Skip to content

Commit 517dc65

Browse files
markshannonmarkshannon
authored
GH-128682: Stronger checking of PyStackRef_CLOSE and DEAD. (GH-128683)
1 parent 6ff8f82 commit 517dc65

File tree

7 files changed

+220
-123
lines changed

7 files changed

+220
-123
lines changed

‎Include/internal/pycore_opcode_metadata.h

+3-3
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎Include/internal/pycore_uop_metadata.h

+3-3
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎Lib/test/test_generated_cases.py

+12
Original file line numberDiff line numberDiff line change
@@ -1739,6 +1739,18 @@ def test_no_escaping_calls_in_branching_macros(self):
17391739
with self.assertRaises(SyntaxError):
17401740
self.run_cases_test(input, "")
17411741

1742+
def test_kill_in_wrong_order(self):
1743+
input = """
1744+
inst(OP, (a, b -- c)) {
1745+
c = b;
1746+
PyStackRef_CLOSE(a);
1747+
PyStackRef_CLOSE(b);
1748+
}
1749+
"""
1750+
with self.assertRaises(SyntaxError):
1751+
self.run_cases_test(input, "")
1752+
1753+
17421754
class TestGeneratedAbstractCases(unittest.TestCase):
17431755
def setUp(self) -> None:
17441756
super().setUp()

‎Python/bytecodes.c

+38-36
Original file line numberDiff line numberDiff line change
@@ -384,7 +384,7 @@ dummy_func(
384384
(void)receiver;
385385
val = value;
386386
DEAD(value);
387-
PyStackRef_CLOSE(receiver);
387+
DECREF_INPUTS();
388388
}
389389

390390
tier1 inst(INSTRUMENTED_END_SEND, (receiver, value -- val)) {
@@ -681,8 +681,8 @@ dummy_func(
681681

682682
STAT_INC(BINARY_OP, hit);
683683
PyObject *res_o = PyUnicode_Concat(left_o, right_o);
684-
PyStackRef_CLOSE_SPECIALIZED(left, _PyUnicode_ExactDealloc);
685684
PyStackRef_CLOSE_SPECIALIZED(right, _PyUnicode_ExactDealloc);
685+
PyStackRef_CLOSE_SPECIALIZED(left, _PyUnicode_ExactDealloc);
686686
INPUTS_DEAD();
687687
ERROR_IF(res_o == NULL, error);
688688
res = PyStackRef_FromPyObjectSteal(res_o);
@@ -725,7 +725,7 @@ dummy_func(
725725
* that the string is safe to mutate.
726726
*/
727727
assert(Py_REFCNT(left_o) >= 2);
728-
PyStackRef_CLOSE(left);
728+
PyStackRef_CLOSE_SPECIALIZED(left, _PyUnicode_ExactDealloc);
729729
DEAD(left);
730730
PyObject *temp = PyStackRef_AsPyObjectSteal(*target_local);
731731
PyUnicode_Append(&temp, right_o);
@@ -822,8 +822,7 @@ dummy_func(
822822
err = PyObject_SetItem(PyStackRef_AsPyObjectBorrow(container), slice, PyStackRef_AsPyObjectBorrow(v));
823823
Py_DECREF(slice);
824824
}
825-
PyStackRef_CLOSE(v);
826-
PyStackRef_CLOSE(container);
825+
DECREF_INPUTS();
827826
ERROR_IF(err, error);
828827
}
829828

