cpython
cpython copied to clipboard
`tp_doc` switch from `PyObject_Malloc` to `PyMem_Malloc` is not backwards compatible
Bug report
In https://github.com/python/cpython/pull/114574 we switched a number of non-PyObject allocations from PyObject_Malloc
to PyMem_Malloc
, including tp_doc
on PyHeapTypeObject
s.
Unfortunately, this isn't backwards compatible because C-API extensions may allocate tp_doc
contents, which are then freed by CPython in type_dealloc
. For example, pybind11 allocates memory for the docstring using PyObject_MALLOC
. This leads to crashes when using pybind11 in debug builds of Python 3.13: the allocation uses PyObject_MALLOC
, but the memory is freed using PyMem_Free
.
We should consider reverting the change to tp_doc
and figure out a way to allocate the doc in a way that's both safe (in the free-threaded build) and doesn't break backwards compatibility (in the default build).
Some example extensions:
Uses PyObject_Malloc
Uses strdup
We don't document the tp_doc
behavior so some extensions use strdup
, which works fine in release builds (and is thread-safe in the free-threaded build), but probably crashes in debug builds of CPython.
cc @erlend-aasland