<div dir="ltr">This code appears to have been added to fix <a href="https://bugs.python.org/issue3100">https://bugs.python.org/issue3100</a> - A crash involving a weakref subclass.<div><br></div><div>-gps</div></div><br><div class="gmail_quote"><div dir="ltr">On Tue, Sep 6, 2016 at 3:51 PM Larry Hastings <<a href="mailto:larry@hastings.org">larry@hastings.org</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div bgcolor="#FFFFFF" text="#000000" class="gmail_msg">
<br class="gmail_msg">
This is all about current (3.6) trunk.<br class="gmail_msg">
<br class="gmail_msg">
In Objects/weakrefobject.c, we have the function
PyObject_ClearWeakRefs(). This is called when a generic object that
supports weakrefs is destroyed; this is the code that calls the
callbacks. Here's a little paragraph of code from the center:<br class="gmail_msg">
<br class="gmail_msg">
<blockquote class="gmail_msg"><tt class="gmail_msg">for (i = 0; i < count; ++i) {<br class="gmail_msg">
PyWeakReference *next = current->wr_next;<br class="gmail_msg">
<br class="gmail_msg">
if (((PyObject *)current)->ob_refcnt > 0)<br class="gmail_msg">
{<br class="gmail_msg">
Py_INCREF(current);<br class="gmail_msg">
PyTuple_SET_ITEM(tuple, i * 2, (PyObject *) current);<br class="gmail_msg">
PyTuple_SET_ITEM(tuple, i * 2 + 1,
current->wr_callback);<br class="gmail_msg">
}<br class="gmail_msg">
else {<br class="gmail_msg">
Py_DECREF(current->wr_callback);<br class="gmail_msg">
}<br class="gmail_msg">
current->wr_callback = NULL;<br class="gmail_msg">
clear_weakref(current);<br class="gmail_msg">
current = next;<br class="gmail_msg">
}</tt><br class="gmail_msg">
</blockquote>
"current" is the doubly-linked list of PyWeakReference objects
stored inside the object that's getting destroyed.<br class="gmail_msg">
<br class="gmail_msg">
My question: under what circumstances would ob_refcnt ever be 0?
The tp_dealloc handler for PyWeakReference * objects removes it from
this list and frees the memory. How could the reference count reach
0 without tp_dealloc being called and it being removed from the
list?<br class="gmail_msg">
<br class="gmail_msg">
Scratching my head like crazy,<br class="gmail_msg">
<br class="gmail_msg">
<br class="gmail_msg">
<i class="gmail_msg">/arry</i><br class="gmail_msg">
<br class="gmail_msg">
p.s. If you're thinking "why does he care?", understanding this
would maybe help with the Gilectomy. So yes there's a point to this
question.<br class="gmail_msg">
</div>
_______________________________________________<br class="gmail_msg">
Python-Dev mailing list<br class="gmail_msg">
<a href="mailto:Python-Dev@python.org" class="gmail_msg" target="_blank">Python-Dev@python.org</a><br class="gmail_msg">
<a href="https://mail.python.org/mailman/listinfo/python-dev" rel="noreferrer" class="gmail_msg" target="_blank">https://mail.python.org/mailman/listinfo/python-dev</a><br class="gmail_msg">
Unsubscribe: <a href="https://mail.python.org/mailman/options/python-dev/greg%40krypto.org" rel="noreferrer" class="gmail_msg" target="_blank">https://mail.python.org/mailman/options/python-dev/greg%40krypto.org</a><br class="gmail_msg">
</blockquote></div>