Skip to content

gh-157526: Call __instancecheck__ and __subclasscheck__ without creating a bound method - #157670

Open
kumaraditya303 wants to merge 2 commits into
python:mainfrom
kumaraditya303:isinstance-special-method-call
Open

kumaraditya303 wants to merge 2 commits into
python:mainfrom
kumaraditya303:isinstance-special-method-call

Conversation

@kumaraditya303

@kumaraditya303 kumaraditya303 commented Sep 17, 2026

Copy link
Copy Markdown
Contributor

This reduces contention when calling these methods used by ABC on free-threading.

Skipping news for individual PR, will add one after all work is complete.

@mpage mpage left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good. There's one issue with the call to _PyObject_LookupSpecialMethod that I think we need to deal with though.

Comment thread Objects/abstract.c Outdated
Comment on lines +2648 to +2649
int found = _PyObject_LookupSpecialMethod(name, method_and_self);
cref.ref = method_and_self[0];

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't think this is safe. We need method_and_self[0] to be a stackref that the GC is aware of (i.e. a _PyCStackRef) before we call _PyObject_LookupSpecialMethod because _PyObject_LookupSpecialMethod stores into it and then may invoke a descriptor. It's possible that the reference stored in method_and_self[0] is the only reference to the object. In that case, if the descriptor invocation triggers the GC, the GC will reclaim the reference if its unaware of the stackref. Subsequent attempts to use the reference would be a UAF.

One potential solution is to change the signature of _PyObject_LookupSpecialMethod to be int _PyObject_LookupSpecialMethod(PyObject *attr, _PyStackRef *method, _PyStackRef *self) (and update the implementation accordingly). Then we could pass cref as method.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks, fixed it

@bedevere-app

bedevere-app Bot commented Sep 18, 2026

Copy link
Copy Markdown

When you're done making the requested changes, leave the comment: I have made the requested changes; please review again.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants