-
-
Notifications
You must be signed in to change notification settings - Fork 33.9k
gh-142883: avoid crash when __index__ changes array type during multiplication. #143776
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
gh-142883: avoid crash when __index__ changes array type during multiplication. #143776
Conversation
This comment was marked as resolved.
This comment was marked as resolved.
This comment was marked as resolved.
This comment was marked as resolved.
Co-authored-by: AN Long <aisk@users.noreply.github.com>
Co-authored-by: AN Long <aisk@users.noreply.github.com>
priyanshu2282-cyber
commented
Jan 13, 2026
Thanks, fixed.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I'm not very sure about this, but I'm wondering should we increase the refcount for type_before, because we will call user's code next, thus it may be GCed (like user delete the type in __index__)?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Yes, that makes sense. Since we call user code next, the type could indeed be GCed if its last reference is dropped. I’ve updated the code to INCREF type_before before calling user code and DECREF it on all exit paths. I also ran the regression test locally and it passes.
@picnixz
picnixz
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Why do we need to make those changes in typeobject? is it only relevant for objects implementing __mul__? or is it relevant only to array.__mul__?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Why is it in the numeric tower??? it has nothing to do with numeric tower.
A Python core developer has requested some changes be made to your pull request before we can consider merging it. If you could please address their requests along with any other requests in other reviews from core developers that would be appreciated.
Once you have made the requested changes, please leave a comment on this pull request containing the phrase I have made the requested changes; please review again. I will then notify any core developers who have left a review that you're ready for them to take another look at this pull request.
Uh oh!
There was an error while loading. Please reload this page.
__index__can change the array’s class during multiplication. After that,the old function is still called, which can cause a crash. This adds a
check to avoid that and raises TypeError instead.
A regression test is also added.
array_repeatvia re-entrant__index__during array multiplication #142883