gh-118272: set stacktop to 0 before freeing contents, to avoid access to invalid objects during GC (#118478)

iritkatriel · web-flow · commit 6763bfcc0fba · 2024-05-01T21:51:40.000+01:00
diff --git a/Python/frame.c b/Python/frame.c
@@ -98,10 +98,11 @@ void
 _PyFrame_ClearLocals(_PyInterpreterFrame *frame)
 {
     assert(frame->stacktop >= 0);
-    for (int i = 0; i < frame->stacktop; i++) {
+    int stacktop = frame->stacktop;
+    frame->stacktop = 0;
+    for (int i = 0; i < stacktop; i++) {
         Py_XDECREF(frame->localsplus[i]);
     }
-    frame->stacktop = 0;
     Py_CLEAR(frame->f_locals);
 }
 

Original file line number	Diff line number	Diff line change
`@@ -98,10 +98,11 @@ void`
`98`	`98`	`_PyFrame_ClearLocals(_PyInterpreterFrame *frame)`
`99`	`99`	`{`
`100`	`100`	`assert(frame->stacktop >= 0);`
`101`		`- for (int i = 0; i < frame->stacktop; i++) {`
	`101`	`+ int stacktop = frame->stacktop;`
	`102`	`+ frame->stacktop = 0;`
	`103`	`+ for (int i = 0; i < stacktop; i++) {`
`102`	`104`	`Py_XDECREF(frame->localsplus[i]);`
`103`	`105`	`}`
`104`		`- frame->stacktop = 0;`
`105`	`106`	`Py_CLEAR(frame->f_locals);`
`106`	`107`	`}`
`107`	`108`