gh-122527: Fix a crash on deallocation of PyStructSequence (GH-122577)

The `PyStructSequence` destructor would crash if it was deallocated after
its type's dictionary was cleared by the GC, because it couldn't compute
the "real size" of the instance. This could occur with relatively
straightforward code in the free-threaded build or with a reference
cycle involving the type in the default build, due to differing orders
in which `tp_clear()` was called.

Account for the non-sequence fields in `tp_basicsize` and use that,
along with `Py_SIZE()`, to compute the "real" size of a
`PyStructSequence` in the dealloc function. This avoids the accesses to
the type's dictionary during dealloc, which were unsafe.
This commit is contained in:
Sam Gross 2024-08-02 12:11:44 -04:00 committed by GitHub
parent 7aca84e557
commit 4b63cd170e
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
4 changed files with 41 additions and 7 deletions

View file

@ -1823,7 +1823,8 @@ class SizeofTest(unittest.TestCase):
# symtable entry
# XXX
# sys.flags
check(sys.flags, vsize('') + self.P * len(sys.flags))
# FIXME: The +1 will not be necessary once gh-122575 is fixed
check(sys.flags, vsize('') + self.P * (1 + len(sys.flags)))
def test_asyncgen_hooks(self):
old = sys.get_asyncgen_hooks()