classification
Title: subclass of multiprocessing Connection segfault upon attribute acces
Type: Stage: needs patch
Components: Versions: Python 2.7
process
Status: open Resolution:
Dependencies: Superseder:
Assigned To: Nosy List: Arfrever, davin, neologix, pitrou, superluser
Priority: normal Keywords:

Created on 2015-06-10 19:26 by neologix, last changed 2015-09-21 03:11 by davin.

Messages (2)
msg245140 - (view) Author: Charles-François Natali (neologix) * (Python committer) Date: 2015-06-10 19:26
The following segfaults in _PyObject_GenericGetAttrWithDict:

"""
from socket import socketpair
from _multiprocessing import Connection


class Crash(Connection):
    pass

_, w = socketpair()

Crash(w.fileno()).bar
"""

#0  _PyObject_GenericGetAttrWithDict (dict=0xa6b001c, name=0xb7281020, obj=0x8c12478) at Objects/object.c:1427
#1  PyObject_GenericGetAttr (obj=0x8c12478, name=0xb7281020) at Objects/object.c:1461

(gdb) p *(obj + obj->ob_type->tp_dictoffset)
$8 = {ob_refcnt = 0, ob_type = 0x0}

It's probably not specific to this example, but I'm not familiar enough with object construction/descriptors to know what's going on here.

Note that the following atch fixes the crash, but I don't know why:
"""
--- a/Modules/_multiprocessing/connection.h     Wed Apr 15 19:30:38 2015 +0100
+++ b/Modules/_multiprocessing/connection.h     Wed Jun 10 20:25:15 2015 +0100
@@ -58,7 +58,7 @@
         return NULL;
     }
 
-    self = PyObject_New(ConnectionObject, type);
+    self = type->tp_alloc(type, 0);
     if (self == NULL)
         return NULL;
 
@@ -86,7 +86,7 @@
         CLOSE(self->handle);
         Py_END_ALLOW_THREADS
     }
-    PyObject_Del(self);
+    Py_TYPE(self)->tp_free((PyObject*)self);
 }
 
 /*
"""
msg245356 - (view) Author: Rose Ames (superluser) * Date: 2015-06-15 00:32
Reproduced - the crash exists and the patch fixes it.
History
Date User Action Args
2015-09-21 03:11:26davinsetnosy: + davin
2015-06-15 06:17:57Arfreversetnosy: + Arfrever
2015-06-15 00:32:21superlusersetnosy: + superluser

messages: + msg245356
versions: + Python 2.7
2015-06-10 19:26:55neologixcreate