// This implements the reference cycle garbage collector.

// The Python module interface to the collector is in gcmodule.c.

// See https://devguide.python.org/internals/garbage-collector/

#include "Python.h"

#include "pycore_ceval.h" // _Py_set_eval_breaker_bit()

#include "pycore_context.h"

#include "pycore_dict.h" // _PyInlineValuesSize()

#include "pycore_initconfig.h"

#include "pycore_interp.h" // PyInterpreterState.gc

#include "pycore_object.h"

#include "pycore_object_alloc.h" // _PyObject_MallocWithType()

#include "pycore_pyerrors.h"

#include "pycore_pystate.h" // _PyThreadState_GET()

#include "pycore_weakref.h" // _PyWeakref_ClearRef()

#include "pydtrace.h"

#ifndef Py_GIL_DISABLED

typedef struct _gc_runtime_state GCState;

#ifdef Py_DEBUG

# define GC_DEBUG

#endif

// Define this when debugging the GC

// #define GC_EXTRA_DEBUG

#define GC_NEXT _PyGCHead_NEXT

#define GC_PREV _PyGCHead_PREV

// update_refs() set this bit for all objects in current generation.

// subtract_refs() and move_unreachable() uses this to distinguish

// visited object is in GCing or not.

//

// move_unreachable() removes this flag from reachable objects.

// Only unreachable objects have this flag.

//

// No objects in interpreter have this flag after GC ends.

#define PREV_MASK_COLLECTING _PyGC_PREV_MASK_COLLECTING

// Lowest bit of _gc_next is used for UNREACHABLE flag.

//

// This flag represents the object is in unreachable list in move_unreachable()

//

// Although this flag is used only in move_unreachable(), move_unreachable()

// doesn't clear this flag to skip unnecessary iteration.

// move_legacy_finalizers() removes this flag instead.

// Between them, unreachable list is not normal list and we can not use

// most gc_list_* functions for it.

#define NEXT_MASK_UNREACHABLE 2

#define AS_GC(op) _Py_AS_GC(op)

#define FROM_GC(gc) _Py_FROM_GC(gc)

// Automatically choose the generation that needs collecting.

#define GENERATION_AUTO (-1)

static inline int

gc_is_collecting(PyGC_Head *g)

{

return (g->_gc_prev & PREV_MASK_COLLECTING) != 0;

}

static inline void

gc_clear_collecting(PyGC_Head *g)

{

g->_gc_prev &= ~PREV_MASK_COLLECTING;

}

static inline Py_ssize_t

gc_get_refs(PyGC_Head *g)

{

return (Py_ssize_t)(g->_gc_prev >> _PyGC_PREV_SHIFT);

}

static inline void

gc_set_refs(PyGC_Head *g, Py_ssize_t refs)

{

g->_gc_prev = (g->_gc_prev & ~_PyGC_PREV_MASK)

| ((uintptr_t)(refs) << _PyGC_PREV_SHIFT);

}

static inline void

gc_reset_refs(PyGC_Head *g, Py_ssize_t refs)

{

g->_gc_prev = (g->_gc_prev & _PyGC_PREV_MASK_FINALIZED)

| PREV_MASK_COLLECTING

| ((uintptr_t)(refs) << _PyGC_PREV_SHIFT);

}

static inline void

gc_decref(PyGC_Head *g)

{

_PyObject_ASSERT_WITH_MSG(FROM_GC(g),

gc_get_refs(g) > 0,

"refcount is too small");

g->_gc_prev -= 1 << _PyGC_PREV_SHIFT;

}

static inline int

gc_old_space(PyGC_Head *g)

{

return g->_gc_next & _PyGC_NEXT_MASK_OLD_SPACE_1;

}

static inline int

flip_old_space(int space)

{

assert(space == 0 || space == 1);

return space ^ _PyGC_NEXT_MASK_OLD_SPACE_1;

}

static inline void

gc_flip_old_space(PyGC_Head *g)

{

g->_gc_next ^= _PyGC_NEXT_MASK_OLD_SPACE_1;

}

static inline void

gc_set_old_space(PyGC_Head *g, int space)

{

assert(space == 0 || space == _PyGC_NEXT_MASK_OLD_SPACE_1);

g->_gc_next &= ~_PyGC_NEXT_MASK_OLD_SPACE_1;

g->_gc_next |= space;

