gh-152951 - Fix double DECREF when newblock fails during deque.extend calls#152961
Merged
Conversation
newblock fails during deque.extend callsnewblock fails during deque.extend calls
sobolevn
approved these changes
Jul 3, 2026
sobolevn
left a comment
Member
There was a problem hiding this comment.
In two other places where we call deque_append_lock_held we pass Py_NewRef(item), so the reference would be owned by the deque.
Here we don't do that, because tp_iternext returns new references.
So, we can remove the second decref.
Contributor
Author
|
Thanks again @sobolevn! |
|
GH-152971 is a backport of this pull request to the 3.15 branch. |
|
GH-152972 is a backport of this pull request to the 3.14 branch. |
|
GH-152973 is a backport of this pull request to the 3.13 branch. |
sobolevn
pushed a commit
that referenced
this pull request
Jul 3, 2026
sobolevn
pushed a commit
that referenced
this pull request
Jul 3, 2026
sobolevn
pushed a commit
that referenced
this pull request
Jul 3, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
When deque.extend is called, items from the passed-in sequence are appended using
deque_append_lock_held.deque_append_lock_heldsteals the reference toitem, and (if needed) allocates a new block to store the item.If the
netblockcall fails, thendeque_append_lock_heldDECREFs the item and returns -1BUT: if
deque_extend_implsees the -1 return fromdeque_append_lock_held, it also DECREF'sitemagain, despite not owning it any more. This can cause negative refcounts and crashes.This fix removes the output DECREF, as it's handled by the inner func already.
There's no tests for this, as triggering an allocation failure within
newblockis a bit tricky to do reliably.deque_append_lock_held#152951