diff options
| author | Victor Stinner <victor.stinner@gmail.com> | 2013-12-13 01:17:29 (GMT) |
|---|---|---|
| committer | Victor Stinner <victor.stinner@gmail.com> | 2013-12-13 01:17:29 (GMT) |
| commit | 131051079351859a5451b873667b489e2a9e9f2a (patch) | |
| tree | b57298e16e6aabf7ba5a48755cfb3e3f01e57ca5 /Objects | |
| parent | da12adac10761439a8a3828958e970db98d7ebc8 (diff) | |
| download | cpython-131051079351859a5451b873667b489e2a9e9f2a.zip cpython-131051079351859a5451b873667b489e2a9e9f2a.tar.gz cpython-131051079351859a5451b873667b489e2a9e9f2a.tar.bz2 | |
Issue #14432: Generator now clears the borrowed reference to the thread state
Fix a crash when a generator is created in a C thread that is destroyed while
the generator is still used. The issue was that a generator contains a frame,
and the frame kept a reference to the Python state of the destroyed C thread.
The crash occurs when a trace function is setup.
Diffstat (limited to 'Objects')
| -rw-r--r-- | Objects/genobject.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/Objects/genobject.c b/Objects/genobject.c index 016bfa2..2e74b8c 100644 --- a/Objects/genobject.c +++ b/Objects/genobject.c @@ -76,6 +76,7 @@ gen_send_ex(PyGenObject *gen, PyObject *arg, int exc) /* Generators always return to their most recent caller, not * necessarily their creator. */ + f->f_tstate = tstate; Py_XINCREF(tstate->frame); assert(f->f_back == NULL); f->f_back = tstate->frame; @@ -89,6 +90,8 @@ gen_send_ex(PyGenObject *gen, PyObject *arg, int exc) * cycle. */ assert(f->f_back == tstate->frame); Py_CLEAR(f->f_back); + /* Clear the borrowed reference to the thread state */ + f->f_tstate = NULL; /* If the generator just returned (as opposed to yielding), signal * that the generator is exhausted. */ |