}

static PyGC_Head *

GEN_HEAD(GCState *gcstate, int n)

{

assert((gcstate->visited_space & (~1)) == 0);

switch(n) {

case 0:

return &gcstate->young.head;

case 1:

return &gcstate->old[gcstate->visited_space].head;

case 2:

return &gcstate->old[gcstate->visited_space^1].head;

default:

Py_UNREACHABLE();

}

}

static GCState *

get_gc_state(void)

{

PyInterpreterState *interp = _PyInterpreterState_GET();

return &interp->gc;

}

void

_PyGC_InitState(GCState *gcstate)

{

#define INIT_HEAD(GEN) \

do { \

GEN.head._gc_next = (uintptr_t)&GEN.head; \

GEN.head._gc_prev = (uintptr_t)&GEN.head; \

} while (0)

assert(gcstate->young.count == 0);

assert(gcstate->old[0].count == 0);

assert(gcstate->old[1].count == 0);

INIT_HEAD(gcstate->young);

INIT_HEAD(gcstate->old[0]);

INIT_HEAD(gcstate->old[1]);

INIT_HEAD(gcstate->permanent_generation);

#undef INIT_HEAD

}

PyStatus

_PyGC_Init(PyInterpreterState *interp)

{

GCState *gcstate = &interp->gc;

gcstate->garbage = PyList_New(0);

if (gcstate->garbage == NULL) {

return _PyStatus_NO_MEMORY();

}

gcstate->callbacks = PyList_New(0);

if (gcstate->callbacks == NULL) {

return _PyStatus_NO_MEMORY();

}

gcstate->heap_size = 0;

return _PyStatus_OK();

}

/*

_gc_prev values

---------------

Between collections, _gc_prev is used for doubly linked list.

Lowest two bits of _gc_prev are used for flags.

PREV_MASK_COLLECTING is used only while collecting and cleared before GC ends

or _PyObject_GC_UNTRACK() is called.

During a collection, _gc_prev is temporary used for gc_refs, and the gc list

is singly linked until _gc_prev is restored.

gc_refs

At the start of a collection, update_refs() copies the true refcount

to gc_refs, for each object in the generation being collected.

subtract_refs() then adjusts gc_refs so that it equals the number of

times an object is referenced directly from outside the generation

being collected.

PREV_MASK_COLLECTING

Objects in generation being collected are marked PREV_MASK_COLLECTING in

update_refs().

_gc_next values

---------------

_gc_next takes these values:

0

The object is not tracked

!= 0

Pointer to the next object in the GC list.

Additionally, lowest bit is used temporary for

NEXT_MASK_UNREACHABLE flag described below.

NEXT_MASK_UNREACHABLE

move_unreachable() then moves objects not reachable (whether directly or

indirectly) from outside the generation into an "unreachable" set and

set this flag.

Objects that are found to be reachable have gc_refs set to 1.

When this flag is set for the reachable object, the object must be in

"unreachable" set.

The flag is unset and the object is moved back to "reachable" set.

move_legacy_finalizers() will remove this flag from "unreachable" set.

*/

/*** list functions ***/

static inline void

gc_list_init(PyGC_Head *list)

{

// List header must not have flags.

// We can assign pointer by simple cast.

list->_gc_prev = (uintptr_t)list;

list->_gc_next = (uintptr_t)list;

}

static inline int

gc_list_is_empty(PyGC_Head *list)

{

return (list->_gc_next == (uintptr_t)list);

}

/* Append `node` to `list`. */

static inline void

gc_list_append(PyGC_Head *node, PyGC_Head *list)

{

assert((list->_gc_prev & ~_PyGC_PREV_MASK) == 0);

PyGC_Head *last = (PyGC_Head *)list->_gc_prev;

// last <-> node

_PyGCHead_SET_PREV(node, last);

_PyGCHead_SET_NEXT(last, node);

// node <-> list

_PyGCHead_SET_NEXT(node, list);

list->_gc_prev = (uintptr_t)node;

}

/* Remove `node` from the gc list it's currently in. */

static inline void

gc_list_remove(PyGC_Head *node)

{

PyGC_Head *prev = GC_PREV(node);

PyGC_Head *next = GC_NEXT(node);

_PyGCHead_SET_NEXT(prev, next);

_PyGCHead_SET_PREV(next, prev);

node->_gc_next = 0; /* object is not currently tracked */

}

/* Move `node` from the gc list it's currently in (which is not explicitly

* named here) to the end of `list`. This is semantically the same as

* gc_list_remove(node) followed by gc_list_append(node, list).

