clear out f_gen during generator finalization (closes #27812)

Patch from Armin Rigo.

diff --git a/Misc/NEWS b/Misc/NEWS
index 8558db4df378da9c7617f2c57e662011984016db..4b1899938d1f633c53a90b446bb96997bb692161 100644 (file)
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -10,6 +10,9 @@ Release date: TBA
 Core and Builtins
 -----------------
 
+- Issue #27812: Properly clear out a generator's frame's backreference to the
+  generator to prevent crashes in frame.clear().
+
 - Issue #27811: Fix a crash when a coroutine that has not been awaited is
   finalized with warnings-as-errors enabled.
 

diff --git a/Objects/genobject.c b/Objects/genobject.c
index a9ea5c24786974b93ac22183f00963836fb99ef4..01c59c24a968c717806fe18f23b2975c22fe226b 100644 (file)
--- a/Objects/genobject.c
+++ b/Objects/genobject.c
@@ -71,7 +71,10 @@ gen_dealloc(PyGenObject *gen)
         return;                     /* resurrected.  :( */
 
     _PyObject_GC_UNTRACK(self);
-    Py_CLEAR(gen->gi_frame);
+    if (gen->gi_frame != NULL) {
+        gen->gi_frame->f_gen = NULL;
+        Py_CLEAR(gen->gi_frame);
+    }
     Py_CLEAR(gen->gi_code);
     Py_CLEAR(gen->gi_name);
     Py_CLEAR(gen->gi_qualname);