Nick Coghlan ncogh...@gmail.com added the comment:
It certainly looks like all direct calls to PyObject_DEL/PyObject_Del
from outside tp_dealloc implementations are going to be broken in
pydebug builds.
Replacing those calls with either Py_DECREF operations (as Victor's
patch does) or direct
Changes by Jeffrey C. Jacobs [EMAIL PROTECTED]:
--
versions: +Python 2.7 -Python 2.6
___
Python tracker [EMAIL PROTECTED]
http://bugs.python.org/issue3299
___
___
Changes by Jeffrey C. Jacobs [EMAIL PROTECTED]:
--
nosy: +timehorse
___
Python tracker [EMAIL PROTECTED]
http://bugs.python.org/issue3299
___
___
Python-bugs-list mailing
Changes by Jesús Cea Avión [EMAIL PROTECTED]:
--
nosy: +jcea
___
Python tracker [EMAIL PROTECTED]
http://bugs.python.org/issue3299
___
___
Python-bugs-list mailing list
Changes by Adam Olsen [EMAIL PROTECTED]:
--
nosy: +Rhamphoryncus
___
Python tracker [EMAIL PROTECTED]
http://bugs.python.org/issue3299
___
___
Python-bugs-list mailing
STINNER Victor [EMAIL PROTECTED] added the comment:
Valgrind output for Python trunk compiled with pydebug option:
==29848== Invalid read of size 4
==29848==at 0x809AF61: _Py_ForgetReference (object.c:2044)
==29848==by 0x809AFCF: _Py_Dealloc (object.c:2065)
==29848==by 0x80FE635:
STINNER Victor [EMAIL PROTECTED] added the comment:
F*ck, Firefox just crashed! I have to rewrite my long comment...
First, to explain why the problem only occurs in pydebug mode: a
PyObject has only _ob_next and _ob_prev attributes if Py_TRACE_REFS is
set (eg. by pydebug). PyObject_NEW() and
Changes by STINNER Victor [EMAIL PROTECTED]:
Removed file: http://bugs.python.org/file10828/re_finditer.patch
___
Python tracker [EMAIL PROTECTED]
http://bugs.python.org/issue3299
___
Changes by STINNER Victor [EMAIL PROTECTED]:
Added file: http://bugs.python.org/file10892/_curses_panel.patch
___
Python tracker [EMAIL PROTECTED]
http://bugs.python.org/issue3299
___
STINNER Victor [EMAIL PROTECTED] added the comment:
Other examples of invalid use of PyObject_Del().
Don't apply the patch, i didn't check it. Eg. element_dealloc() should
crash if self-tag is NULL... and at line 331, self-tag is NULL
whereas I called element_dealloc() using Py_DECREF()!
STINNER Victor [EMAIL PROTECTED] added the comment:
About _curses_panel.patch: same as pyobject_del.patch, i didn't tested
the code, and is looks like PyCursesPanel_Dealloc() expects that the
object is properly initialized.
It looks like this bug (invalid use of PyObject_Del/PyObject_DEL) is
New submission from STINNER Victor [EMAIL PROTECTED]:
import re: re.finditer(a, {}) crash on Python 2.x (tested with svn
trunk) because of an invalid use of PyObject_NEW/PyObject_DEL. The
error is in pattern_scanner(), in block if (!string) { ... }.
- scanner_dealloc() calls
Georg Brandl [EMAIL PROTECTED] added the comment:
This seems to be new in trunk; 2.5.2 raises a TypeError.
--
nosy: +georg.brandl
___
Python tracker [EMAIL PROTECTED]
http://bugs.python.org/issue3299
___
Changes by Georg Brandl [EMAIL PROTECTED]:
--
assignee: - effbot
nosy: +effbot
___
Python tracker [EMAIL PROTECTED]
http://bugs.python.org/issue3299
___
___
Changes by Georg Brandl [EMAIL PROTECTED]:
--
priority: - critical
___
Python tracker [EMAIL PROTECTED]
http://bugs.python.org/issue3299
___
___
Python-bugs-list mailing
STINNER Victor [EMAIL PROTECTED] added the comment:
@georg.brandl: The error is an Heisenbug. Yes, sometimes it doesn't
crash, but recheck in Valgrind ;-)
___
Python tracker [EMAIL PROTECTED]
http://bugs.python.org/issue3299
Fredrik Lundh [EMAIL PROTECTED] added the comment:
This report makes no sense to me; at least in Python 2.X, PyObject_Del
removes a chunk of memory from the object heap. It's designed to be
used from dealloc implementations, to release the actual memory (either
directly, or as the default
Georg Brandl [EMAIL PROTECTED] added the comment:
It can also be used in constructors, to destroy an object that was just
created if something goes wrong.
It appears that this is not true in debug builds: PyObject_NEW adds the
object to the global linked list of all objects, which
STINNER Victor [EMAIL PROTECTED] added the comment:
Hum, the bug is maybe specific to Python build with --with-pydebug. I
don't know exactly the behaviour changes of the PYDEBUG option.
@effbot: in my patch, I replaced PyObject_DEL (PyObject_FREE) and not
PyObject_Del (PyMem_Free).
19 matches
Mail list logo
