Charles-Francois Natali <[email protected]> added the comment:
Didn't have much sleep last night, so please forgive me if I say something
stupid, but:
Python/pystate.c:
void
PyThreadState_DeleteCurrent()
{
PyThreadState *tstate = _PyThreadState_Current;
if (tstate == NULL)
Py_FatalError(
"PyThreadState_DeleteCurrent: no current tstate");
_PyThreadState_Current = NULL;
tstate_delete_common(tstate);
if (autoTLSkey && PyThread_get_key_value(autoTLSkey) == tstate)
PyThread_delete_key_value(autoTLSkey);
PyEval_ReleaseLock();
}
the current tstate is deleted and freed before releasing the GIL, so if another
thread calls take_gil after the current thread has called tstate_delete_common
but before it calls PyEval_ReleaseLock (which calls drop_gil and set gil_locked
to 0), then it will enter this section and dereference gil_last_holder.
I just checked with valgrind, and he also reports an illegal dereference at
this precise line.
----------
_______________________________________
Python tracker <[email protected]>
<http://bugs.python.org/issue7946>
_______________________________________
_______________________________________________
Python-bugs-list mailing list
Unsubscribe:
http://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
