Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Calling isinstance(x,t) repeatedly when x or t is not actually a CLR … #273

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Oct 18, 2016

Conversation

ArvidJB
Copy link
Contributor

@ArvidJB ArvidJB commented Oct 18, 2016

…object will leak reference counts to PyFalse, resulting in memory corruption once the reference count drops to zero and PyFalse gets freed

…object will leak reference counts to PyFalse, resulting in memory corruption once the reference count drops to zero and PyFalse gets freed
@ArvidJB
Copy link
Contributor Author

ArvidJB commented Oct 18, 2016

If you run the simple test I added you will most likely get a crash. Every invocation of DoInstanceCheck will return PyFalse, from this callstack:
Python.Runtime.dll!Python.Runtime.MetaType.DoInstanceCheck(System.IntPtr tp, System.IntPtr args, bool checkType) Line 281 C#
Python.Runtime.dll!Python.Runtime.MetaType.__instancecheck__(System.IntPtr tp, System.IntPtr args) Line 318 C#
[Native to Managed Transition]
python35.dll!PyCFunction_Call(_object * func, _object * args, _object * kwds) Line 145 C
python35.dll!PyObject_Call(_object * func, _object * arg, _object * kw) Line 2167 C
python35.dll!PyObject_CallFunctionObjArgs(_object * callable, ...) Line 2446 C
python35.dll!PyObject_IsInstance(_object * inst, _object * cls) Line 2640 C
python35.dll!builtin_isinstance(PyModuleDef * module, _object * args) Line 624 C
In Python 3.5.2 which I am running PyObject_IsInstance contains this code which decrements the reference count of the returned value
res = PyObject_CallFunctionObjArgs(checker, inst, NULL);
Py_LeaveRecursiveCall();
Py_DECREF(checker);
if (res != NULL) {
ok = PyObject_IsTrue(res);
Py_DECREF(res);
}
And if you run this often enough the reference count drops to zero and "False" get freed which almost immediately crashes my python interpreter.

@den-run-ai
Copy link
Contributor

@ArvidJB looks good to me and I confirmed that test this crashes the python interpreter - nice catch! Do you agree to MIT license once we transition? This code appears to be from @filmor, so we will let him review this.

@filmor
Copy link
Member

filmor commented Oct 18, 2016

Yep, looks a lot more correct than before, thanks for catching this :)

@filmor filmor merged commit 1a2499b into pythonnet:master Oct 18, 2016
@ArvidJB
Copy link
Contributor Author

ArvidJB commented Oct 18, 2016

Great, thanks for the quick turnaround!
I agree with both the ZPL and the MIT license for this change (and potential future changes).

@ArvidJB ArvidJB deleted the isinstance_refcount_leak branch October 18, 2016 13:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants