Interesting bug. :-( It seems bugs.python.org is back up, so can you file it there too?
On Wed, Mar 28, 2012 at 3:45 AM, Victor Stinner <victor.stin...@gmail.com> wrote: > Hi, > > bugs.python.org is down so I'm reporting the bug here :-) > > We have a crash in our product when tracing is enabled by > sys.settrace() and threading.settrace(). If a Python generator is > created in a C thread, calling the generator later in another thread > may crash if Python tracing is enabled. > > - the C thread calls PyGILState_Ensure() which creates a temporary > Python thread state > - a generator is created, the generator has a reference to a Python > frame which keeps a reference to the temporary Python thread state > - the C thread calls PyGILState_Releases() which destroys the > temporary Python thread state > - when the generator is called later in another thread, call_trace() > reads the Python thread state from the generator frame, which is the > destroyed frame => it does crash on a pointer dereference if the > memory was reallocated (by malloc()) and the data were erased > > To reproduce the crash, unpack the attached > generator_frame_bug.tar.gz, compile the C module using "python > setup.py build" and then run "PYTHONPATH=$(ls -d build/lib*/) python > test.py" (or just "python test.py if you installed the _test module). > You may need to use Valgrind to see the error, or call memset(tstate, > 0xFF, sizeof(*tstate)) before free(tstate) in tstate_delete_common(). > > Calling the generator should update its reference to the Python state > thread in its frame. The generator may also clears frame->f_tstate (to > detect bugs earlier), as it does for frame->f_back (to avoid a > reference cycle). Attached patch implements this fix for Python 3.3. > > Victor > > _______________________________________________ > Python-Dev mailing list > Python-Dev@python.org > http://mail.python.org/mailman/listinfo/python-dev > Unsubscribe: > http://mail.python.org/mailman/options/python-dev/guido%40python.org > -- --Guido van Rossum (python.org/~guido) _______________________________________________ Python-Dev mailing list Python-Dev@python.org http://mail.python.org/mailman/listinfo/python-dev Unsubscribe: http://mail.python.org/mailman/options/python-dev/archive%40mail-archive.com
