classification
Title: Weakref proxy crashes on null tp_iternext slot.
Type: crash Stage: resolved
Components: Interpreter Core Versions: Python 3.11, Python 3.10, Python 3.9, Python 3.8, Python 3.7, Python 3.6
process
Status: closed Resolution: fixed
Dependencies: Superseder:
Assigned To: Nosy List: Dennis Sweeney, lukasz.langa, miss-islington, xxm
Priority: normal Keywords: patch

Created on 2021-07-23 05:05 by xxm, last changed 2021-07-24 09:46 by lukasz.langa. This issue is now closed.

Files
File name Uploaded Description Edit
test.py xxm, 2021-07-23 05:05
Pull Requests
URL Status Linked Edit
PR 27316 merged Dennis Sweeney, 2021-07-24 02:14
PR 27324 merged miss-islington, 2021-07-24 09:17
PR 27325 merged miss-islington, 2021-07-24 09:17
Messages (6)
msg398029 - (view) Author: Xinmeng Xia (xxm) Date: 2021-07-23 05:05
This piece of code is originally from https://github.com/python/cpython/tree/main/Lib/test/test_weakref.py. In function test_proxy_iter(), we change the original data dependency and then this generated test case (see the following "test.py") crashes Python. 

Crashing Python version: 3.6-master(3.11.0a0)

test.py
=========================
import weakref


def test_proxy_iter():
    obj = None

    class MyObj:

        def __iter__(a):
            nonlocal obj
            del obj
-           return NotImplemented
+           return p
    obj = MyObj()
-   p = weakref.proxy(obj)
+   p = weakref.proxy(TypeError)

-   'blech' in p
+   'blech' in obj

test_proxy_iter()
===========================


system: ubuntu 16.04
crash: segmentation fault
msg398114 - (view) Author: Dennis Sweeney (Dennis Sweeney) * (Python triager) Date: 2021-07-24 02:21
Here's a simpler reproducer:

        not_an_iterator = lambda: 0

        class A:
            def __iter__(self):
                return weakref.proxy(not_an_iterator)
        a = A()
        list(a)

I opened a PR.
msg398127 - (view) Author: Łukasz Langa (lukasz.langa) * (Python committer) Date: 2021-07-24 09:17
New changeset 5370f0a82aaa4ba617070d5c71d2b18236096ac0 by Dennis Sweeney in branch 'main':
bpo-44720: Don't crash when calling weakref.proxy(not_an_iterator).__next__ (GH-27316)
https://github.com/python/cpython/commit/5370f0a82aaa4ba617070d5c71d2b18236096ac0
msg398131 - (view) Author: Łukasz Langa (lukasz.langa) * (Python committer) Date: 2021-07-24 09:45
New changeset 659030c7d56a329c1aa559678f2df15e306215e4 by Miss Islington (bot) in branch '3.10':
bpo-44720: Don't crash when calling weakref.proxy(not_an_iterator).__next__ (GH-27316) (GH-27324)
https://github.com/python/cpython/commit/659030c7d56a329c1aa559678f2df15e306215e4
msg398132 - (view) Author: Łukasz Langa (lukasz.langa) * (Python committer) Date: 2021-07-24 09:45
New changeset 0a08f22184aef6e36bb8bb7ad84207e47594f46e by Miss Islington (bot) in branch '3.9':
bpo-44720: Don't crash when calling weakref.proxy(not_an_iterator).__next__ (GH-27316) (#27325)
https://github.com/python/cpython/commit/0a08f22184aef6e36bb8bb7ad84207e47594f46e
msg398133 - (view) Author: Łukasz Langa (lukasz.langa) * (Python committer) Date: 2021-07-24 09:46
Thanks for your quick pull request, Dennis! ✨ 🍰 ✨
History
Date User Action Args
2021-07-24 09:46:50lukasz.langasetstatus: open -> closed
resolution: fixed
messages: + msg398133

stage: patch review -> resolved
2021-07-24 09:45:43lukasz.langasetmessages: + msg398132
2021-07-24 09:45:17lukasz.langasetmessages: + msg398131
2021-07-24 09:17:33miss-islingtonsetpull_requests: + pull_request25869
2021-07-24 09:17:28miss-islingtonsetnosy: + miss-islington
pull_requests: + pull_request25868
2021-07-24 09:17:23lukasz.langasetnosy: + lukasz.langa
messages: + msg398127
2021-07-24 02:21:45Dennis Sweeneysetmessages: + msg398114
title: Finding string in iteratively deleted object cause segfault -> Weakref proxy crashes on null tp_iternext slot.
2021-07-24 02:14:24Dennis Sweeneysetkeywords: + patch
nosy: + Dennis Sweeney

pull_requests: + pull_request25862
stage: patch review
2021-07-23 05:05:41xxmcreate