Skip to content

Some GC types can crash during destruction if a GC runs executes #95324

Closed
@pablogsal

Description

@pablogsal

We have been bitten a couple of times already if C extension types that implement the GC interface don't call PyObject_GC_UnTrack in their tp_dealloc slot. The last issue was #95045

Although this is technically not always an error (the tp_free slot untracks the object from the GC), if the GC executes during the deallocator is possible that it will see an object with 0 reference count.

To avoid this in the future, we should add a warning if this happens so we can fix it within CPython

Metadata

Metadata

Assignees

No one assigned

    Labels

    3.11only security fixestype-bugAn unexpected behavior, bug, or error

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions