Sorry, I sent the fixed version. These two incref's are missing!

On 10.12.19 14:16, Christian Tismer wrote:

Hi Łukasz,

tonite I found a critical bug that affects all heaptype extension classes with a custom (not PyType_Type) type.

the bug is in typeobject.c function type_mro_modified line 309:

if (custom) {
    _Py_IDENTIFIER(mro);
    mro_meth = lookup_maybe_method(
        (PyObject *)type, &PyId_mro, &unbound);
    if (mro_meth == NULL)
        goto clear;

This one

    Py_INCREF(mro_meth);
    type_mro_meth = lookup_maybe_method(
        (PyObject *)&PyType_Type, &PyId_mro, &unbound);
    if (type_mro_meth == NULL)
        goto clear;

And this one

    Py_INCREF(type_mro_meth);
    if (mro_meth != type_mro_meth)
        goto clear;
    Py_XDECREF(mro_meth);
    Py_XDECREF(type_mro_meth);
}

This block is wrong because it decrefs a value that comes from lookup_maybe_method which does not incref.

The code is easily fixed by two Py_INCREF s.

Please let me know how you want to proceed. This is a critical error, producing negative refcounts.

Cheers -- Chris

-- Christian Tismer :^) tismer@stackless.com Software Consulting : http://www.stackless.com/ Karl-Liebknecht-Str. 121 : https://github.com/PySide 14482 Potsdam : GPG key -> 0xFB7BEE0E phone +49 173 24 18 776 fax +49 (30) 700143-0023

On 10.12.19 14:28, Łukasz Langa wrote:

...

On 10 Dec 2019, at 14:16, Christian Tismer <tismer@stackless.com <mailto:tismer@stackless.com>> wrote:

Please let me know how you want to proceed. This is a critical error, producing negative refcounts.

Is there a BPO issue for this? If not, there should be, let's discuss there. Is this a 3.8 regression?

3.8.1 proper is next Monday, if this fix is handled quickly it will land in 3.8.1.

Yes, this problem exists since the first 3.8.0 version. I did not create a PR, yet because it took me so long to understand that this time it was really not a PySide problem ;-)

I will try to produce one ASAP.

-- Christian Tismer :^) tismer@stackless.com Software Consulting : http://www.stackless.com/ Karl-Liebknecht-Str. 121 : https://github.com/PySide 14482 Potsdam : GPG key -> 0xFB7BEE0E phone +49 173 24 18 776 fax +49 (30) 700143-0023

Howdy,

I have produced this: https://bugs.python.org/issue39016

No idea if it's correct, doing that too rarely.

Cheers -- Chris

On 10.12.19 14:34, Victor Stinner wrote:

Can you please open an issue at https://bugs.python.org/ and then post the link in this thread?

Thanks in advance, Victor

Le mar. 10 déc. 2019 à 14:18, Christian Tismer <tismer@stackless.com> a écrit :

...

Hi Łukasz,

tonite I found a critical bug that affects all heaptype extension classes with a custom (not PyType_Type) type.

the bug is in typeobject.c function type_mro_modified line 309:

if (custom) {
    _Py_IDENTIFIER(mro);
    mro_meth = lookup_maybe_method(
        (PyObject *)type, &PyId_mro, &unbound);
    if (mro_meth == NULL)
        goto clear;
    Py_INCREF(mro_meth);
    type_mro_meth = lookup_maybe_method(
        (PyObject *)&PyType_Type, &PyId_mro, &unbound);
    if (type_mro_meth == NULL)
        goto clear;
    Py_INCREF(type_mro_meth);
    if (mro_meth != type_mro_meth)
        goto clear;
    Py_XDECREF(mro_meth);
    Py_XDECREF(type_mro_meth);
}

This block is wrong because it decrefs a value that comes from lookup_maybe_method which does not incref.

The code is easily fixed by two Py_INCREF s.

Please let me know how you want to proceed. This is a critical error, producing negative refcounts.

Cheers -- Chris

On 10.12.19 10:22, Łukasz Langa wrote:

...

Python 3.8.1rc1 is the release candidate of the first maintenance release of Python 3.8.

The Python 3.8 series is the newest feature release of the Python language, and it contains many new features and optimizations. You can find Python 3.8.1rc1 here:

https://www.python.org/downloads/release/python-381rc1/

Assuming no critical problems are found prior to *2019-12-16*, the scheduled release date for *3.8.1* as well as *Ned Deily's birthday*, no code changes are planned between this release candidate and the final release.

That being said, please keep in mind that this is a pre-release of 3.8.1 and as such its main purpose is testing.

See the “What’s New in Python 3.8 <https://docs.python.org/3.8/whatsnew/3.8.html>” document for more information about features included in the 3.8 series. Detailed information about all changes made in 3.8.0 can be found in its change log.

Maintenance releases for the 3.8 series will continue at regular bi-monthly intervals, with *3.8.2* planned for February 2020.

  We hope you enjoy Python 3.8!

Thanks to all of the many volunteers who help make Python Development and these releases possible! Please consider supporting our efforts by volunteering yourself or through organization contributions to the Python Software Foundation.

https://www.python.org/psf/

---

Python-Dev mailing list -- python-dev@python.org To unsubscribe send an email to python-dev-leave@python.org https://mail.python.org/mailman3/lists/python-dev.python.org/ Message archived at https://mail.python.org/archives/list/python-dev@python.org/message/IGJ6ZOAO... Code of Conduct: http://python.org/psf/codeofconduct/

-- Christian Tismer :^) tismer@stackless.com Software Consulting : http://www.stackless.com/ Karl-Liebknecht-Str. 121 : https://github.com/PySide 14482 Potsdam : GPG key -> 0xFB7BEE0E phone +49 173 24 18 776 fax +49 (30) 700143-0023

---

python-committers mailing list -- python-committers@python.org To unsubscribe send an email to python-committers-leave@python.org https://mail.python.org/mailman3/lists/python-committers.python.org/ Message archived at https://mail.python.org/archives/list/python-committers@python.org/message/6... Code of Conduct: https://www.python.org/psf/codeofconduct/

-- Christian Tismer :^) tismer@stackless.com Software Consulting : http://www.stackless.com/ Karl-Liebknecht-Str. 121 : https://github.com/PySide 14482 Potsdam : GPG key -> 0xFB7BEE0E phone +49 173 24 18 776 fax +49 (30) 700143-0023