| 1 | <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> |
| 2 | <html> |
| 3 | <head> |
| 4 | <link rel="STYLESHEET" href="ext.css" type='text/css' /> |
| 5 | <link rel="SHORTCUT ICON" href="../icons/pyfav.png" type="image/png" /> |
| 6 | <link rel='start' href='../index.html' title='Python Documentation Index' /> |
| 7 | <link rel="first" href="ext.html" title='Extending and Embedding the Python Interpreter' /> |
| 8 | <link rel='contents' href='contents.html' title="Contents" /> |
| 9 | <link rel='last' href='about.html' title='About this document...' /> |
| 10 | <link rel='help' href='about.html' title='About this document...' /> |
| 11 | <link rel="next" href="nullPointers.html" /> |
| 12 | <link rel="prev" href="ownershipRules.html" /> |
| 13 | <link rel="parent" href="refcounts.html" /> |
| 14 | <link rel="next" href="nullPointers.html" /> |
| 15 | <meta name='aesop' content='information' /> |
| 16 | <title>1.10.3 Thin Ice |
| 17 | </title> |
| 18 | </head> |
| 19 | <body> |
| 20 | <DIV CLASS="navigation"> |
| 21 | <div id='top-navigation-panel' xml:id='top-navigation-panel'> |
| 22 | <table align="center" width="100%" cellpadding="0" cellspacing="2"> |
| 23 | <tr> |
| 24 | <td class='online-navigation'><a rel="prev" title="1.10.2 Ownership Rules" |
| 25 | href="ownershipRules.html"><img src='../icons/previous.png' |
| 26 | border='0' height='32' alt='Previous Page' width='32' /></A></td> |
| 27 | <td class='online-navigation'><a rel="parent" title="1.10 Reference Counts" |
| 28 | href="refcounts.html"><img src='../icons/up.png' |
| 29 | border='0' height='32' alt='Up One Level' width='32' /></A></td> |
| 30 | <td class='online-navigation'><a rel="next" title="1.10.4 NULL Pointers" |
| 31 | href="nullPointers.html"><img src='../icons/next.png' |
| 32 | border='0' height='32' alt='Next Page' width='32' /></A></td> |
| 33 | <td align="center" width="100%">Extending and Embedding the Python Interpreter</td> |
| 34 | <td class='online-navigation'><a rel="contents" title="Table of Contents" |
| 35 | href="contents.html"><img src='../icons/contents.png' |
| 36 | border='0' height='32' alt='Contents' width='32' /></A></td> |
| 37 | <td class='online-navigation'><img src='../icons/blank.png' |
| 38 | border='0' height='32' alt='' width='32' /></td> |
| 39 | <td class='online-navigation'><img src='../icons/blank.png' |
| 40 | border='0' height='32' alt='' width='32' /></td> |
| 41 | </tr></table> |
| 42 | <div class='online-navigation'> |
| 43 | <b class="navlabel">Previous:</b> |
| 44 | <a class="sectref" rel="prev" href="ownershipRules.html">1.10.2 Ownership Rules</A> |
| 45 | <b class="navlabel">Up:</b> |
| 46 | <a class="sectref" rel="parent" href="refcounts.html">1.10 Reference Counts</A> |
| 47 | <b class="navlabel">Next:</b> |
| 48 | <a class="sectref" rel="next" href="nullPointers.html">1.10.4 NULL Pointers</A> |
| 49 | </div> |
| 50 | <hr /></div> |
| 51 | </DIV> |
| 52 | <!--End of Navigation Panel--> |
| 53 | |
| 54 | <H2><A NAME="SECTION0031030000000000000000"></A><A NAME="thinIce"></A> |
| 55 | <BR> |
| 56 | 1.10.3 Thin Ice |
| 57 | |
| 58 | </H2> |
| 59 | |
| 60 | <P> |
| 61 | There are a few situations where seemingly harmless use of a borrowed |
| 62 | reference can lead to problems. These all have to do with implicit |
| 63 | invocations of the interpreter, which can cause the owner of a |
| 64 | reference to dispose of it. |
| 65 | |
| 66 | <P> |
| 67 | The first and most important case to know about is using |
| 68 | <tt class="cfunction">Py_DECREF()</tt> on an unrelated object while borrowing a |
| 69 | reference to a list item. For instance: |
| 70 | |
| 71 | <P> |
| 72 | <div class="verbatim"><pre> |
| 73 | void |
| 74 | bug(PyObject *list) |
| 75 | { |
| 76 | PyObject *item = PyList_GetItem(list, 0); |
| 77 | |
| 78 | PyList_SetItem(list, 1, PyInt_FromLong(0L)); |
| 79 | PyObject_Print(item, stdout, 0); /* BUG! */ |
| 80 | } |
| 81 | </pre></div> |
| 82 | |
| 83 | <P> |
| 84 | This function first borrows a reference to <code>list[0]</code>, then |
| 85 | replaces <code>list[1]</code> with the value <code>0</code>, and finally prints |
| 86 | the borrowed reference. Looks harmless, right? But it's not! |
| 87 | |
| 88 | <P> |
| 89 | Let's follow the control flow into <tt class="cfunction">PyList_SetItem()</tt>. The list |
| 90 | owns references to all its items, so when item 1 is replaced, it has |
| 91 | to dispose of the original item 1. Now let's suppose the original |
| 92 | item 1 was an instance of a user-defined class, and let's further |
| 93 | suppose that the class defined a <tt class="method">__del__()</tt> method. If this |
| 94 | class instance has a reference count of 1, disposing of it will call |
| 95 | its <tt class="method">__del__()</tt> method. |
| 96 | |
| 97 | <P> |
| 98 | Since it is written in Python, the <tt class="method">__del__()</tt> method can execute |