@@ -2082,11 +2081,8 @@ dummy_func(
20822081
int method_found = 0;
20832082
PyObject *attr_o = _PySuper_Lookup(cls, self, name,
20842083
Py_TYPE(self)->tp_getattro == PyObject_GenericGetAttr ? &method_found : NULL);
2085-
PyStackRef_CLOSE(global_super_st);
2086-
PyStackRef_CLOSE(class_st);
20872084
if (attr_o == NULL) {
2088-
PyStackRef_CLOSE(self_st);
2089-
ERROR_IF(true, error);
2085+
ERROR_NO_POP();
20902086
}
20912087
if (method_found) {
20922088
self_or_null = self_st; // transfer ownership
@@ -2095,6 +2091,8 @@ dummy_func(
20952091
PyStackRef_CLOSE(self_st);
20962092
self_or_null = PyStackRef_NULL;
20972093
}
2094+
PyStackRef_CLOSE(class_st);
2095+
PyStackRef_CLOSE(global_super_st);
20982096

20992097
attr = PyStackRef_FromPyObjectSteal(attr_o);
21002098
}
@@ -2920,7 +2918,6 @@ dummy_func(
29202918
else {
29212919
/* `iterable` is not a generator. */
29222920
PyObject *iter_o = PyObject_GetIter(iterable_o);
2923-
DEAD(iterable);
29242921
if (iter_o == NULL) {
29252922
ERROR_NO_POP();
29262923
}
@@ -3466,11 +3463,11 @@ dummy_func(
34663463
/* Callable is not a normal Python function */
34673464
STACKREFS_TO_PYOBJECTS(args, total_args, args_o);
34683465
if (CONVERSION_FAILED(args_o)) {
3469-
PyStackRef_CLOSE(callable[0]);
34703466
for (int i = 0; i < total_args; i++) {
34713467
PyStackRef_CLOSE(args[i]);
34723468
}
34733469
DEAD(self_or_null);
3470+
PyStackRef_CLOSE(callable[0]);
34743471
ERROR_IF(true, error);
34753472
}
34763473
PyObject *res_o = PyObject_Vectorcall(
@@ -3496,11 +3493,11 @@ dummy_func(
34963493
}
34973494
}
34983495
assert((res_o != NULL) ^ (_PyErr_Occurred(tstate) != NULL));
3499-
PyStackRef_CLOSE(callable[0]);
35003496
for (int i = 0; i < total_args; i++) {
35013497
PyStackRef_CLOSE(args[i]);
35023498
}
35033499
DEAD(self_or_null);
3500+
PyStackRef_CLOSE(callable[0]);
35043501
ERROR_IF(res_o == NULL, error);
35053502
res = PyStackRef_FromPyObjectSteal(res_o);
35063503
}
@@ -3636,11 +3633,11 @@ dummy_func(
36363633
NULL);
36373634
STACKREFS_TO_PYOBJECTS_CLEANUP(args_o);
36383635
assert((res_o != NULL) ^ (_PyErr_Occurred(tstate) != NULL));
3639-
PyStackRef_CLOSE(callable[0]);
36403636
for (int i = 0; i < total_args; i++) {
36413637
PyStackRef_CLOSE(args[i]);
36423638
}
36433639
DEAD(self_or_null);
3640+
PyStackRef_CLOSE(callable[0]);
36443641
ERROR_IF(res_o == NULL, error);
36453642
res = PyStackRef_FromPyObjectSteal(res_o);
36463643
}
@@ -3865,28 +3862,29 @@ dummy_func(
38653862

