[issue9751] _PyInstance_Lookup() defeats its purpose

[Serhiy Storchaka]

Serhiy Storchaka  added the comment:

Python 2.7 is no longer supported.

--
nosy: +serhiy.storchaka
resolution:  -> out of date
stage: needs patch -> resolved
status: open -> closed

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue9751] _PyInstance_Lookup() defeats its purpose

[Zackery Spytz]

Zackery Spytz  added the comment:

Python 2 is EOL.

--
nosy: +ZackerySpytz

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue9751] _PyInstance_Lookup() defeats its purpose

[Armin Rigo]

Armin Rigo  added the comment:

Unlike other crashers I'm a bit concerned about this one.  It can occur on any 
code that stores custom instances as keys in the __dict__ of an old-style 
instance.  Such code might be unusual-looking, but certainly not unheard-of.  
And the segfault that we get then is very rare and impossible to reproduce in 
practice because it depends on when exactly the GC is running and on the low 
bits of hashes colliding.

--

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
http://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue9751] _PyInstance_Lookup() defeats its purpose

[Antoine Pitrou]

Antoine Pitrou  added the comment:

Well, I don't think there's any point in trying to fixing this now.

--
nosy: +pitrou

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
http://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue9751] _PyInstance_Lookup() defeats its purpose

[Ezio Melotti]

Ezio Melotti  added the comment:

I tracked this down a bit and this is what I found:
has_finalizer in Modules/gcmodule.c calls
return _PyInstance_Lookup(op, delstr) != NULL;
_PyInstance_Lookup in Modules/classobject.c calls
v = class_lookup(inst->in_class, name, &klass);
where inst is (PyInstanceObject *)op;
class_lookup in Modules/classobject.c eventually calls
PyObject *value = PyDict_GetItem(cp->cl_dict, name);
where cp is (PyClassObject *)inst->in_class
and since cp is not a valid pointer, cp->cl_dict results in the segfault after 
a few recursive calls of class_lookup.

Confirmed that this only affects 2.7.

--
nosy: +ezio.melotti

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
http://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue9751] _PyInstance_Lookup() defeats its purpose

[Armin Rigo]

Armin Rigo  added the comment:

I propose that we first attempt to fix the crasher; depending on the solution 
we might then either fix the doc or the code for _PyInstance_Lookup().

If no-one is willing to fix this bug I am fine to let it go.  But somehow I am 
sure that there is code *somewhere* that sticks non-string keys in old-style 
classes or instances, and whose __eq__ has side-effects, like caching.  This 
would create hard-to-reproduce and hard-to-diagnose segfaults.  That's mainly 
the reason why I think that it should be fixed.

--

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
http://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue9751] _PyInstance_Lookup() defeats its purpose

[Éric Araujo]

Éric Araujo  added the comment:

It’s not clear whether you want a doc fix or a behavior change.

--
nosy: +eric.araujo

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
http://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue9751] _PyInstance_Lookup() defeats its purpose

[Georg Brandl]

Georg Brandl  added the comment:

I'm not sure anyone will be interested in this: it doesn't affect 3.x.

--
nosy: +georg.brandl

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
http://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue9751] _PyInstance_Lookup() defeats its purpose

[Armin Rigo]

New submission from Armin Rigo :

_PyInstance_Lookup() is documented as follows:

The point of this routine is that it never calls arbitrary Python
code, so is always "safe":  all it does is dict lookups.

But of course dict lookups can call arbitrary Python code.  This function has 
no purpose, because it's not possible to be "safe".  I checked in a crasher:

http://svn.python.org/projects/python/branches/release27-maint/Lib/test/crashers/gc_has_finalizer.py

--
components: Interpreter Core
messages: 115426
nosy: arigo
priority: low
severity: normal
stage: needs patch
status: open
title: _PyInstance_Lookup() defeats its purpose
type: crash
versions: Python 2.7

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
http://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com