In `_Py_dict_lookup_threadsafe_stackref`, call `ensure_shared_on_read()` to
prevent a race between the lookup and concurrent dict resizes, which may free
the PyDictKeysObject (i.e., it ensures that the resize uses QSBR).
(cherry picked from commit e666a01ef4)
gh-102809: No longer mention `Misc/gdbinit` in the code (GH-143980)
Fix misleading comment on `PyObject_Dump`.
(cherry picked from commit f84ea11071)
Co-authored-by: Bartosz Sławecki <bartosz@ilikepython.com>
This happens when the set contained several elements with the same hash,
and then some of them were removed.
(cherry picked from commit b8e925b4f8)
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
Remove outdated comment about `excess_args` warning in `object.__init__` (GH-143669)
The code emitting a warning was removed in 96384b93aa.
(cherry picked from commit 03e6457096)
Co-authored-by: Manuel Jacob <me@manueljacob.de>
When comparing negative non-integer float and int with the same number
of bits in the integer part, __neg__() in the int subclass returning
not an int caused an assertion error.
Now the integer is no longer negated. Also, reduced the number of
temporary created Python objects.
(cherry picked from commit 66bca383bd)
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
When __length_hint__() returns 0 for non-empty iterator, the data can be
written past the shared 0-terminated buffer, corrupting it.
(cherry picked from commit 522563549a)
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
gh-142557: fix UAF in `bytearray.__mod__` when object is mutated while formatting `%`-style arguments (GH-143213)
(cherry picked from commit 61ee04834b)
Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>
gh-142560: prevent use-after-free in search-like methods by exporting buffer in bytearray (GH-142938)
(cherry picked from commit 220f0b1077)
Co-authored-by: wangxiaolei <fatelei@gmail.com>
gh-142554: avoid `divmod` crashes due to bad `_pylong.int_divmod` (GH-142673)
(cherry picked from commit 4e4163676a)
Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>
There are places we use "relaxed" loads where C11 requires "consume" or
stronger. Unfortunately, compilers don't really implement "consume" so
fake it for our use in a way that avoids upsetting TSan.
(cherry picked from commit 0a62f8277e)
Co-authored-by: Sam Gross <colesbury@gmail.com>
gh-142433: Move deref to below the error when checking for laststring (GH-142402)
Move deref of laststring to below the error checking so the deref
is applied after the object in strings is replaced.
(cherry picked from commit 785268fdce)
Co-authored-by: AZero13 <gfunni234@gmail.com>
This fixes a regression introduced in gh-140558. The interpreter would
crash if we inserted a non `str` key into a split table that matches an
existing key.
(cherry picked from commit 547d8daf78)
Co-authored-by: Sam Gross <colesbury@gmail.com>
The dataclasses `__init__` function is generated dynamically by a call to `exec()` and so doesn't have deferred reference counting enabled. Enable deferred reference counting on functions when assigned as an attribute to type objects to avoid reference count contention when creating dataclass instances.
(cherry picked from commit ce79154176)
Co-authored-by: Edward Xu <xuxiangad@gmail.com>
This fixes an assertion error when the new computed start is not an integer.
(cherry picked from commit 10bec7c1eb)
Co-authored-by: Sergey Miryanov <sergey.miryanov@gmail.com>
gh-140815: Fix faulthandler for invalid/freed frame (GH-140921)
faulthandler now detects if a frame or a code object is invalid or
freed.
Add helper functions:
* _PyCode_SafeAddr2Line()
* _PyFrame_SafeGetCode()
* _PyFrame_SafeGetLasti()
_PyMem_IsPtrFreed() now detects pointers in [-0xff, 0xff] range
as freed.
(cherry picked from commit a84181c31b)
Co-authored-by: Victor Stinner <vstinner@python.org>
gh-140348: Fix using | on unusual objects plus Unions (GH-140383)
(cherry picked from commit 7a9437d986)
Co-authored-by: Jelle Zijlstra <jelle.zijlstra@gmail.com>
Remove dead stores to 'size' in UTF-8 decoder (unicodeobject.c) (GH-140637)
(cherry picked from commit 7d70a147f5)
Co-authored-by: Shamil <ashm.tech@proton.me>
The `make_gen()` function creates and tracks generator/coro objects, but
doesn't fully initialize all the fields. At a minimum, we need to
initialize all the fields that may be accessed by gen_traverse because
the call to `compute_cr_origin()` can trigger a GC.
(cherry picked from commit 574405c19e)
Co-authored-by: Sam Gross <colesbury@gmail.com>
* Count number of actually tracked objects, instead of trackable objects. This ensures that untracking tuples has the desired effect of reducing GC overhead
* Do not track most untrackable tuples during creation. This prevents large numbers of small tuples causing execessive GCs.
Currently, there are a few places where tp_mro could theoretically
become NULL, but do not in practice. This commit adds defensive checks for
NULL values to ensure that any changes do not introduce a crash and that
state invariants are upheld.
The assertions added in this commit are all instances where a NULL value would get passed to something not expecting a NULL, so it is better to catch an assertion failure than crash later on.
There are a few cases where it is OK for the return of lookup_tp_mro to be NULL, such as when passed to is_subtype_with_mro, which handles this explicitly.
(cherry picked from commit a8edca62fc)
Co-authored-by: Emma Smith <emma@emmatyping.dev>
gh-140406: Fix memory leak upon `__hash__` returning a non-integer (GH-140411)
(cherry picked from commit 71db05a12d)
Co-authored-by: Peter Bierma <zintensitydev@gmail.com>
The previous `Py_REFCNT(x) == 1` checks can have data races in the free
threaded build. `_PyObject_IsUniquelyReferenced(x)` is a more conservative
check that is safe in the free threaded build and is identical to
`Py_REFCNT(x) == 1` in the default GIL-enabled build.
(cherry picked from commit 32c264982e)
Co-authored-by: Sergey Miryanov <sergey.miryanov@gmail.com>
GH-140058: Clear key and value if `PyTuple_New` fails in `dictiter_iternextitem` (GH-140059)
(cherry picked from commit ded59f7e8e)
Co-authored-by: Sergey Miryanov <sergey.miryanov@gmail.com>
gh-139988: fix a leak when failing to create a Union type (GH-139990)
(cherry picked from commit 6710156bd2)
Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>
gh-133467: fix data race in `type_set_name` (GH-137302)
Fix data race in `type_set_name` by assigning name under stop the world pause making it thread safe in free-threading.
(cherry picked from commit e99bc7fd44)
Co-authored-by: Kumar Aditya <kumaraditya@python.org>
gh-58124: Avoid CP_UTF8 in UnicodeDecodeError (GH-137415)
Fix name of the Python encoding in Unicode errors of the code page
codec: use "cp65000" and "cp65001" instead of "CP_UTF7" and "CP_UTF8"
which are not valid Python code names.
(cherry picked from commit ce1b747ff6)
Co-authored-by: Victor Stinner <vstinner@python.org>
gh-71810: Fix _PyLong_AsByteArray() undefined behavior (GH-138873)
Don't read p[-1] when p is an empty string: when n==0.
(cherry picked from commit 8b5ce31c2b)
Co-authored-by: Victor Stinner <vstinner@python.org>
