Movatterモバイル変換
[0]ホーム
[Python-Dev] Crash in new "trashcan" mechanism.
Mark Hammondmhammond@skippinet.com.au
Thu, 13 Apr 2000 11:07:45 +1000
The trashcan bug turns out to be trivial to describe, but not sotrivial to fix. Put simply, the trashcan mechanism conflictshorribly with PY_TRACE_REFS :-(The problem stems from the fact that the trashcan resurrectsobjects. An object added to the trashcan has its ref count as zero,but is then added to the trash list, transitioning its ref-countback to 1. Deleting the trashcan then does a second deallocation ofthe object, again taking the ref count back to zero, and this timeactually doing the destruction. By pure fluke, this works withoutPy_DEBUG defined!With Py_DEBUG defined, this first causes problems due to ob_typebeing NULL. _Py_Dealloc() sets the ob_type element to NULL beforeit calls the object de-allocater. Thus, the trash object first hitsa zero refcount, and its ob_type is zapped. It is then resurrected,but the ob_type value remains NULL. When the second deallocationfor the object happens, this NULL type forces the crash.Changing the Py_DEBUG version of _Py_Dealloc() to not zap the typedoesnt solve the problem. The whole _Py_ForgetReference()linked-list management also dies. Second time we attempt todeallocate the object the code that removes the object from the"alive objects" linked list fails - the object was already removedfirst time around.I see these possible solutions:* The trash mechanism is changed to keep a list of (address,deallocator) pairs. This is a "cleaner" solution, as the list isnot considered holding PyObjects as such, just blocks of memory tobe freed with a custom allocator. Thus, we never end up in aposition where a Python objects are resurrected - we just defer theactual memory deallocation, rather than attempting a delayed objectdestruction. This may not be as trivial to implement as to describe:-)* Debug builds disable the trash mechanism. Not desired as thebasic behaviour of the interpreter will change, making bug trackingwith debug builds difficult! If we went this way, I would (try to:-) insist that the Windows debug builds dropped Py_DEBUG, as Ireally want to avoid the scenario that switching to a debug buildchanges the behaviour to this extent.* Perform further hacks, so that Py_ForgetReference() gracefullyhandles NULL linked-list elements etc.Any thoughts?Mark.
[8]ページ先頭