gemini-code-assist[bot] commented on code in PR #308:
URL: https://github.com/apache/tvm-ffi/pull/308#discussion_r2585458544
##########
python/tvm_ffi/cython/function.pxi:
##########
@@ -674,6 +674,19 @@ cdef int TVMFFIPyArgSetterFloatProtocol_(
return 0
+cdef int TVMFFIPyArgSetterFFIValueProtocol_(
+ TVMFFIPyArgSetter* handle, TVMFFIPyCallContext* ctx,
+ PyObject* py_arg, TVMFFIAny* out
+) except -1:
+ """Setter for class with __tvm_ffi_value__() method"""
+ cdef object arg = <object>py_arg
+ cdef object value_py_obj = arg.__tvm_ffi_value__()
+ cdef PyObject* value_py_obj_ptr = <PyObject*>value_py_obj
+ return TVMFFIPySetArgumentGenericDispatcher(
+ TVMFFIPyArgSetterFactory_, ctx, value_py_obj_ptr, out
+ )
Review Comment:
The object returned by `arg.__tvm_ffi_value__()` could be a temporary
object. For example, it might be a `tvm_ffi.Tensor` with a reference count of
1. This object will be deallocated when `TVMFFIPyArgSetterFFIValueProtocol_`
returns, but the FFI call might still be using its handle, leading to a
use-after-free error.
To prevent this, you should ensure the object is kept alive for the duration
of the FFI call. This can be done by using `TVMFFIPyPushTempPyObject` to add
the object to the call context's temporary object list.
```
cdef object value_py_obj = arg.__tvm_ffi_value__()
cdef PyObject* value_py_obj_ptr = <PyObject*>value_py_obj
TVMFFIPyPushTempPyObject(ctx, value_py_obj_ptr)
return TVMFFIPySetArgumentGenericDispatcher(
TVMFFIPyArgSetterFactory_, ctx, value_py_obj_ptr, out
)
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