*/

static void

gc_list_move(PyGC_Head *node, PyGC_Head *list)

{

/* Unlink from current list. */

PyGC_Head *from_prev = GC_PREV(node);

PyGC_Head *from_next = GC_NEXT(node);

_PyGCHead_SET_NEXT(from_prev, from_next);

_PyGCHead_SET_PREV(from_next, from_prev);

/* Relink at end of new list. */

// list must not have flags. So we can skip macros.

PyGC_Head *to_prev = (PyGC_Head*)list->_gc_prev;

_PyGCHead_SET_PREV(node, to_prev);

_PyGCHead_SET_NEXT(to_prev, node);

list->_gc_prev = (uintptr_t)node;

_PyGCHead_SET_NEXT(node, list);

}

/* append list `from` onto list `to`; `from` becomes an empty list */

static void

gc_list_merge(PyGC_Head *from, PyGC_Head *to)

{

assert(from != to);

if (!gc_list_is_empty(from)) {

PyGC_Head *to_tail = GC_PREV(to);

PyGC_Head *from_head = GC_NEXT(from);

PyGC_Head *from_tail = GC_PREV(from);

assert(from_head != from);

assert(from_tail != from);

assert(gc_list_is_empty(to) ||

gc_old_space(to_tail) == gc_old_space(from_tail));

_PyGCHead_SET_NEXT(to_tail, from_head);

_PyGCHead_SET_PREV(from_head, to_tail);

_PyGCHead_SET_NEXT(from_tail, to);

_PyGCHead_SET_PREV(to, from_tail);

}

gc_list_init(from);

}

static Py_ssize_t

gc_list_size(PyGC_Head *list)

{

PyGC_Head *gc;

Py_ssize_t n = 0;

for (gc = GC_NEXT(list); gc != list; gc = GC_NEXT(gc)) {

n++;

}

return n;

}

/* Walk the list and mark all objects as non-collecting */

static inline void

gc_list_clear_collecting(PyGC_Head *collectable)

{

PyGC_Head *gc;

for (gc = GC_NEXT(collectable); gc != collectable; gc = GC_NEXT(gc)) {

gc_clear_collecting(gc);

}

}

/* Append objects in a GC list to a Python list.

* Return 0 if all OK, < 0 if error (out of memory for list)

*/

static int

append_objects(PyObject *py_list, PyGC_Head *gc_list)

{

PyGC_Head *gc;

for (gc = GC_NEXT(gc_list); gc != gc_list; gc = GC_NEXT(gc)) {

PyObject *op = FROM_GC(gc);

if (op != py_list) {

if (PyList_Append(py_list, op)) {

return -1; /* exception */

}

}

}

return 0;

}

// Constants for validate_list's flags argument.

enum flagstates {collecting_clear_unreachable_clear,

collecting_clear_unreachable_set,

collecting_set_unreachable_clear,

collecting_set_unreachable_set};

#ifdef GC_DEBUG

// validate_list checks list consistency. And it works as document

// describing when flags are expected to be set / unset.

// `head` must be a doubly-linked gc list, although it's fine (expected!) if

// the prev and next pointers are "polluted" with flags.

// What's checked:

// - The `head` pointers are not polluted.

// - The objects' PREV_MASK_COLLECTING and NEXT_MASK_UNREACHABLE flags are all

// `set or clear, as specified by the 'flags' argument.

// - The prev and next pointers are mutually consistent.

static void

validate_list(PyGC_Head *head, enum flagstates flags)

{

assert((head->_gc_prev & ~_PyGC_PREV_MASK) == 0);

assert((head->_gc_next & ~_PyGC_PREV_MASK) == 0);

uintptr_t prev_value = 0, next_value = 0;

switch (flags) {

case collecting_clear_unreachable_clear:

break;

case collecting_set_unreachable_clear:

prev_value = PREV_MASK_COLLECTING;

break;

case collecting_clear_unreachable_set:

next_value = NEXT_MASK_UNREACHABLE;

break;

case collecting_set_unreachable_set:

prev_value = PREV_MASK_COLLECTING;

next_value = NEXT_MASK_UNREACHABLE;

break;

default:

assert(! "bad internal flags argument");

