bpo-39877: Fix take_gil() for daemon threads (GH-19054)

vstinner · web-flow · commit 29356e03d4f8 · 2020-03-18T03:04:33.000+01:00
bpo-39877, bpo-39984: If the thread must exit, don't access tstate to prevent a potential crash: tstate memory has been freed.
diff --git a/Python/ceval_gil.h b/Python/ceval_gil.h
@@ -281,13 +281,17 @@ take_gil(PyThreadState *tstate)
     if (_Py_atomic_load_relaxed(&ceval->gil_drop_request)) {
         RESET_GIL_DROP_REQUEST(ceval);
     }
-    if (tstate->async_exc != NULL) {
+
+    int must_exit = tstate_must_exit(tstate);
+
+    /* Don't access tstate if the thread must exit */
+    if (!must_exit && tstate->async_exc != NULL) {
         _PyEval_SignalAsyncExc(ceval);
     }
 
     MUTEX_UNLOCK(gil->mutex);
 
-    if (tstate_must_exit(tstate)) {
+    if (must_exit) {
         /* bpo-36475: If Py_Finalize() has been called and tstate is not
            the thread which called Py_Finalize(), exit immediately the
            thread.
