INCREF/DECREFs around the rich comparison needs tests

[rhettinger]

BPO	40489
Nosy	@rhettinger, @serhiy-storchaka, @corona10
PRs	bpo-40489: Add test case for dict contain use after free #19906

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = 'https://github.com/serhiy-storchaka'
closed_at = <Date 2020-05-05.06:08:07.226>
created_at = <Date 2020-05-03.21:41:29.388>
labels = ['interpreter-core']
title = 'INCREF/DECREFs around the rich comparison needs tests'
updated_at = <Date 2020-05-05.06:08:07.225>
user = 'https://github.com/rhettinger'

bugs.python.org fields:

activity = <Date 2020-05-05.06:08:07.225>
actor = 'rhettinger'
assignee = 'serhiy.storchaka'
closed = True
closed_date = <Date 2020-05-05.06:08:07.226>
closer = 'rhettinger'
components = ['Interpreter Core']
creation = <Date 2020-05-03.21:41:29.388>
creator = 'rhettinger'
dependencies = []
files = []
hgrepos = []
issue_num = 40489
keywords = ['patch']
message_count = 7.0
messages = ['367997', '368033', '368049', '368050', '368052', '368072', '368107']
nosy_count = 3.0
nosy_names = ['rhettinger', 'serhiy.storchaka', 'corona10']
pr_nums = ['19906']
priority = 'normal'
resolution = 'fixed'
stage = 'resolved'
status = 'closed'
superseder = None
type = None
url = 'https://bugs.python.org/issue40489'
versions = []

[rhettinger]

In Objects/dictobject.c, if I remove the INCREF/DECREF pair around PyObject_RichCompareBool(), all the tests still pass:

•       Py_INCREF(startkey);
        cmp = PyObject_RichCompareBool(startkey, key, Py_EQ);
  

•       Py_DECREF(startkey);
  

It would be nice to have tests demonstrating why it is necessary. IIRC the reason is that an object could have a custom comparison that clears the enclosing container and frees the element during the comparison.

Also, it would be nice if PyObject_RichCompareBool() could be redesigned to not fail if a borrowed reference gets deallocated while the function is running. The incref and decref occur on a hot path, and it is unfortunate that they cause extra writes to objects scattered all over memory, likely causing a lot of cache misses in real programs.

[serhiy-storchaka]

See bpo-1517.

[corona10]

I can crash python interpreter with few lines of code when if we remove those codes.

class S(str):

    def __eq__(self, other):
        d.clear()
        return NotImplemented

    def __hash__(self):
        return hash('test')

d = {S(): 'value'}
'test' in d

[corona10]

Would you like to add a test for this case?

[corona10]

Would you like to add a test for this case?

Oh, I mean, is it good to add a test for this case?

[corona10]

New changeset 785f5e6 by Dong-hee Na in branch 'master':
bpo-40489: Add test case for dict contain use after free (GH-19906)
785f5e6

[rhettinger]

Thank you.