}

PyGC_Head *prev = head;

PyGC_Head *gc = GC_NEXT(head);

while (gc != head) {

PyGC_Head *trueprev = GC_PREV(gc);

PyGC_Head *truenext = GC_NEXT(gc);

assert(truenext != NULL);

assert(trueprev == prev);

assert((gc->_gc_prev & PREV_MASK_COLLECTING) == prev_value);

assert((gc->_gc_next & NEXT_MASK_UNREACHABLE) == next_value);

prev = gc;

gc = truenext;

}

assert(prev == GC_PREV(head));

}

#else

#define validate_list(x, y) do{}while(0)

#endif

#ifdef GC_EXTRA_DEBUG

static void

validate_old(GCState *gcstate)

{

for (int space = 0; space < 2; space++) {

PyGC_Head *head = &gcstate->old[space].head;

PyGC_Head *gc = GC_NEXT(head);

while (gc != head) {

PyGC_Head *next = GC_NEXT(gc);

assert(gc_old_space(gc) == space);

gc = next;

}

}

}

static void

validate_consistent_old_space(PyGC_Head *head)

{

PyGC_Head *prev = head;

PyGC_Head *gc = GC_NEXT(head);

if (gc == head) {

return;

}

int old_space = gc_old_space(gc);

while (gc != head) {

PyGC_Head *truenext = GC_NEXT(gc);

assert(truenext != NULL);

assert(gc_old_space(gc) == old_space);

prev = gc;

gc = truenext;

}

assert(prev == GC_PREV(head));

}

static void

gc_list_validate_space(PyGC_Head *head, int space) {

PyGC_Head *gc = GC_NEXT(head);

while (gc != head) {

assert(gc_old_space(gc) == space);

gc = GC_NEXT(gc);

}

}

#else

#define validate_old(g) do{}while(0)

#define validate_consistent_old_space(l) do{}while(0)

#define gc_list_validate_space(l, s) do{}while(0)

#endif

/*** end of list stuff ***/

/* Set all gc_refs = ob_refcnt. After this, gc_refs is > 0 and

* PREV_MASK_COLLECTING bit is set for all objects in containers.

*/

static void

update_refs(PyGC_Head *containers)

{

PyGC_Head *next;

PyGC_Head *gc = GC_NEXT(containers);

while (gc != containers) {

next = GC_NEXT(gc);

PyObject *op = FROM_GC(gc);

if (_Py_IsImmortal(op)) {

gc_list_move(gc, &get_gc_state()->permanent_generation.head);

gc = next;

continue;

}

gc_reset_refs(gc, Py_REFCNT(op));

/* Python's cyclic gc should never see an incoming refcount

* of 0: if something decref'ed to 0, it should have been

* deallocated immediately at that time.

* Possible cause (if the assert triggers): a tp_dealloc

* routine left a gc-aware object tracked during its teardown

* phase, and did something-- or allowed something to happen --

* that called back into Python. gc can trigger then, and may

* see the still-tracked dying object. Before this assert

* was added, such mistakes went on to allow gc to try to

* delete the object again. In a debug build, that caused

* a mysterious segfault, when _Py_ForgetReference tried

* to remove the object from the doubly-linked list of all

* objects a second time. In a release build, an actual

* double deallocation occurred, which leads to corruption

* of the allocator's internal bookkeeping pointers. That's

* so serious that maybe this should be a release-build

* check instead of an assert?

*/

_PyObject_ASSERT(op, gc_get_refs(gc) != 0);

gc = next;

}

}

/* A traversal callback for subtract_refs. */

static int

visit_decref(PyObject *op, void *parent)

{

OBJECT_STAT_INC(object_visits);

_PyObject_ASSERT(_PyObject_CAST(parent), !_PyObject_IsFreed(op));

if (_PyObject_IS_GC(op)) {

PyGC_Head *gc = AS_GC(op);

/* We're only interested in gc_refs for objects in the

* generation being collected, which can be recognized

* because only they have positive gc_refs.

