PyFrameObject.f_gen can be left pointing to a dangling generator

[arigo]

BPO	27812
Nosy	@arigo
Files	patch2.diff

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = None
closed_at = <Date 2016-09-05.17:41:15.539>
created_at = <Date 2016-08-20.09:42:54.106>
labels = ['interpreter-core']
title = 'PyFrameObject.f_gen can be left pointing to a dangling generator'
updated_at = <Date 2016-09-05.17:41:15.537>
user = 'https://github.com/arigo'

bugs.python.org fields:

activity = <Date 2016-09-05.17:41:15.537>
actor = 'python-dev'
assignee = 'none'
closed = True
closed_date = <Date 2016-09-05.17:41:15.539>
closer = 'python-dev'
components = ['Interpreter Core']
creation = <Date 2016-08-20.09:42:54.106>
creator = 'arigo'
dependencies = []
files = ['44166']
hgrepos = []
issue_num = 27812
keywords = ['patch', 'needs review']
message_count = 2.0
messages = ['273200', '274410']
nosy_count = 2.0
nosy_names = ['arigo', 'python-dev']
pr_nums = []
priority = 'normal'
resolution = 'fixed'
stage = 'resolved'
status = 'closed'
superseder = None
type = None
url = 'https://bugs.python.org/issue27812'
versions = ['Python 3.6']

[arigo]

PyFrameObject.f_gen is a pointer (not a reference) to a generator/coroutine object. But the latter doesn't always correctly clean it up when it dies. This pointer is used by frame.clear().

Here is an example I made, which ends in a segfault. This example assumes we apply the patch of bpo-27811 first, otherwise it just crashes earlier in the same way as bpo-27811.

    # execute this with "python -Werror"
    import gc
    async def f():
        pass
    cr = f()
    frame = cr.cr_frame
    del cr
    gc.collect()
    # create some randomness to reuse the memory just freed by 'cr'
    import asyncio
    print("ping")
    frame.clear()

Patch attached. No test, but you can copy the above example.

[python-dev]

New changeset 3e4452424f9b by Benjamin Peterson in branch '3.5':
clear out f_gen during generator finalization (closes bpo-27812)
https://hg.python.org/cpython/rev/3e4452424f9b

New changeset 1d7a938b1e47 by Benjamin Peterson in branch 'default':
merge 3.5 (bpo-27812)
https://hg.python.org/cpython/rev/1d7a938b1e47