[Python-Dev] tp_dealloc

[Amaury Forgeot d'Arc]

2010/6/1  <smarv at gmx.net>:
>> This said, there may be a bug somewhere, but what do you want us to look
>> at?
>> Do you have a case that we could reproduce and investigate?
>>
>> --
>> Amaury Forgeot d'Arc
>
> Thank you, I'm not a C-Developer,
> but still I have one more detail:
>
> I call py_decRef( pyObj) of dll (version 3.1.1),
> ( which calls tp_dealloc, which calls my freeMem() method))
> No problem is reported here.
> Now, the freed memory should not be accessed anymore by python31.dll.
> You may fill the freed pyObjectHead with invalid values,
> in my case it's:  ob_refcnt= 7851148, ob_type = $80808080
>
> But later, when I call Py_Finalize,
> there inside is some access to the same freed memory;
> this causes an AV, more precisely,
> when the value $80808080 is checked.
>
> My Delphi-Debugger shows the following byte-sequence inside python31.dll:
> 5EC3568B7424088B4604F74054004000007504
>
> 5E                  - pop esi
> C3                  - ret
> 56                  - push esi
> 8B742408            - mov esi, [esp+$08]
> 8B4604              - mov eax, [esi+$04]
>       // eax = $80808080 //
>
> F7405400400000      - test [eax+$54], $00004000
>       // AV exception by read of address $808080D4 //
>
> 7504                - jnz $1e03681b
>
>
> Maybe this can help someone, thank you!

I'm sorry but this kind of issue is difficult to investigate without
the source code.
Normally I would compile everything (python & your program) in debug mode,
and try to see why the object is used after tp_dealloc.

For example, it's possible that your code does not handle reference
counts correctly
A call to Py_INCREF() may be missing somewhere, for example. This is a
common error.
tp_dealloc() is called when the reference count falls to zero, but if
the object is still
referenced elsewhere, memory will be accessed again!

Without further information, I cannot consider this as a problem in Python.
I know other extension modules that manage memory in their own way, and work.
It's more probably an issue in the code of your type.

-- 
Amaury Forgeot d'Arc