bpo-46025: Fix a crash in the atexit module for auto-unregistering functions (GH-30002) (GH-30005)

(cherry picked from commit f0d290d25cad66e615ada68ba190b8a23ac1deaa)

Co-authored-by: Pablo Galindo Salgado <Pablogsal@gmail.com>

Co-authored-by: Pablo Galindo Salgado <Pablogsal@gmail.com>

3 files changed, 21 insertions, 1 deletions

diff --git a/Lib/test/_test_atexit.py b/Lib/test/_test_atexit.py
index a316585..55d2808 100644
--- a/Lib/test/_test_atexit.py
+++ b/Lib/test/_test_atexit.py
@@ -116,6 +116,21 @@ class GeneralTest(unittest.TestCase):
         atexit._run_exitfuncs()
         self.assertEqual(l, [5])
 
+    def test_atexit_with_unregistered_function(self):
+        # See bpo-46025 for more info
+        def func():
+            atexit.unregister(func)
+            1/0
+        atexit.register(func)
+        try:
+            with support.catch_unraisable_exception() as cm:
+                atexit._run_exitfuncs()
+                self.assertEqual(cm.unraisable.object, func)
+                self.assertEqual(cm.unraisable.exc_type, ZeroDivisionError)
+                self.assertEqual(type(cm.unraisable.exc_value), ZeroDivisionError)
+        finally:
+            atexit.unregister(func)
+
 
 if __name__ == "__main__":
     unittest.main()
diff --git a/Misc/NEWS.d/next/Core and Builtins/2021-12-09-11-41-35.bpo-46025.pkEvW9.rst b/Misc/NEWS.d/next/Core and Builtins/2021-12-09-11-41-35.bpo-46025.pkEvW9.rst
new file mode 100644
index 0000000..dd2f1ff
--- /dev/null
+++ b/Misc/NEWS.d/next/Core and Builtins/2021-12-09-11-41-35.bpo-46025.pkEvW9.rst
@@ -0,0 +1,2 @@
+Fix a crash in the :mod:`atexit` module involving functions that unregister
+themselves before raising exceptions. Patch by Pablo Galindo.
diff --git a/Modules/atexitmodule.c b/Modules/atexitmodule.c
index e536b4a..95c653c 100644
--- a/Modules/atexitmodule.c
+++ b/Modules/atexitmodule.c
@@ -93,13 +93,16 @@ atexit_callfuncs(struct atexit_state *state)
             continue;
         }
 
+        // bpo-46025: Increment the refcount of cb->func as the call itself may unregister it
+        PyObject* the_func = Py_NewRef(cb->func);
         PyObject *res = PyObject_Call(cb->func, cb->args, cb->kwargs);
         if (res == NULL) {
-            _PyErr_WriteUnraisableMsg("in atexit callback", cb->func);
+            _PyErr_WriteUnraisableMsg("in atexit callback", the_func);
         }
         else {
             Py_DECREF(res);
         }
+        Py_DECREF(the_func);
     }
 
     atexit_cleanup(state);