

File name Uploaded Description Edit
type_lookup_mro.patch vstinner, 2012-03-05 12:33 review
Messages (3)
msg154943 - (view) Author: STINNER Victor (vstinner) * (Python committer) Date: 2012-03-05 12:33
Lib/test/crashers/ does crash Python: _PyType_Lookup() borrows a reference to the type MRO, but the type MRO is replaced during the lookup. Python crashs because it reads an item from a tuple that was destroyed (in the specific test, it reads an item from a newly created tuple which is not the type MRO).

Attached patch keeps a strong reference to the type MRO during the lookup to workaround this crasher. It fixes Lib/test/crashers/

If changing temporary has an impact on performances, a guard can be used to check that the type MRO has not been changed during the lookup.
msg154990 - (view) Author: Mark Shannon (Mark.Shannon) * (Python committer) Date: 2012-03-05 23:39
Looks good to me. 

The INCREF/DECREFs are outside of the loops so will have negligible performance impact.
msg155186 - (view) Author: Roundup Robot (python-dev) (Python triager) Date: 2012-03-08 23:39
New changeset 21e245ed3747 by Victor Stinner in branch 'default':
Close #14199: _PyType_Lookup() and super_getattro() keep a strong reference to
Date User Action Args
2012-03-08 23:39:09python-devsetstatus: open -> closed

nosy: + python-dev
messages: + msg155186

resolution: fixed
stage: resolved
2012-03-05 23:39:00Mark.Shannonsetnosy: + Mark.Shannon
messages: + msg154990
2012-03-05 12:33:27vstinnercreate