*/

if (gc_is_collecting(gc)) {

gc_decref(gc);

}

}

return 0;

}

int

_PyGC_VisitStackRef(_PyStackRef *ref, visitproc visit, void *arg)

{

Py_VISIT(PyStackRef_AsPyObjectBorrow(*ref));

return 0;

}

int

_PyGC_VisitFrameStack(_PyInterpreterFrame *frame, visitproc visit, void *arg)

{

_PyStackRef *ref = _PyFrame_GetLocalsArray(frame);

/* locals and stack */

for (; ref < frame->stackpointer; ref++) {

Py_VISIT(PyStackRef_AsPyObjectBorrow(*ref));

}

return 0;

}

/* Subtract internal references from gc_refs. After this, gc_refs is >= 0

* for all objects in containers, and is GC_REACHABLE for all tracked gc

* objects not in containers. The ones with gc_refs > 0 are directly

* reachable from outside containers, and so can't be collected.

*/

static void

subtract_refs(PyGC_Head *containers)

{

traverseproc traverse;

PyGC_Head *gc = GC_NEXT(containers);

for (; gc != containers; gc = GC_NEXT(gc)) {

PyObject *op = FROM_GC(gc);

traverse = Py_TYPE(op)->tp_traverse;

(void) traverse(op,

visit_decref,

op);

}

}

/* A traversal callback for move_unreachable. */

static int

visit_reachable(PyObject *op, void *arg)

{

PyGC_Head *reachable = arg;

OBJECT_STAT_INC(object_visits);

if (!_PyObject_IS_GC(op)) {

return 0;

}

PyGC_Head *gc = AS_GC(op);

const Py_ssize_t gc_refs = gc_get_refs(gc);

// Ignore objects in other generation.

// This also skips objects "to the left" of the current position in

// move_unreachable's scan of the 'young' list - they've already been

// traversed, and no longer have the PREV_MASK_COLLECTING flag.

if (! gc_is_collecting(gc)) {

return 0;

}

// It would be a logic error elsewhere if the collecting flag were set on

// an untracked object.

_PyObject_ASSERT(op, gc->_gc_next != 0);

if (gc->_gc_next & NEXT_MASK_UNREACHABLE) {

/* This had gc_refs = 0 when move_unreachable got

* to it, but turns out it's reachable after all.

* Move it back to move_unreachable's 'young' list,

* and move_unreachable will eventually get to it

* again.

*/

// Manually unlink gc from unreachable list because the list functions

// don't work right in the presence of NEXT_MASK_UNREACHABLE flags.

PyGC_Head *prev = GC_PREV(gc);

PyGC_Head *next = GC_NEXT(gc);

_PyObject_ASSERT(FROM_GC(prev),

prev->_gc_next & NEXT_MASK_UNREACHABLE);

_PyObject_ASSERT(FROM_GC(next),

next->_gc_next & NEXT_MASK_UNREACHABLE);

prev->_gc_next = gc->_gc_next; // copy flag bits

gc->_gc_next &= ~NEXT_MASK_UNREACHABLE;

_PyGCHead_SET_PREV(next, prev);

gc_list_append(gc, reachable);

gc_set_refs(gc, 1);

}

else if (gc_refs == 0) {

/* This is in move_unreachable's 'young' list, but

* the traversal hasn't yet gotten to it. All

* we need to do is tell move_unreachable that it's

* reachable.

*/

gc_set_refs(gc, 1);

}

/* Else there's nothing to do.

* If gc_refs > 0, it must be in move_unreachable's 'young'

* list, and move_unreachable will eventually get to it.

*/

else {

_PyObject_ASSERT_WITH_MSG(op, gc_refs > 0, "refcount is too small");

}

return 0;

}

/* Move the unreachable objects from young to unreachable. After this,

* all objects in young don't have PREV_MASK_COLLECTING flag and

* unreachable have the flag.

* All objects in young after this are directly or indirectly reachable

* from outside the original young; and all objects in unreachable are

* not.

*

* This function restores _gc_prev pointer. young and unreachable are

* doubly linked list after this function.

* But _gc_next in unreachable list has NEXT_MASK_UNREACHABLE flag.

* So we can not gc_list_* functions for unreachable until we remove the flag.

*/

static void

move_unreachable(PyGC_Head *young, PyGC_Head *unreachable)

{

// previous elem in the young list, used for restore gc_prev.

PyGC_Head *prev = young;

PyGC_Head *gc = GC_NEXT(young);

/* Invariants: all objects "to the left" of us in young are reachable

* (directly or indirectly) from outside the young list as it was at entry.

