Skip to content

fix cases of incorrect allocator or deallocator inheritance - #6559

Open
davidhewitt wants to merge 4 commits into
PyO3:mainfrom
davidhewitt:explicit-tp-alloc
Open

davidhewitt wants to merge 4 commits into
PyO3:mainfrom
davidhewitt:explicit-tp-alloc

Conversation

@davidhewitt

Copy link
Copy Markdown
Member

This PR fixes two cases of incorrect inheritance of tp_alloc or tp_free causing crashes with various #[pyclass] types:

  • We weren't previously explicitly setting the allocator, except for #[pyclass(freelist)] and invalid base allocators might not allocate space for the Rust data (this happens to be the case for datetime.time, for example). This could be viewed as a bug in the base allocator but I think it doesn't hurt for us to be defensive and select PyType_GenericAlloc explicitly (this is the documented behaviour for heap types but not what happens in practice, see also documentation of tp_alloc and tp_free inheritance for heap types is incorrect python/cpython#160749).

  • For #[pyclass(freelist)] struct Base, an inherited #[pyclass] struct Child would accidentally inherit Base deallocator and corrupt the base freelist with a Child object.

Whilst fixing these cases I decided to make TP_ALLOC and TP_FREE constants inside the PyClassImpl trait, which allows for the most concise generated code while setting the defaults & allowing the freelist override.

Although both are nasty crashes, I think they would be discovered during development so not CVE-worthy.

Bug discovery credit OpenAI (OutboundDisclosures@openai.com)

@codspeed

codspeed Bot commented Oct 27, 2026

Copy link
Copy Markdown

Merging this PR will degrade performance by 17.55%

1 warning

⚠️ Base and head ran on different runner types

Some benchmarks with significant performance changes were compared across different runner types, so the changes might not come from the code. Run base and head on the same runner type, or use CodSpeed Macro Runners for more stable results.

Learn more about Macro Runners

Open the report in CodSpeed to investigate

❌ 2 regressed benchmarks
✅ 141 untouched benchmarks
⏩ 6 skipped benchmarks1

Warning

Please fix the performance issues or acknowledge them on CodSpeed.

Performance Changes

Benchmark BASE HEAD Efficiency
❌ into_bigint_big_negative 4.2 µs 5.4 µs -22.2%
❌ into_biguint_big 4.2 µs 4.8 µs -12.63%

Tip

Investigate this regression by commenting @codspeedbot fix this regression on this PR, or directly use the CodSpeed MCP with your agent.


Comparing davidhewitt:explicit-tp-alloc (68ad4b3) with main (26f9ec8)

Open in CodSpeed

Footnotes

  1. 6 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

@Icxolu Icxolu left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@bschoenmaeckers
bschoenmaeckers added this pull request to the merge queue Oct 28, 2026
@github-merge-queue
github-merge-queue Bot removed this pull request from the merge queue due to failed status checks Oct 28, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants