diff options
| author | Victor Stinner <victor.stinner@gmail.com> | 2013-12-13 02:37:09 +0100 |
|---|---|---|
| committer | Victor Stinner <victor.stinner@gmail.com> | 2013-12-13 02:37:09 +0100 |
| commit | 3fc7076e3964c6066ca3a7a02e6245a7f393bca2 (patch) | |
| tree | ee6d8fd000c3b95887b3d5fc64eb1d7485cc1b59 /Objects | |
| parent | a639a00c42ac7147e9cc75f96dd6dbc57aba14de (diff) | |
| download | cpython-3fc7076e3964c6066ca3a7a02e6245a7f393bca2.tar.gz | |
Issue #14432: Generator now clears the borrowed reference to the thread state
Fix a crash when a generator is created in a C thread that is destroyed while
the generator is still used. The issue was that a generator contains a frame,
and the frame kept a reference to the Python state of the destroyed C thread.
The crash occurs when a trace function is setup.
Diffstat (limited to 'Objects')
| -rw-r--r-- | Objects/genobject.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/Objects/genobject.c b/Objects/genobject.c index 341f6605fb..082e03c48e 100644 --- a/Objects/genobject.c +++ b/Objects/genobject.c @@ -76,6 +76,7 @@ gen_send_ex(PyGenObject *gen, PyObject *arg, int exc) /* Generators always return to their most recent caller, not * necessarily their creator. */ + f->f_tstate = tstate; Py_XINCREF(tstate->frame); assert(f->f_back == NULL); f->f_back = tstate->frame; @@ -89,6 +90,8 @@ gen_send_ex(PyGenObject *gen, PyObject *arg, int exc) * cycle. */ assert(f->f_back == tstate->frame); Py_CLEAR(f->f_back); + /* Clear the borrowed reference to the thread state */ + f->f_tstate = NULL; /* If the generator just returned (as opposed to yielding), signal * that the generator is exhausted. */ |