*

* All other objects from the original young "to the left" of us are in

* unreachable now, and have NEXT_MASK_UNREACHABLE. All objects to the

* left of us in 'young' now have been scanned, and no objects here

* or to the right have been scanned yet.

*/

validate_consistent_old_space(young);

/* Record which old space we are in, and set NEXT_MASK_UNREACHABLE bit for convenience */

uintptr_t flags = NEXT_MASK_UNREACHABLE | (gc->_gc_next & _PyGC_NEXT_MASK_OLD_SPACE_1);

while (gc != young) {

if (gc_get_refs(gc)) {

/* gc is definitely reachable from outside the

* original 'young'. Mark it as such, and traverse

* its pointers to find any other objects that may

* be directly reachable from it. Note that the

* call to tp_traverse may append objects to young,

* so we have to wait until it returns to determine

* the next object to visit.

*/

PyObject *op = FROM_GC(gc);

traverseproc traverse = Py_TYPE(op)->tp_traverse;

_PyObject_ASSERT_WITH_MSG(op, gc_get_refs(gc) > 0,

"refcount is too small");

// NOTE: visit_reachable may change gc->_gc_next when

// young->_gc_prev == gc. Don't do gc = GC_NEXT(gc) before!

(void) traverse(op,

visit_reachable,

(void *)young);

// relink gc_prev to prev element.

_PyGCHead_SET_PREV(gc, prev);

// gc is not COLLECTING state after here.

gc_clear_collecting(gc);

prev = gc;

}

else {

/* This *may* be unreachable. To make progress,

* assume it is. gc isn't directly reachable from

* any object we've already traversed, but may be

* reachable from an object we haven't gotten to yet.

* visit_reachable will eventually move gc back into

* young if that's so, and we'll see it again.

*/

// Move gc to unreachable.

// No need to gc->next->prev = prev because it is single linked.

prev->_gc_next = gc->_gc_next;

// We can't use gc_list_append() here because we use

// NEXT_MASK_UNREACHABLE here.

PyGC_Head *last = GC_PREV(unreachable);

// NOTE: Since all objects in unreachable set has

// NEXT_MASK_UNREACHABLE flag, we set it unconditionally.

// But this may pollute the unreachable list head's 'next' pointer

// too. That's semantically senseless but expedient here - the

// damage is repaired when this function ends.

last->_gc_next = flags | (uintptr_t)gc;

_PyGCHead_SET_PREV(gc, last);

gc->_gc_next = flags | (uintptr_t)unreachable;

unreachable->_gc_prev = (uintptr_t)gc;

}

gc = _PyGCHead_NEXT(prev);

}

// young->_gc_prev must be last element remained in the list.

young->_gc_prev = (uintptr_t)prev;

young->_gc_next &= _PyGC_PREV_MASK;

// don't let the pollution of the list head's next pointer leak

unreachable->_gc_next &= _PyGC_PREV_MASK;

}

static void

untrack_tuples(PyGC_Head *head)

{

PyGC_Head *next, *gc = GC_NEXT(head);

while (gc != head) {

PyObject *op = FROM_GC(gc);

next = GC_NEXT(gc);

if (PyTuple_CheckExact(op)) {

_PyTuple_MaybeUntrack(op);

}

gc = next;

}

}

/* Return true if object has a pre-PEP 442 finalization method. */

static int

has_legacy_finalizer(PyObject *op)

{

return Py_TYPE(op)->tp_del != NULL;

}

/* Move the objects in unreachable with tp_del slots into `finalizers`.

*

* This function also removes NEXT_MASK_UNREACHABLE flag

* from _gc_next in unreachable.

*/

static void

move_legacy_finalizers(PyGC_Head *unreachable, PyGC_Head *finalizers)

{

PyGC_Head *gc, *next;

_PyObject_ASSERT(

FROM_GC(unreachable),

(unreachable->_gc_next & NEXT_MASK_UNREACHABLE) == 0);

/* March over unreachable. Move objects with finalizers into

* `finalizers`.

