occasional null pointer dereference in slp_kill_tasks_with_stacks

[ghost]

Originally reported by: Johnny Healey (Bitbucket: johealey, GitHub: revnull)

---

I've been encountering segfaults while shutting down stackless. Debugging with gdb lead to a for loop that doesn't seem to be checking to see if the value it is iterating over is null.

I've attached a proposed patch.
null_ptr.patch.zip
test_issue105.py.zip

---

• Bitbucket: https://bitbucket.org/stackless-dev/stackless/issue/105

[ghost]

Original comment by Anselm Kruis (Bitbucket: akruis, GitHub: akruis):

---

Hi Johnny,

many thanks for the report. Do you have a python script, that reproduces the bug?

Kind regards
Anselm

[ghost]

Original comment by Anselm Kruis (Bitbucket: akruis, GitHub: akruis):

---

I was able to craft a test case, that triggers the bug reliable.
The for(cs = csfirst; !(in_loop && cs == csfirst); cs = cs->next) loop is broken. PyTasklet_Kill(t) decrefs t->tempval. This can run code. If this code releases the GIL, tasklet t might run and t->cstate might change and cs gets finalized.

[ghost]

Original comment by Anselm Kruis (Bitbucket: akruis, GitHub: akruis):

---

Fixed. The code now uses separate loops to first identify the tasklets to bee killed and to actually kill them.

Changesets:

• 2.7-slp: f7deec7
• 3.3-slp: f6d12b1
• 3.4-slp: ff54e14
• default-slp: 9cc4d47