[New-bugs-announce] [issue38009] Handle weakreference callbacks invoked indirectly in the middle of a gc collection

[Pablo Galindo Salgado]

New submission from Pablo Galindo Salgado <pablogsal at gmail.com>:

A weak reference may try to invoke a callback object that is being
cleaned (tp_clear) by the garbage collector and it may be in an
inconsistent state. As the garbage collector explicitly does not
invoke callbacks that are part of the same cycle isolate as the
weak reference (pretending that the weak reference was destroyed first),
we should act in the same way when invoking callbacks using Objects/weakrefobject.c:handle_callback.

For example, consider the following scenario:

- F is a function.
- An object O is in a cycle with F.
- O has a weak reference with F as a callback.

When running the garbage collector, is possible to end in Objects/weakrefobject.c:handle_callback if the tp_clear of F decrements the references of O, invoking the weak
reference callback that will try to call F, which is in an incosistent
state as is in the middle of its tp_clear and some internal fields may
be NULL.

----------
components: Interpreter Core
messages: 351001
nosy: pablogsal, pitrou, vstinner
priority: normal
severity: normal
status: open
title: Handle weakreference callbacks invoked indirectly in the middle of a gc collection
versions: Python 3.7, Python 3.8, Python 3.9

_______________________________________
Python tracker <report at bugs.python.org>
<https://bugs.python.org/issue38009>
_______________________________________