*/

for (gc = GC_NEXT(unreachable); gc != unreachable; gc = next) {

PyObject *op = FROM_GC(gc);

_PyObject_ASSERT(op, gc->_gc_next & NEXT_MASK_UNREACHABLE);

next = GC_NEXT(gc);

gc->_gc_next &= ~NEXT_MASK_UNREACHABLE;

if (has_legacy_finalizer(op)) {

gc_clear_collecting(gc);

gc_list_move(gc, finalizers);

}

}

}

static inline void

clear_unreachable_mask(PyGC_Head *unreachable)

{

/* Check that the list head does not have the unreachable bit set */

_PyObject_ASSERT(

FROM_GC(unreachable),

((uintptr_t)unreachable & NEXT_MASK_UNREACHABLE) == 0);

_PyObject_ASSERT(

FROM_GC(unreachable),

(unreachable->_gc_next & NEXT_MASK_UNREACHABLE) == 0);

PyGC_Head *gc, *next;

for (gc = GC_NEXT(unreachable); gc != unreachable; gc = next) {

_PyObject_ASSERT((PyObject*)FROM_GC(gc), gc->_gc_next & NEXT_MASK_UNREACHABLE);

next = GC_NEXT(gc);

gc->_gc_next &= ~NEXT_MASK_UNREACHABLE;

}

validate_list(unreachable, collecting_set_unreachable_clear);

}

/* A traversal callback for move_legacy_finalizer_reachable. */

static int

visit_move(PyObject *op, void *arg)

{

PyGC_Head *tolist = arg;

OBJECT_STAT_INC(object_visits);

if (_PyObject_IS_GC(op)) {

PyGC_Head *gc = AS_GC(op);

if (gc_is_collecting(gc)) {

gc_list_move(gc, tolist);

gc_clear_collecting(gc);

}

}

return 0;

}

/* Move objects that are reachable from finalizers, from the unreachable set

* into finalizers set.

*/

static void

move_legacy_finalizer_reachable(PyGC_Head *finalizers)

{

traverseproc traverse;

PyGC_Head *gc = GC_NEXT(finalizers);

for (; gc != finalizers; gc = GC_NEXT(gc)) {

/* Note that the finalizers list may grow during this. */

traverse = Py_TYPE(FROM_GC(gc))->tp_traverse;

(void) traverse(FROM_GC(gc),

visit_move,

(void *)finalizers);

}

}

/* Clear all weakrefs to unreachable objects, and if such a weakref has a

* callback, invoke it if necessary. Note that it's possible for such

* weakrefs to be outside the unreachable set -- indeed, those are precisely

* the weakrefs whose callbacks must be invoked. See gc_weakref.txt for

* overview & some details. Some weakrefs with callbacks may be reclaimed

* directly by this routine; the number reclaimed is the return value. Other

* weakrefs with callbacks may be moved into the `old` generation. Objects

* moved into `old` have gc_refs set to GC_REACHABLE; the objects remaining in

* unreachable are left at GC_TENTATIVELY_UNREACHABLE. When this returns,

* no object in `unreachable` is weakly referenced anymore.

*/

static int

handle_weakrefs(PyGC_Head *unreachable, PyGC_Head *old)

{

PyGC_Head *gc;

PyObject *op; /* generally FROM_GC(gc) */

PyWeakReference *wr; /* generally a cast of op */

PyGC_Head wrcb_to_call; /* weakrefs with callbacks to call */

PyGC_Head *next;

int num_freed = 0;

gc_list_init(&wrcb_to_call);

/* Clear all weakrefs to the objects in unreachable. If such a weakref

* also has a callback, move it into `wrcb_to_call` if the callback

* needs to be invoked. Note that we cannot invoke any callbacks until

* all weakrefs to unreachable objects are cleared, lest the callback

* resurrect an unreachable object via a still-active weakref. We

* make another pass over wrcb_to_call, invoking callbacks, after this

* pass completes.

*/

for (gc = GC_NEXT(unreachable); gc != unreachable; gc = next) {

PyWeakReference **wrlist;

op = FROM_GC(gc);

next = GC_NEXT(gc);

if (PyWeakref_Check(op)) {

/* A weakref inside the unreachable set must be cleared. If we

* allow its callback to execute inside delete_garbage(), it

* could expose objects that have tp_clear already called on

* them. Or, it could resurrect unreachable objects. One way

* this can happen is if some container objects do not implement

* tp_traverse. Then, wr_object can be outside the unreachable

* set but can be deallocated as a result of breaking the

* reference cycle. If we don't clear the weakref, the callback

* will run and potentially cause a crash. See bpo-38006 for

* one example.

