-
-
Notifications
You must be signed in to change notification settings - Fork 29.2k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Crash due to borrowed references in _PyStack_UnpackDict() #81088
Comments
class IntWithDict:
def __init__(self, **kwargs):
self.kwargs = kwargs
def __index__(self):
self.kwargs.clear()
L = [2**i for i in range(10000)]
return 0
x = IntWithDict(dont_inherit=float())
compile("", "", "", x, **x.kwargs) The above crashes CPython due to the usage of borrowed references in _PyStack_UnpackDict(): the dict x.kwargs contains the only reference to the float() object stored in x.kwargs When parsing the arguments, x.__int__() is called, which clears the dict, removing the only reference to that float() |
Ideally, this would be fixed together with bpo-36904. |
The idea of bpo-36904 could be used here: define a special kind of tuple, which is like an ordinary tuple followed by a C array of PyObject* entries (all refcounted), terminated by a NULL to know where it ends. A special deallocation function would decref all entries. |
Jeroen, do you want to also do a backport for 3.7? |
Don't we have a bot for that? |
We do, but here the test will need to be changed: Python 3.7.3+ (heads/3.7:791e5fcbab, May 22 2019, 13:37:27)
[GCC 9.1.1 20190503 (Red Hat 9.1.1-1)] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> class IntWithDict:
... def __init__(self, **kwargs):
... self.kwargs = kwargs
... def __index__(self):
... self.kwargs.clear()
... return 0
...
>>> x = IntWithDict(dont_inherit=float())
>>> compile("", "", "", x, **x.kwargs)
Traceback (most recent call last):
File "<stdin>", line 1, in <module>
TypeError: an integer is required (got type IntWithDict) |
Using __int__ instead of __index__ works. PR coming right away. |
Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.
Show more details
GitHub fields:
bugs.python.org fields:
The text was updated successfully, but these errors were encountered: