Issue #13070: Fix a crash when a TextIOWrapper caught in a reference cycle

would be finalized after the reference to its underlying BufferedRWPair's
writer got cleared by the GC.

3 files changed, 24 insertions, 0 deletions

diff --git a/Lib/test/test_io.py b/Lib/test/test_io.py
index 53cabbb..eb2ac5f 100644
--- a/Lib/test/test_io.py
+++ b/Lib/test/test_io.py
@@ -2414,6 +2414,21 @@ class CTextIOWrapperTest(TextIOWrapperTest):
         with self.open(support.TESTFN, "rb") as f:
             self.assertEqual(f.read(), b"456def")
 
+    def test_rwpair_cleared_before_textio(self):
+        # Issue 13070: TextIOWrapper's finalization would crash when called
+        # after the reference to the underlying BufferedRWPair's writer got
+        # cleared by the GC.
+        for i in range(1000):
+            b1 = self.BufferedRWPair(self.MockRawIO(), self.MockRawIO())
+            t1 = self.TextIOWrapper(b1, encoding="ascii")
+            b2 = self.BufferedRWPair(self.MockRawIO(), self.MockRawIO())
+            t2 = self.TextIOWrapper(b2, encoding="ascii")
+            # circular references
+            t1.buddy = t2
+            t2.buddy = t1
+        support.gc_collect()
+
+
 class PyTextIOWrapperTest(TextIOWrapperTest):
     pass
 
diff --git a/Misc/NEWS b/Misc/NEWS
index 6b558b4..c4aba0d 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -98,6 +98,10 @@ Tests
 Extension Modules
 -----------------
 
+- Issue #13070: Fix a crash when a TextIOWrapper caught in a reference cycle
+  would be finalized after the reference to its underlying BufferedRWPair's
+  writer got cleared by the GC.
+
 - Issue #12881: ctypes: Fix segfault with large structure field names.
 
 - Issue #13058: ossaudiodev: fix a file descriptor leak on error. Patch by
diff --git a/Modules/_io/bufferedio.c b/Modules/_io/bufferedio.c
index bd1aae5..c979ac2 100644
--- a/Modules/_io/bufferedio.c
+++ b/Modules/_io/bufferedio.c
@@ -2212,6 +2212,11 @@ bufferedrwpair_isatty(rwpair *self, PyObject *args)
 static PyObject *
 bufferedrwpair_closed_get(rwpair *self, void *context)
 {
+    if (self->writer == NULL) {
+        PyErr_SetString(PyExc_RuntimeError,
+                "the BufferedRWPair object is being garbage-collected");
+        return NULL;
+    }
     return PyObject_GetAttr((PyObject *) self->writer, _PyIO_str_closed);
 }