Miss Islington (bot) aee90465e5
[3.14] gh-148891: prevent crash in HAMT caused by GC during traverse (GH-148928) (#161592)
gh-148891: prevent crash in HAMT caused by GC during traverse (GH-148928)

`_PyHamt_Assoc` allocates HAMT nodes, which can trigger GC. A weakref callback or finaliser fired during GC could re-enter `contextvar_set`, replacing `ctx->ctx_vars` via `Py_SETREF` and freeing the old HAMT while `_PyHamt_Assoc` was still traversing it, causing a use-after-free.

Hold a strong reference to `ctx->ctx_vars` during the `_PyHamt_Assoc` call, so that a re-entrant free cannot affect the HAMT being traversed.
(cherry picked from commit 1798d4fb3ca0e1cd8f9e6ab0ac99a0a9fb1f7527)

Co-authored-by: Thomas Kowalski <thom.kowa@gmail.com>
2026-11-07 23:57:31 +00:00
..
…
…
…
…
…
…
…
…
…
…
…
…
…
…
…
…
…
…
…
…
…
…
…
…
…
…
…
…
…
…
…

Miscellaneous source files for the main Python shared library