Skip to content

_Py_Dealloc is an escaping call #124483

Open
@brandtbucher

Description

@brandtbucher

Crash report

We like to pretend that _Py_Dealloc (and, by extension, Py_DECREF, Py_XDECREF, Py_CLEAR, PyStackRef_CLOSE, PyStackRef_CLEAR, etc...) isn't an escaping call in tier two. However, it's perfectly capable of invalidating the world. For example, the following code crashes when run under the JIT:

import sys

class Crashy:
    def __del__(self):
        ns = sys._getframe(1).f_locals
        if ns["i"] == 999:
            ns["i"] = None

def crashy():
    for i in range(1000):
        n = Crashy()
        i + i  # Remove guards for i.
        n = None  # Change i.
        i + i  # Crash!

crashy()

Longer term, we're hoping that removing refcounting operations in tier two will help us out here. Fortunately, the _SET_IP and _CHECK_VALIDITY instructions necessary to fix this issue aren't expensive enough to show up on benchmarks when added back (for now).

Linked PRs

Metadata

Metadata

Assignees

Labels

3.13bugs and security fixes3.14bugs and security fixesinterpreter-core(Objects, Python, Grammar, and Parser dirs)type-crashA hard crash of the interpreter, possibly with a core dump

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions