Hello,
Neil Schemenauer wrote:
> Nick Coghlan <ncoghlan at gmail.com> wrote:
> > The problem is calls to Py_DECREF(self->attr) where some of the code
> > invoked by __del__ manages to find a way back around to reference
> > self->attr and gets access to a half-deleted object.
>
> Don't you mean "__del__ manages to find a way back around to self"?
> If so, how can that happen? If such a reference path exists, the
> reference count of self should not be zero. I don't understand why
> Py_CLEAR is necessary outside of tp_clear functions.
Of course we are speaking of different objects.
For example, in exception.c, BaseException_init() starts with the instruction:
Py_DECREF(self->args);
this may call __del__ on self->args, which can execute arbitrary
python code - including access to the now-invalid "args" member of the
exception.
class S:
def __del__(self):
print e.args
e = BaseException(1, S())
e.__init__("hello") # segfault
--
Amaury Forgeot d'Arc
RetroSearch is an open source project built by @garambo | Open a GitHub Issue
Search and Browse the WWW like it's 1997 | Search results from DuckDuckGo
HTML:
3.2
| Encoding:
UTF-8
| Version:
0.7.4