Skip to content

Commit 39f987b

Browse files
Fix merge conflicts
1 parent b9a1208 commit 39f987b

1 file changed

Lines changed: 6 additions & 1 deletion

File tree

Objects/typeobject.c

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5697,14 +5697,19 @@ is_dunder_name(PyObject *name)
56975697
static PyObject *
56985698
update_cache(struct type_cache_entry *entry, PyObject *name, unsigned int version_tag, PyObject *value)
56995699
{
5700-
_Py_atomic_store_uint32_relaxed(&entry->version, version_tag);
57015700
_Py_atomic_store_ptr_relaxed(&entry->value, value); /* borrowed */
57025701
assert(_PyASCIIObject_CAST(name)->hash != -1);
57035702
OBJECT_STAT_INC_COND(type_cache_collisions, entry->name != Py_None && entry->name != name);
57045703
// We're releasing this under the lock for simplicity sake because it's always a
57055704
// exact unicode object or Py_None so it's safe to do so.
57065705
PyObject *old_name = entry->name;
57075706
_Py_atomic_store_ptr_relaxed(&entry->name, Py_NewRef(name));
5707+
// We must write the version last to avoid _Py_TryXGetStackRef()
5708+
// operating on an invalid (already deallocated) value inside
5709+
// _PyType_LookupRefAndVersion(). If we write the version first then a
5710+
// reader could pass the "entry_version == type_version" check but could
5711+
// be using the old entry value.
5712+
_Py_atomic_store_uint32_release(&entry->version, version_tag);
57085713
return old_name;
57095714
}
57105715

0 commit comments

Comments
 (0)