| 99 | arbitrary Python code. Could it perhaps do something to invalidate |
| 100 | the reference to <code>item</code> in <tt class="cfunction">bug()</tt>? You bet! Assuming |
| 101 | that the list passed into <tt class="cfunction">bug()</tt> is accessible to the |
| 102 | <tt class="method">__del__()</tt> method, it could execute a statement to the effect of |
| 103 | "<tt class="samp">del list[0]</tt>", and assuming this was the last reference to that |
| 104 | object, it would free the memory associated with it, thereby |
| 105 | invalidating <code>item</code>. |
| 106 | |
| 107 | <P> |
| 108 | The solution, once you know the source of the problem, is easy: |
| 109 | temporarily increment the reference count. The correct version of the |
| 110 | function reads: |
| 111 | |
| 112 | <P> |
| 113 | <div class="verbatim"><pre> |
| 114 | void |
| 115 | no_bug(PyObject *list) |
| 116 | { |
| 117 | PyObject *item = PyList_GetItem(list, 0); |
| 118 | |
| 119 | Py_INCREF(item); |
| 120 | PyList_SetItem(list, 1, PyInt_FromLong(0L)); |
| 121 | PyObject_Print(item, stdout, 0); |
| 122 | Py_DECREF(item); |
| 123 | } |
| 124 | </pre></div> |
| 125 | |
| 126 | <P> |
| 127 | This is a true story. An older version of Python contained variants |
| 128 | of this bug and someone spent a considerable amount of time in a C |
| 129 | debugger to figure out why his <tt class="method">__del__()</tt> methods would fail... |
| 130 | |
| 131 | <P> |
| 132 | The second case of problems with a borrowed reference is a variant |
| 133 | involving threads. Normally, multiple threads in the Python |
| 134 | interpreter can't get in each other's way, because there is a global |
| 135 | lock protecting Python's entire object space. However, it is possible |
| 136 | to temporarily release this lock using the macro |
| 137 | Py_BEGIN_ALLOW_THREADS, and to re-acquire it using |
| 138 | Py_END_ALLOW_THREADS. This is common around blocking |
| 139 | I/O calls, to let other threads use the processor while waiting for |
| 140 | the I/O to complete. Obviously, the following function has the same |
| 141 | problem as the previous one: |
| 142 | |
| 143 | <P> |
| 144 | <div class="verbatim"><pre> |
| 145 | void |
| 146 | bug(PyObject *list) |
| 147 | { |
| 148 | PyObject *item = PyList_GetItem(list, 0); |
| 149 | Py_BEGIN_ALLOW_THREADS |
| 150 | ...some blocking I/O call... |
| 151 | Py_END_ALLOW_THREADS |
| 152 | PyObject_Print(item, stdout, 0); /* BUG! */ |
| 153 | } |
| 154 | </pre></div> |
| 155 | |
| 156 | <P> |
| 157 | |
| 158 | <DIV CLASS="navigation"> |
| 159 | <div class='online-navigation'> |
| 160 | <p></p><hr /> |
| 161 | <table align="center" width="100%" cellpadding="0" cellspacing="2"> |
| 162 | <tr> |
| 163 | <td class='online-navigation'><a rel="prev" title="1.10.2 Ownership Rules" |
| 164 | href="ownershipRules.html"><img src='../icons/previous.png' |
| 165 | border='0' height='32' alt='Previous Page' width='32' /></A></td> |
| 166 | <td class='online-navigation'><a rel="parent" title="1.10 Reference Counts" |
| 167 | href="refcounts.html"><img src='../icons/up.png' |
| 168 | border='0' height='32' alt='Up One Level' width='32' /></A></td> |
| 169 | <td class='online-navigation'><a rel="next" title="1.10.4 NULL Pointers" |
| 170 | href="nullPointers.html"><img src='../icons/next.png' |
| 171 | border='0' height='32' alt='Next Page' width='32' /></A></td> |
| 172 | <td align="center" width="100%">Extending and Embedding the Python Interpreter</td> |
| 173 | <td class='online-navigation'><a rel="contents" title="Table of Contents" |
| 174 | href="contents.html"><img src='../icons/contents.png' |
| 175 | border='0' height='32' alt='Contents' width='32' /></A></td> |
| 176 | <td class='online-navigation'><img src='../icons/blank.png' |
| 177 | border='0' height='32' alt='' width='32' /></td> |
| 178 | <td class='online-navigation'><img src='../icons/blank.png' |
| 179 | border='0' height='32' alt='' width='32' /></td> |
| 180 | </tr></table> |
| 181 | <div class='online-navigation'> |
| 182 | <b class="navlabel">Previous:</b> |
| 183 | <a class="sectref" rel="prev" href="ownershipRules.html">1.10.2 Ownership Rules</A> |
| 184 | <b class="navlabel">Up:</b> |
| 185 | <a class="sectref" rel="parent" href="refcounts.html">1.10 Reference Counts</A> |
| 186 | <b class="navlabel">Next:</b> |
| 187 | <a class="sectref" rel="next" href="nullPointers.html">1.10.4 NULL Pointers</A> |
| 188 | </div> |
| 189 | </div> |
| 190 | <hr /> |
| 191 | <span class="release-info">Release 2.4.2, documentation updated on 28 September 2005.</span> |
| 192 | </DIV> |
| 193 | <!--End of Navigation Panel--> |
| 194 | <ADDRESS> |
| 195 | See <i><a href="about.html">About this document...</a></i> for information on suggesting changes. |
| 196 | </ADDRESS> |
| 197 | </BODY> |
| 198 | </HTML> |