gh-150868: Fix incorrect specialized deallocation of float subclasses in sum()#150869
Open
opale-c wants to merge 1 commit into
Open
gh-150868: Fix incorrect specialized deallocation of float subclasses in sum()#150869opale-c wants to merge 1 commit into
opale-c wants to merge 1 commit into
Conversation
Fix incorrect specialized deallocation of float subclasses in sum()
In the complex-number fast path of builtin_sum_impl ( Python/bltinmodule.c ), items are tested with PyFloat_Check() but then released with _Py_DECREF_SPECIALIZED(item, _PyFloat_ExactDealloc) . PyFloat_Check() also matches float subclasses, whereas _PyFloat_ExactDealloc is only valid for exact float objects. As a result, when summing instances of a float subclass into a complex start value, the subclass instances are deallocated as exact floats, bypassing their real tp_dealloc (instance __dict__ , weakref, and GC cleanup). This can leak memory and leave the GC in an inconsistent state.
The adjacent float fast path already guards the same specialized dealloc with PyFloat_CheckExact() ; this change brings the complex path in line by using PyFloat_CheckExact() as well. Subclass instances then fall through to the generic PyNumber_Add path with a normal Py_DECREF , preserving numeric behavior while fixing the deallocation.
Reproducer:
class F(float):
pass
sum([F(1.0), F(2.0)], 0j) # subclass instances were freed as exact floats
Change: in the complex branch of builtin_sum_impl , replace PyFloat_Check(item) with PyFloat_CheckExact(item) (one line).
|
The following commit authors need to sign the Contributor License Agreement: |
This comment was marked as resolved.
This comment was marked as resolved.
skirpichev
approved these changes
Jun 3, 2026
Member
|
@opale-c, could you please sign CLA? |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
In the complex-number fast path of
builtin_sum_impl(Python/bltinmodule.c),items are tested with
PyFloat_Check()but then released with_Py_DECREF_SPECIALIZED(item, _PyFloat_ExactDealloc).PyFloat_Check()alsomatches
floatsubclasses, whereas_PyFloat_ExactDeallocis only valid forexact
floatobjects. As a result, when summing instances of afloatsubclass into a complex start value, the subclass instances are deallocated as
exact floats, bypassing their real
tp_dealloc(instance__dict__, weakref,and GC cleanup). This can leak memory and leave the GC in an inconsistent state.
The adjacent float fast path already guards the same specialized dealloc with
PyFloat_CheckExact(); this change brings the complex path in line by usingPyFloat_CheckExact()as well. Subclass instances then fall through to thegeneric
PyNumber_Addpath with a normalPy_DECREF, preserving numericbehavior while fixing the deallocation.
Reproducer
Change: in the complex branch of
builtin_sum_impl, replacePyFloat_Check(item)withPyFloat_CheckExact(item)(one line).