[issue32584] Uninitialized free_extra in code_dealloc

[Irit Katriel]

Irit Katriel  added the comment:

Is there anything left to do on this issue? It seems like a question more than 
a bug report.

--
nosy: +iritkatriel

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue32584] Uninitialized free_extra in code_dealloc

[Brett Cannon]

Brett Cannon  added the comment:

co_extra_freefuncs is an array of pointers, so there's no way for it to be 
uninitialized unless you didn't initialize the interpreter state 
(https://github.com/python/cpython/blob/b193fa996a746111252156f11fb14c12fd6267e6/Include/pystate.h#L155).
 And looking at your gdb session it shows the memory wipeout pattern which 
means you're accessing an interpreter state that has already been freed itself. 
IOW I don't think this is a PEP 523 issue specifically.

--

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue32584] Uninitialized free_extra in code_dealloc

[Brett Cannon]

Change by Brett Cannon :


--
nosy: +dino.viehland

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue32584] Uninitialized free_extra in code_dealloc

[Serhiy Storchaka]

Change by Serhiy Storchaka :


--
nosy: +brett.cannon
priority: normal -> high
versions: +Python 3.6, Python 3.8

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue32584] Uninitialized free_extra in code_dealloc

[Jeethu Rao]

New submission from Jeethu Rao :

In one of patches I'm building, (yet another attempt at caching 
LOAD_GLOBALS)[1], I'm using the private APIs from PEP 523 to store an array 
with every code object. I'm calling _PyEval_RequestCodeExtraIndex with 
PyMem_Free for the freefunc argument. While running  the cpython testsuite, I 
found that test_embed case crashes with a segfault. The gdb backtrace[2] seems 
to indicate that PyInterpreterState::co_extra_freefuncs is uninitialized, while 
it should be a pointer to the PyMem_Free function. 

One way to work around this is to set the array as a member on the PyCodeObject 
struct and use it directly. And I've verified that it works. Am I using the PEP 
523 private api correctly? Also, on Linux, this consistently crashes while on 
OSX, it occasionally doesn't crash which makes me wonder if it's some kind of a 
race condition involving Sub-interpreters. The attached gist[2] has steps for 
repro.

[1]: 
https://github.com/python/cpython/compare/master...jeethu:py3.7_load_global_cache
[2]: https://gist.github.com/jeethu/6d92185ca97dd692e7fadcd105e0ef70

--
components: Interpreter Core
messages: 310191
nosy: jeethu
priority: normal
severity: normal
status: open
title: Uninitialized free_extra in code_dealloc
type: crash
versions: Python 3.7

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com