gh-111049: Fix crash during garbage collection of the BytesIO buffer object (GH-111221)

serhiy-storchaka · web-flow · commit bb36f72efcc6 · 2023-12-14T10:04:23.000Z
diff --git a/Lib/test/test_memoryio.py b/Lib/test/test_memoryio.py
@@ -6,10 +6,12 @@
 import unittest
 from test import support
 
+import gc
 import io
 import _pyio as pyio
 import pickle
 import sys
+import weakref
 
 class IntLike:
 def __init__(self, num):
@@ -477,6 +479,25 @@ def test_getbuffer_empty(self):
 buf2.release()
 memio.write(b'x')
 
+ def test_getbuffer_gc_collect(self):
+ memio = self.ioclass(b"1234567890")
+ buf = memio.getbuffer()
+ memiowr = weakref.ref(memio)
+ bufwr = weakref.ref(buf)
+ # Create a reference loop.
+ a = [buf]
+ a.append(a)
+ # The Python implementation emits an unraisable exception.
+ with support.catch_unraisable_exception():
+ del memio
+ del buf
+ del a
+ # The C implementation emits an unraisable exception.
+ with support.catch_unraisable_exception():
+ gc.collect()
+ self.assertIsNone(memiowr())
+ self.assertIsNone(bufwr())
+
 def test_read1(self):
 buf = self.buftype("1234567890")
 self.assertEqual(self.ioclass(buf).read1(), buf)
diff --git a/Misc/NEWS.d/next/Library/2023-10-23-18-42-26.gh-issue-111049.Ys7-o_.rst b/Misc/NEWS.d/next/Library/2023-10-23-18-42-26.gh-issue-111049.Ys7-o_.rst
@@ -0,0 +1,2 @@
+Fix crash during garbage collection of the :class:`io.BytesIO` buffer
+object.
diff --git a/Modules/_io/bytesio.c b/Modules/_io/bytesio.c
@@ -990,7 +990,9 @@ static int
 bytesio_clear(bytesio *self)
 {
 Py_CLEAR(self->dict);
- Py_CLEAR(self->buf);
+ if (self->exports == 0) {
+ Py_CLEAR(self->buf);
+ }
 return 0;
 }
 
@@ -1095,13 +1097,6 @@ bytesiobuf_releasebuffer(bytesiobuf *obj, Py_buffer *view)
 b->exports--;
 }
 
-static int
-bytesiobuf_clear(bytesiobuf *self)
-{
- Py_CLEAR(self->source);
- return 0;
-}
-
 static int
 bytesiobuf_traverse(bytesiobuf *self, visitproc visit, void *arg)
 {
@@ -1116,15 +1111,14 @@ bytesiobuf_dealloc(bytesiobuf *self)
 PyTypeObject *tp = Py_TYPE(self);
 /* bpo-31095: UnTrack is needed before calling any callbacks */
 PyObject_GC_UnTrack(self);
- (void)bytesiobuf_clear(self);
+ Py_CLEAR(self->source);
 tp->tp_free(self);
 Py_DECREF(tp);
 }
 
 static PyType_Slot bytesiobuf_slots[] = {
 {Py_tp_dealloc, bytesiobuf_dealloc},
 {Py_tp_traverse, bytesiobuf_traverse},
- {Py_tp_clear, bytesiobuf_clear},
 
 // Buffer protocol
 {Py_bf_getbuffer, bytesiobuf_getbuffer},

-Original file line number
+Diff line change
 importunittest
 fromtestimportsupport
 +importgc
 importio
 import_pyioaspyio
 importpickle
 importsys
 +importweakref
 classIntLike:
 def__init__(self, num):
 buf2.release()
 memio.write(b'x')
 +deftest_getbuffer_gc_collect(self):
 +memio=self.ioclass(b"1234567890")
 +buf=memio.getbuffer()
 +memiowr=weakref.ref(memio)
 +bufwr=weakref.ref(buf)
 +# Create a reference loop.
 +a= [buf]
 +a.append(a)
 +# The Python implementation emits an unraisable exception.
 +withsupport.catch_unraisable_exception():
 +delmemio
 +delbuf
 +dela
 +# The C implementation emits an unraisable exception.
 +withsupport.catch_unraisable_exception():
 +gc.collect()
 +self.assertIsNone(memiowr())
 +self.assertIsNone(bufwr())
++
 deftest_read1(self):
 buf=self.buftype("1234567890")
 self.assertEqual(self.ioclass(buf).read1(), buf)
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,2 @@`
	`1`	+Fix crash during garbage collection of the :class:`io.BytesIO` buffer
	`2`	`+object.`