38663863
op(_CALL_BUILTIN_CLASS, (callable[1], self_or_null[1], args[oparg] -- res)) {
38673864
PyObject *callable_o = PyStackRef_AsPyObjectBorrow(callable[0]);
3868-
3865+
DEOPT_IF(!PyType_Check(callable_o));
3866+
PyTypeObject *tp = (PyTypeObject *)callable_o;
38693867
int total_args = oparg;
3868+
_PyStackRef *arguments = args;
38703869
if (!PyStackRef_IsNull(self_or_null[0])) {
3871-
args--;
3870+
arguments--;
38723871
total_args++;
38733872
}
3874-
DEAD(self_or_null);
3875-
DEOPT_IF(!PyType_Check(callable_o));
3876-
PyTypeObject *tp = (PyTypeObject *)callable_o;
38773873
DEOPT_IF(tp->tp_vectorcall == NULL);
38783874
STAT_INC(CALL, hit);
3879-
STACKREFS_TO_PYOBJECTS(args, total_args, args_o);
3875+
STACKREFS_TO_PYOBJECTS(arguments, total_args, args_o);
38803876
if (CONVERSION_FAILED(args_o)) {
38813877
DECREF_INPUTS();
38823878
ERROR_IF(true, error);
38833879
}
3880+
DEAD(self_or_null);
38843881
PyObject *res_o = tp->tp_vectorcall((PyObject *)tp, args_o, total_args, NULL);
38853882
STACKREFS_TO_PYOBJECTS_CLEANUP(args_o);
38863883
/* Free the arguments. */
38873884
for (int i = 0; i < total_args; i++) {
3888-
PyStackRef_CLOSE(args[i]);
3885+
PyStackRef_CLOSE(arguments[i]);
38893886
}
3887+
DEAD(args);
38903888
PyStackRef_CLOSE(callable[0]);
38913889
ERROR_IF(res_o == NULL, error);
38923890
res = PyStackRef_FromPyObjectSteal(res_o);
@@ -3939,21 +3937,22 @@ dummy_func(
39393937
PyObject *callable_o = PyStackRef_AsPyObjectBorrow(callable[0]);
39403938

39413939
int total_args = oparg;
3940+
_PyStackRef *arguments = args;
39423941
if (!PyStackRef_IsNull(self_or_null[0])) {
3943-
args--;
3942+
arguments--;
39443943
total_args++;
39453944
}
3946-
DEAD(self_or_null);
39473945
DEOPT_IF(!PyCFunction_CheckExact(callable_o));
39483946
DEOPT_IF(PyCFunction_GET_FLAGS(callable_o) != METH_FASTCALL);
39493947
STAT_INC(CALL, hit);
39503948
PyCFunction cfunc = PyCFunction_GET_FUNCTION(callable_o);
39513949
/* res = func(self, args, nargs) */
3952-
STACKREFS_TO_PYOBJECTS(args, total_args, args_o);
3950+
STACKREFS_TO_PYOBJECTS(arguments, total_args, args_o);
39533951
if (CONVERSION_FAILED(args_o)) {
39543952
DECREF_INPUTS();
39553953
ERROR_IF(true, error);
39563954
}
3955+
DEAD(self_or_null);
39573956
PyObject *res_o = ((PyCFunctionFast)(void(*)(void))cfunc)(
39583957
PyCFunction_GET_SELF(callable_o),
39593958
args_o,
@@ -3963,8 +3962,9 @@ dummy_func(
39633962

39643963
/* Free the arguments. */
39653964
for (int i = 0; i < total_args; i++) {
3966-
PyStackRef_CLOSE(args[i]);
3965+
PyStackRef_CLOSE(arguments[i]);
39673966
}
3967+
DEAD(args);
39683968
PyStackRef_CLOSE(callable[0]);
39693969
ERROR_IF(res_o == NULL, error);
39703970
res = PyStackRef_FromPyObjectSteal(res_o);
@@ -4043,8 +4043,10 @@ dummy_func(
40434043
if (res_o == NULL) {
40444044
GOTO_ERROR(error);
40454045
}
4046-
PyStackRef_CLOSE(callable[0]);
40474046
PyStackRef_CLOSE(arg_stackref);
4047+
DEAD(args);
4048+
DEAD(self_or_null);
4049+
PyStackRef_CLOSE(callable[0]);
40484050
res = PyStackRef_FromPyObjectSteal(res_o);
40494051
}
40504052

@@ -4053,25 +4055,24 @@ dummy_func(
40534055
PyObject *callable_o = PyStackRef_AsPyObjectBorrow(callable[0]);
40544056

