gh-124470: Fix crash when reading from object instance dictionary while replacing it#122489
Merged
DinoV merged 4 commits intopython:mainfrom Nov 21, 2024
Merged
gh-124470: Fix crash when reading from object instance dictionary while replacing it#122489DinoV merged 4 commits intopython:mainfrom
DinoV merged 4 commits intopython:mainfrom
Conversation
c26d357 to
5a1b6fd
Compare
16ca39f to
0988d1a
Compare
0169a30 to
bd1c1a7
Compare
0146a13 to
2d05896
Compare
colesbury
reviewed
Sep 26, 2024
Contributor
colesbury
left a comment
There was a problem hiding this comment.
The overall approach makes sense to me. A few comments below.
Objects/dictobject.c
Outdated
| } | ||
|
|
||
| FT_ATOMIC_STORE_PTR(_PyObject_ManagedDictPointer(obj)->dict, | ||
| (PyDictObject *)Py_XNewRef(new_dict)); |
Contributor
There was a problem hiding this comment.
nit: align (PyDictObject *)Py_XNewRef(new_dict)
1a199bf to
dc3d5ae
Compare
colesbury
approved these changes
Sep 30, 2024
Contributor
colesbury
left a comment
There was a problem hiding this comment.
LGTM. A few minor comments below
Include/refcount.h
Outdated
| // zero. Otherwise, the thread gives up ownership and merges the reference | ||
| // count fields. | ||
| PyAPI_FUNC(void) _Py_MergeZeroLocalRefcount(PyObject *); | ||
|
|
| set_or_clear_managed_dict(PyObject *obj, PyObject *new_dict, bool clear) | ||
| { | ||
| assert(Py_TYPE(obj)->tp_flags & Py_TPFLAGS_MANAGED_DICT); | ||
| assert(_PyObject_InlineValuesConsistencyCheck(obj)); |
Contributor
There was a problem hiding this comment.
Do these consistency checks need to be within some sort of lock?
Contributor
Author
There was a problem hiding this comment.
The type flag one is fine, I'll add some ifdefs and lock for the inline check.
Objects/dictobject.c
Outdated
Comment on lines
7149
to
7113
| FT_ATOMIC_STORE_PTR(_PyObject_ManagedDictPointer(obj)->dict, | ||
| (PyDictObject *)Py_XNewRef(new_dict)); |
Contributor
There was a problem hiding this comment.
Maybe align the wrapped line
|
🤖 New build scheduled with the buildbot fleet by @colesbury for commit dc3d5ae 🤖 If you want to schedule another build, you need to add the 🔨 test-with-refleak-buildbots label again. |
117a19e to
367e1f4
Compare
367e1f4 to
c9aee55
Compare
ebonnal
pushed a commit
to ebonnal/cpython
that referenced
this pull request
Jan 12, 2025
…ry while replacing it (python#122489) Delay free a dictionary when replacing it
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Currently when we have one thread reading an attribute from an object and another thread replacing the dictionary we can crash. This is because the reader thread is actually using a borrowed reference to the object and the writer will decref the dictionary and de-allocate it when replacing the dictionary.
This fixes this by changing the decref of the previous dictionary to be delayed via QSBR. We get rid of the
GC_SET_SHARED_INLINEflag which is not being used anywhere and instead we simply queue the decref via_PyObject_XDecRefDelayed.When we process these objects during GC we need to be careful because we don't want to run object finalizers during the destruction of the objects. Instead we do the same thing we do w/ merged dec refs and queue the objects to be decref'd once the world has resumed.