Use Py_TryIncref when returning the ref

mpage · mpage · commit 6a50381d4be8 · 2024-03-24T15:15:30.000-07:00
The `is_dead` check from the default build is insufficient, since the
refcount may go to zero between when we check and when we incref. More
generally, `Py_NewRef` is unsafe to use if you have a borrowed refernce.
diff --git a/Include/internal/pycore_object.h b/Include/internal/pycore_object.h
@@ -87,7 +87,6 @@ PyAPI_FUNC(void) _Py_NO_RETURN _Py_FatalRefcountErrorFunc(
 PyAPI_DATA(Py_ssize_t) _Py_RefTotal;
 
 extern void _Py_AddRefTotal(PyInterpreterState *, Py_ssize_t);
-extern void _Py_IncRefTotal(PyInterpreterState *);
 extern void _Py_DecRefTotal(PyInterpreterState *);
 
 #  define _Py_DEC_REFTOTAL(interp) \
diff --git a/Include/internal/pycore_weakref.h b/Include/internal/pycore_weakref.h
@@ -58,13 +58,17 @@ static inline PyObject* _PyWeakref_GET_REF(PyObject *ref_obj)
         goto end;
     }
 
+#if !defined(Py_GIL_DISABLED)
     if (_is_dead(obj)) {
         goto end;
     }
-#if !defined(Py_GIL_DISABLED)
     assert(Py_REFCNT(obj) > 0);
-#endif
     ret = Py_NewRef(obj);
+#else
+    if (_Py_TryIncref(&obj, obj)) {
+        ret = obj;
+    }
+#endif
 end:
     Py_END_CRITICAL_SECTION();
     return ret;
diff --git a/Include/object.h b/Include/object.h
@@ -766,6 +766,7 @@ PyAPI_FUNC(void) _Py_NegativeRefcount(const char *filename, int lineno,
                                       PyObject *op);
 PyAPI_FUNC(void) _Py_INCREF_IncRefTotal(void);
 PyAPI_FUNC(void) _Py_DECREF_DecRefTotal(void);
+PyAPI_FUNC(void) _Py_IncRefTotal(PyInterpreterState *);
 #endif  // Py_REF_DEBUG && !Py_LIMITED_API
 
 PyAPI_FUNC(void) _Py_Dealloc(PyObject *);

Original file line number	Diff line number	Diff line change
`@@ -766,6 +766,7 @@ PyAPI_FUNC(void) _Py_NegativeRefcount(const char *filename, int lineno,`
`766`	`766`	`PyObject *op);`
`767`	`767`	`PyAPI_FUNC(void) _Py_INCREF_IncRefTotal(void);`
`768`	`768`	`PyAPI_FUNC(void) _Py_DECREF_DecRefTotal(void);`
	`769`	`+PyAPI_FUNC(void) _Py_IncRefTotal(PyInterpreterState *);`
`769`	`770`	`#endif // Py_REF_DEBUG && !Py_LIMITED_API`
`770`	`771`
`771`	`772`	`PyAPI_FUNC(void) _Py_Dealloc(PyObject *);`