Fix GC TOCTOU race in collect_inner referent traversal (#7511) · RustPython/RustPython@af0c252 · GitHub
Skip to content

Commit af0c252

Browse files
authored
Fix GC TOCTOU race in collect_inner referent traversal (#7511)
Pre-compute referent pointers once per object in step 3 and reuse them in step 4 (BFS reachability). Previously, gc_get_referent_ptrs() was called independently in both steps. If a dict's write lock state changed between the two calls (e.g., held by another thread during one traversal but not the other), the two traversals could return different results. This caused live objects to be incorrectly classified as unreachable and cleared by GC.
1 parent f42ffd6 commit af0c252

1 file changed

Lines changed: 15 additions & 1 deletion

File tree

crates/vm/src/gc_state.rs

Lines changed: 15 additions & 1 deletion

0 commit comments

Comments
 (0)