*/

_PyWeakref_ClearRef((PyWeakReference *)op);

}

if (! _PyType_SUPPORTS_WEAKREFS(Py_TYPE(op))) {

continue;

}

/* It supports weakrefs. Does it have any?

*

* This is never triggered for static types so we can avoid the

* (slightly) more costly _PyObject_GET_WEAKREFS_LISTPTR().

*/

wrlist = _PyObject_GET_WEAKREFS_LISTPTR_FROM_OFFSET(op);

/* `op` may have some weakrefs. March over the list, clear

* all the weakrefs, and move the weakrefs with callbacks

* that must be called into wrcb_to_call.

*/

for (wr = *wrlist; wr != NULL; wr = *wrlist) {

PyGC_Head *wrasgc; /* AS_GC(wr) */

/* _PyWeakref_ClearRef clears the weakref but leaves

* the callback pointer intact. Obscure: it also

* changes *wrlist.

*/

_PyObject_ASSERT((PyObject *)wr, wr->wr_object == op);

_PyWeakref_ClearRef(wr);

_PyObject_ASSERT((PyObject *)wr, wr->wr_object == Py_None);

if (wr->wr_callback == NULL) {

/* no callback */

continue;

}

/* Headache time. `op` is going away, and is weakly referenced by

* `wr`, which has a callback. Should the callback be invoked? If wr

* is also trash, no:

*

* 1. There's no need to call it. The object and the weakref are

* both going away, so it's legitimate to pretend the weakref is

* going away first. The user has to ensure a weakref outlives its

* referent if they want a guarantee that the wr callback will get

* invoked.

*

* 2. It may be catastrophic to call it. If the callback is also in

* cyclic trash (CT), then although the CT is unreachable from

* outside the current generation, CT may be reachable from the

* callback. Then the callback could resurrect insane objects.

*

* Since the callback is never needed and may be unsafe in this case,

* wr is simply left in the unreachable set. Note that because we

* already called _PyWeakref_ClearRef(wr), its callback will never

* trigger.

*

* OTOH, if wr isn't part of CT, we should invoke the callback: the

* weakref outlived the trash. Note that since wr isn't CT in this

* case, its callback can't be CT either -- wr acted as an external

* root to this generation, and therefore its callback did too. So

* nothing in CT is reachable from the callback either, so it's hard

* to imagine how calling it later could create a problem for us. wr

* is moved to wrcb_to_call in this case.

*/

if (gc_is_collecting(AS_GC((PyObject *)wr))) {

/* it should already have been cleared above */

_PyObject_ASSERT((PyObject*)wr, wr->wr_object == Py_None);

continue;

}

/* Create a new reference so that wr can't go away

* before we can process it again.

*/

Py_INCREF(wr);

/* Move wr to wrcb_to_call, for the next pass. */

wrasgc = AS_GC((PyObject *)wr);

// wrasgc is reachable, but next isn't, so they can't be the same

_PyObject_ASSERT((PyObject *)wr, wrasgc != next);

gc_list_move(wrasgc, &wrcb_to_call);

}

}

/* Invoke the callbacks we decided to honor. It's safe to invoke them

* because they can't reference unreachable objects.

*/

int visited_space = get_gc_state()->visited_space;

while (! gc_list_is_empty(&wrcb_to_call)) {

PyObject *temp;

PyObject *callback;

gc = (PyGC_Head*)wrcb_to_call._gc_next;

op = FROM_GC(gc);

_PyObject_ASSERT(op, PyWeakref_Check(op));

wr = (PyWeakReference *)op;

callback = wr->wr_callback;

_PyObject_ASSERT(op, callback != NULL);

/* copy-paste of weakrefobject.c's handle_callback() */

temp = PyObject_CallOneArg(callback, (PyObject *)wr);

if (temp == NULL) {

PyErr_WriteUnraisable(callback);

}

else {

Py_DECREF(temp);

}

/* Give up the reference we created in the first pass. When

* op's refcount hits 0 (which it may or may not do right now),

* op's tp_dealloc will decref op->wr_callback too. Note

* that the refcount probably will hit 0 now, and because this

* weakref was reachable to begin with, gc didn't already

* add it to its count of freed objects. Example: a reachable

* weak value dict maps some key to this reachable weakref.

* The callback removes this key->weakref mapping from the