pybind / pybind/pybind11

virtual methods: garbage collected trampolines may corrupt future trampoline classes?

Open
#1,923 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
C++
Stars
18k
Forks
2.3k
Avg merge
5d 17h
Merged PRs (30d)
10

Description

Issue description

When trying to investigate #1922, I accidentally reproduced the wrong thing, but ended up finding another bug. I haven't root-caused this, but this is the general breakdown:

  • Define a base class + trampoline and bind those in C++, and then make derived class in Python which inherits from it.
  • You should be able to instantiate both of them (if they are default-constructible)
  • Delete those classes and garbage collect (and double-check to ensure they've been deleted)
  • Define another base class + trampoline in C++, and then a derived class in Python
  • Try constructing the new derived class; you may end up getting TypeError: __init__(self, ...) called with invalid `self` argument.

Reproducible example code

https://github.com/EricCousineau-TRI/pybind11/commit/c11472dec0e81b5f4842b54a1e19bae2f17f5773

I'm running this on Ubuntu 18.04, using Python 3.6.8.

My generic guess is that this is due to the use of hashing type.ptr(), which cause a hash collision when an object's memory location is reused after it's deleted (similar to #1922).

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the reproducible example in commit c11472dec0e81b5f4842b54a1e19bae2f17f5773 and follow the reported sequence of creating, deleting, and garbage-collecting trampoline classes. Confirm the failure when constructing the later Python-derived class, then identify and fix the cause so that construction remains valid after earlier classes are collected.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp, python
Domain
api
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.