[3.8] bpo-33930: Fix segfault with deep recursion when cleaning method objects (GH-27678) (GH-27721)

ambv · pablogsal · web-flow · commit 09d814b3833c · 2021-08-11T17:35:38.000+02:00
(cherry picked from commit bfc2d5a) Co-authored-by: Pablo Galindo Salgado <Pablogsal@gmail.com>
diff --git a/Lib/test/test_exceptions.py b/Lib/test/test_exceptions.py
@@ -982,6 +982,21 @@ def g():
         self.assertIsInstance(v, RecursionError, type(v))
         self.assertIn("maximum recursion depth exceeded", str(v))
 
+
+    @cpython_only
+    def test_crashcan_recursion(self):
+        # See bpo-33930
+
+        def foo():
+            o = object()
+            for x in range(1_000_000):
+                # Create a big chain of method objects that will trigger
+                # a deep chain of calls when they need to be destructed.
+                o = o.__dir__
+
+        foo()
+        support.gc_collect()
+
     @cpython_only
     def test_recursion_normalizing_exception(self):
         # Issue #22898.
diff --git a/Misc/NEWS.d/next/Core and Builtins/2021-08-09-14-29-52.bpo-33930.--5LQ-.rst b/Misc/NEWS.d/next/Core and Builtins/2021-08-09-14-29-52.bpo-33930.--5LQ-.rst
@@ -0,0 +1,2 @@
+Fix segmentation fault with deep recursion when cleaning method objects.
+Patch by Augusto Goulart and Pablo Galindo.
diff --git a/Objects/methodobject.c b/Objects/methodobject.c
@@ -125,7 +125,10 @@ PyCFunction_GetFlags(PyObject *op)
 static void
 meth_dealloc(PyCFunctionObject *m)
 {
-    _PyObject_GC_UNTRACK(m);
+    // The Py_TRASHCAN mechanism requires that we be able to
+    // call PyObject_GC_UnTrack twice on an object.
+    PyObject_GC_UnTrack(m);
+    Py_TRASHCAN_BEGIN(m, meth_dealloc);
     if (m->m_weakreflist != NULL) {
         PyObject_ClearWeakRefs((PyObject*) m);
     }
@@ -139,6 +142,7 @@ meth_dealloc(PyCFunctionObject *m)
     else {
         PyObject_GC_Del(m);
     }
+    Py_TRASHCAN_END;
 }
 
 static PyObject *

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,2 @@`
	`1`	`+Fix segmentation fault with deep recursion when cleaning method objects.`
	`2`	`+Patch by Augusto Goulart and Pablo Galindo.`
Original file line number	Diff line number	Diff line change
`@@ -125,7 +125,10 @@ PyCFunction_GetFlags(PyObject *op)`
`125`	`125`	`static void`
`126`	`126`	`meth_dealloc(PyCFunctionObject *m)`
`127`	`127`	`{`
`128`		`- _PyObject_GC_UNTRACK(m);`
	`128`	`+ // The Py_TRASHCAN mechanism requires that we be able to`
	`129`	`+ // call PyObject_GC_UnTrack twice on an object.`
	`130`	`+ PyObject_GC_UnTrack(m);`
	`131`	`+ Py_TRASHCAN_BEGIN(m, meth_dealloc);`
`129`	`132`	`if (m->m_weakreflist != NULL) {`
`130`	`133`	`PyObject_ClearWeakRefs((PyObject*) m);`
`131`	`134`	`}`
`@@ -139,6 +142,7 @@ meth_dealloc(PyCFunctionObject *m)`
`139`	`142`	`else {`
`140`	`143`	`PyObject_GC_Del(m);`
`141`	`144`	`}`
	`145`	`+ Py_TRASHCAN_END;`
`142`	`146`	`}`
`143`	`147`
`144`	`148`	`static PyObject *`