[issue21435] Segfault with cyclic reference and asyncio.Future

[Tim Peters]

Tim Peters added the comment:

Thought question:  suppose finalize_garbage() is called with a collectable list all of whose members are in fact going to be destroyed?

I don't see how the loop iteration logic could reliably work then.  For concreteness, suppose there's only object - A - in the list.  It's a circular list so gc starts as A.  A is finalized, we see it's refcount is 1, `gc = gc->gc.gc_prev` sets gc to A again, and A is destroyed by the Py_DECREF.  We go back to the top of the loop, and then `gc = gc->gc.gc_next` reads up trash (free'd) memory.

Or so it seems to me ;-)

----------

_______________________________________
Python tracker <report at bugs.python.org>
<http://bugs.python.org/issue21435>
_______________________________________