40554057
int total_args = oparg;
4058+
_PyStackRef *arguments = args;
40564059
if (!PyStackRef_IsNull(self_or_null[0])) {
4057-
args--;
4060+
arguments--;
40584061
total_args++;
40594062
}
40604063
DEOPT_IF(total_args != 2);
40614064
PyInterpreterState *interp = tstate->interp;
40624065
DEOPT_IF(callable_o != interp->callable_cache.isinstance);
40634066
STAT_INC(CALL, hit);
4064-
_PyStackRef cls_stackref = args[1];
4065-
_PyStackRef inst_stackref = args[0];
4067+
_PyStackRef cls_stackref = arguments[1];
4068+
_PyStackRef inst_stackref = arguments[0];
40664069
int retval = PyObject_IsInstance(PyStackRef_AsPyObjectBorrow(inst_stackref), PyStackRef_AsPyObjectBorrow(cls_stackref));
40674070
if (retval < 0) {
40684071
ERROR_NO_POP();
40694072
}
40704073
res = retval ? PyStackRef_True : PyStackRef_False;
40714074
assert((!PyStackRef_IsNull(res)) ^ (_PyErr_Occurred(tstate) != NULL));
4072-
PyStackRef_CLOSE(inst_stackref);
4073-
PyStackRef_CLOSE(cls_stackref);
4074-
PyStackRef_CLOSE(callable[0]);
4075+
DECREF_INPUTS();
40754076
}
40764077

40774078
// This is secretly a super-instruction
@@ -4370,11 +4371,11 @@ dummy_func(
43704371
}
43714372
PyStackRef_CLOSE(kwnames);
43724373
assert((res_o != NULL) ^ (_PyErr_Occurred(tstate) != NULL));
4373-
PyStackRef_CLOSE(callable[0]);
43744374
for (int i = 0; i < total_args; i++) {
43754375
PyStackRef_CLOSE(args[i]);
43764376
}
43774377
DEAD(self_or_null);
4378+
PyStackRef_CLOSE(callable[0]);
43784379
ERROR_IF(res_o == NULL, error);
43794380
res = PyStackRef_FromPyObjectSteal(res_o);
43804381
}
@@ -4529,6 +4530,8 @@ dummy_func(
45294530
PyObject *callargs_o = PyStackRef_AsPyObjectBorrow(callargs);
45304531
if (PyTuple_CheckExact(callargs_o)) {
45314532
tuple = callargs;
4533+
kwargs_out = kwargs_in;
4534+
DEAD(kwargs_in);
45324535
DEAD(callargs);
45334536
}
45344537
else {
@@ -4540,11 +4543,11 @@ dummy_func(
45404543
if (tuple_o == NULL) {
45414544
ERROR_NO_POP();
45424545
}
4546+
kwargs_out = kwargs_in;
4547+
DEAD(kwargs_in);
45434548
PyStackRef_CLOSE(callargs);
45444549
tuple = PyStackRef_FromPyObjectSteal(tuple_o);
45454550
}
4546-
kwargs_out = kwargs_in;
4547-
DEAD(kwargs_in);
45484551
}
45494552

45504553
op(_DO_CALL_FUNCTION_EX, (func_st, unused, callargs_st, kwargs_st if (oparg & 1) -- result)) {
@@ -4720,8 +4723,7 @@ dummy_func(
47204723

47214724
inst(FORMAT_WITH_SPEC, (value, fmt_spec -- res)) {
47224725
PyObject *res_o = PyObject_Format(PyStackRef_AsPyObjectBorrow(value), PyStackRef_AsPyObjectBorrow(fmt_spec));
4723-
PyStackRef_CLOSE(value);
4724-
PyStackRef_CLOSE(fmt_spec);
4726+
DECREF_INPUTS();
47254727
ERROR_IF(res_o == NULL, error);
47264728
res = PyStackRef_FromPyObjectSteal(res_o);
47274729
}

0 commit comments

Comments
 (0)