gh-142883: avoid crash when __index__ changes array type during multiplication. #143776
Conversation
This comment was marked as resolved.
This comment was marked as resolved.
This comment was marked as resolved.
This comment was marked as resolved.
Co-authored-by: AN Long <aisk@users.noreply.github.com>
Co-authored-by: AN Long <aisk@users.noreply.github.com>
|
Thanks, fixed. |
| @@ -9716,13 +9714,19 @@ wrap_indexargfunc(PyObject *self, PyObject *args, void *wrapped) | |||
| ssizeargfunc func = (ssizeargfunc)wrapped; | |||
| PyObject* o; | |||
| Py_ssize_t i; | |||
| PyTypeObject *type_before = Py_TYPE(self); | |||
There was a problem hiding this comment.
I'm not very sure about this, but I'm wondering should we increase the refcount for type_before, because we will call user's code next, thus it may be GCed (like user delete the type in __index__)?
There was a problem hiding this comment.
Yes, that makes sense. Since we call user code next, the type could indeed be GCed if its last reference is dropped. I’ve updated the code to INCREF type_before before calling user code and DECREF it on all exit paths. I also ran the regression test locally and it passes.
picnixz
left a comment
picnixz
left a comment
There was a problem hiding this comment.
Why do we need to make those changes in typeobject? is it only relevant for objects implementing __mul__? or is it relevant only to array.__mul__?
| self.assertRaises(TypeError, op, v, z) | ||
|
|
||
|
|
||
| class IndexMutationDuringNumericOpTest(unittest.TestCase): |
There was a problem hiding this comment.
Why is it in the numeric tower??? it has nothing to do with numeric tower.
|
A Python core developer has requested some changes be made to your pull request before we can consider merging it. If you could please address their requests along with any other requests in other reviews from core developers that would be appreciated. Once you have made the requested changes, please leave a comment on this pull request containing the phrase |
3 participants
__index__can change the array’s class during multiplication. After that,the old function is still called, which can cause a crash. This adds a
check to avoid that and raises TypeError instead.
A regression test is also added.
array_repeatvia re-entrant__index__during array multiplication #142883