[Python-checkins] bpo-46025: Fix a crash in the atexit module for auto-unregistering functions (GH-30002)

[pablogsal]

https://github.com/python/cpython/commit/f0d290d25cad66e615ada68ba190b8a23ac1deaa
commit: f0d290d25cad66e615ada68ba190b8a23ac1deaa
branch: main
author: Pablo Galindo Salgado <Pablogsal at gmail.com>
committer: pablogsal <Pablogsal at gmail.com>
date: 2021-12-09T13:53:44Z
summary:

bpo-46025: Fix a crash in the atexit module for auto-unregistering functions (GH-30002)

files:
A Misc/NEWS.d/next/Core and Builtins/2021-12-09-11-41-35.bpo-46025.pkEvW9.rst
M Lib/test/_test_atexit.py
M Modules/atexitmodule.c

diff --git a/Lib/test/_test_atexit.py b/Lib/test/_test_atexit.py
index a31658531113b..55d2808334917 100644
--- a/Lib/test/_test_atexit.py
+++ b/Lib/test/_test_atexit.py
@@ -116,6 +116,21 @@ def test_bound_methods(self):
         atexit._run_exitfuncs()
         self.assertEqual(l, [5])
 
+    def test_atexit_with_unregistered_function(self):
+        # See bpo-46025 for more info
+        def func():
+            atexit.unregister(func)
+            1/0
+        atexit.register(func)
+        try:
+            with support.catch_unraisable_exception() as cm:
+                atexit._run_exitfuncs()
+                self.assertEqual(cm.unraisable.object, func)
+                self.assertEqual(cm.unraisable.exc_type, ZeroDivisionError)
+                self.assertEqual(type(cm.unraisable.exc_value), ZeroDivisionError)
+        finally:
+            atexit.unregister(func)
+
 
 if __name__ == "__main__":
     unittest.main()
diff --git a/Misc/NEWS.d/next/Core and Builtins/2021-12-09-11-41-35.bpo-46025.pkEvW9.rst b/Misc/NEWS.d/next/Core and Builtins/2021-12-09-11-41-35.bpo-46025.pkEvW9.rst
new file mode 100644
index 0000000000000..dd2f1ff4731e7
--- /dev/null
+++ b/Misc/NEWS.d/next/Core and Builtins/2021-12-09-11-41-35.bpo-46025.pkEvW9.rst	
@@ -0,0 +1,2 @@
+Fix a crash in the :mod:`atexit` module involving functions that unregister
+themselves before raising exceptions. Patch by Pablo Galindo.
diff --git a/Modules/atexitmodule.c b/Modules/atexitmodule.c
index e536b4abe295f..95c653cf4782a 100644
--- a/Modules/atexitmodule.c
+++ b/Modules/atexitmodule.c
@@ -93,13 +93,16 @@ atexit_callfuncs(struct atexit_state *state)
             continue;
         }
 
+        // bpo-46025: Increment the refcount of cb->func as the call itself may unregister it
+        PyObject* the_func = Py_NewRef(cb->func);
         PyObject *res = PyObject_Call(cb->func, cb->args, cb->kwargs);
         if (res == NULL) {
-            _PyErr_WriteUnraisableMsg("in atexit callback", cb->func);
+            _PyErr_WriteUnraisableMsg("in atexit callback", the_func);
         }
         else {
             Py_DECREF(res);
         }
+        Py_DECREF(the_func);
     }
 
     atexit_cleanup(state);