add refcnt check in FT_CLEAR_WEAKREFS

xuantengh · xuantengh · commit 3a912991d5e4 · 2025-06-28T10:33:44.000+08:00
diff --git a/Include/internal/pycore_weakref.h b/Include/internal/pycore_weakref.h
@@ -29,8 +29,11 @@ extern "C" {
     PyMutex_LockFlags(wr->weakrefs_lock, _Py_LOCK_DONT_DETACH)
 #define UNLOCK_WEAKREFS_FOR_WR(wr) PyMutex_Unlock(wr->weakrefs_lock)
 
-#define FT_CLEAR_WEAKREFS(obj, weakref_list) \
-    PyObject_ClearWeakRefs(obj)
+#define FT_CLEAR_WEAKREFS(obj, weakref_list)    \
+    do {                                        \
+        assert(Py_REFCNT(obj) == 0);            \
+        PyObject_ClearWeakRefs(obj);            \
+    } while (0)
 
 #else
 
diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2025-06-17-22-34-58.gh-issue-135607.ucsLVu.rst b/Misc/NEWS.d/next/Core_and_Builtins/2025-06-17-22-34-58.gh-issue-135607.ucsLVu.rst
@@ -1,2 +1,2 @@
-Fix potential :mod:`weakref` races on objects dealloc on the :term:`free threaded <free
+Fix potential :mod:`weakref` races in an object's destructor on the :term:`free threaded <free
 threading>` build.
diff --git a/Modules/_sre/sre.c b/Modules/_sre/sre.c
@@ -737,8 +737,7 @@ pattern_dealloc(PyObject *self)
 {
     PyTypeObject *tp = Py_TYPE(self);
     PyObject_GC_UnTrack(self);
-    PatternObject *obj = _PatternObject_CAST(self);
-    FT_CLEAR_WEAKREFS(self, obj->weakreflist);
+    FT_CLEAR_WEAKREFS(self, _PatternObject_CAST(self)->weakreflist);
     (void)pattern_clear(self);
     tp->tp_free(self);
     Py_DECREF(tp);
diff --git a/Modules/_threadmodule.c b/Modules/_threadmodule.c
@@ -1365,7 +1365,7 @@ static void
 localdummy_dealloc(PyObject *op)
 {
     localdummyobject *self = localdummyobject_CAST(op);
-    PyObject_ClearWeakRefs(op);
+    FT_CLEAR_WEAKREFS(op, self->weakreflist);
     PyTypeObject *tp = Py_TYPE(self);
     tp->tp_free(self);
     Py_DECREF(tp);

Original file line number	Diff line number	Diff line change
`@@ -1,2 +1,2 @@`
`1`		-Fix potential :mod:`weakref` races on objects dealloc on the :term:`free threaded <free
	`1`	+Fix potential :mod:`weakref` races in an object's destructor on the :term:`free threaded <free
`2`	`2`	threading>` build.
Original file line number	Diff line number	Diff line change
`@@ -1365,7 +1365,7 @@ static void`
`1365`	`1365`	`localdummy_dealloc(PyObject *op)`
`1366`	`1366`	`{`
`1367`	`1367`	`localdummyobject *self = localdummyobject_CAST(op);`
`1368`		`- PyObject_ClearWeakRefs(op);`
	`1368`	`+ FT_CLEAR_WEAKREFS(op, self->weakreflist);`
`1369`	`1369`	`PyTypeObject *tp = Py_TYPE(self);`
`1370`	`1370`	`tp->tp_free(self);`
`1371`	`1371`	`Py_DECREF(tp);`