[Python-Dev] Re: Evil Trashcan and GC interaction (original) (raw)

Guido van Rossum guido@python.org
Thu, 28 Mar 2002 13:57:46 -0500

_> #define SETLOCAL(i, value) do { PyObject *t = GETLOCAL(i); _ _> GETLOCAL(i) = value; _ > PyXDECREF(t); } while (0)

That's the same fix Andrew and I had in mind. My concern is that this is probably not the only bug of this type. The trashcan mechanism changes the ordering of object deallocation. What are the chances of other bugs like this lurking somewhere?

I've been aware of this issue for a long time (since Don Beaudry first pointed it out to me) and I've been pretty consistent in doing the right thing for globals and for other things that I knew would be accessible from outside. Too bad I missed this one, and you're right that there could be others, but I don't know how to find them systematically. Every DECREF call is suspect!

Fixing the GC to only run at specific times isn't enough -- as you showed, you can exploit this by referencing the frame directly.

The only safe solution is banning del, or moving the calls to del to specific safe times (e.g. at the top of the VM switch).

--Guido van Rossum (home page: http://www.python.org/~guido/)