Issue #13070: Fix a crash when a TextIOWrapper caught in a reference cycle

would be finalized after the reference to its underlying BufferedRWPair's
writer got cleared by the GC.

3 files changed, 24 insertions, 0 deletions

diff --git a/Lib/test/test_io.py b/Lib/test/test_io.py
index 608fc41..003a4f3 100644
--- a/Lib/test/test_io.py
+++ b/Lib/test/test_io.py
@@ -2338,6 +2338,21 @@ class CTextIOWrapperTest(TextIOWrapperTest):
         with self.open(support.TESTFN, "rb") as f:
             self.assertEqual(f.read(), b"456def")
 
+    def test_rwpair_cleared_before_textio(self):
+        # Issue 13070: TextIOWrapper's finalization would crash when called
+        # after the reference to the underlying BufferedRWPair's writer got
+        # cleared by the GC.
+        for i in range(1000):
+            b1 = self.BufferedRWPair(self.MockRawIO(), self.MockRawIO())
+            t1 = self.TextIOWrapper(b1, encoding="ascii")
+            b2 = self.BufferedRWPair(self.MockRawIO(), self.MockRawIO())
+            t2 = self.TextIOWrapper(b2, encoding="ascii")
+            # circular references
+            t1.buddy = t2
+            t2.buddy = t1
+        support.gc_collect()
+
+
 class PyTextIOWrapperTest(TextIOWrapperTest):
     pass
 
diff --git a/Misc/NEWS b/Misc/NEWS
index 71a346d..d89ef68 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -217,6 +217,10 @@ Library
 Extension Modules
 -----------------
 
+- Issue #13070: Fix a crash when a TextIOWrapper caught in a reference cycle
+  would be finalized after the reference to its underlying BufferedRWPair's
+  writer got cleared by the GC.
+
 - Issue #12881: ctypes: Fix segfault with large structure field names.
 
 - Issue #13013: ctypes: Fix a reference leak in PyCArrayType_from_ctype.
diff --git a/Modules/_io/bufferedio.c b/Modules/_io/bufferedio.c
index 73f924e..1b81647 100644
--- a/Modules/_io/bufferedio.c
+++ b/Modules/_io/bufferedio.c
@@ -2179,6 +2179,11 @@ bufferedrwpair_isatty(rwpair *self, PyObject *args)
 static PyObject *
 bufferedrwpair_closed_get(rwpair *self, void *context)
 {
+    if (self->writer == NULL) {
+        PyErr_SetString(PyExc_RuntimeError,
+                "the BufferedRWPair object is being garbage-collected");
+        return NULL;
+    }
     return PyObject_GetAttr((PyObject *) self->writer, _PyIO_str_closed);
 }