mattip
commented
3 weeks ago It can be tricky to manage object lifetimes when one mixes C and Python like CFFI allows you to do.
The C function handle_pair_t children(handle_t) should just return the handles to the two “child nodes” as a pair
You must explicitly keep the return value alive, otherwise the GC will destroy it. Making it explicit may be clearer, and suggests a path to solving the problem. I think this would solve the problem, does it make sense?
def children(handle):
ret = ffi.new("handle_t[1]")
pair = children(handle)
# What keeps `pair` alive?
# Copy the data, so when pair is collected the data will still be valid
ret[0] = pair.first
return ret
nhusung
arigo
I’m not sure whether this is a CFFI or a CPython bug, but recently this issue was reported: https://github.com/OxiDD/oxidd/issues/23. Today, I created a stripped-down version of the CFFI-based bindings at https://github.com/nhusung/cffi-cpython-bug. On the C side, we have some handle type
handle_t, which is a pair of a pointer and an index. Conceptually, these handles refer to binary nodes, but in the example I just use arbitrary values. The C functionhandle_pair_t children(handle_t)should just return the handles to the two “child nodes” as a pair, but the bindings appear to modify the Python object corresponding to the handle passed as argument tochildren(). (Note that the C function takes the handle by value, so it cannot be the culprit.) Here is the Python test code:Output (the line between “before” and “after” is from the C code):
I could reproduce this with CFFI 1.17.1 on both CPython 3.10.12 (Ubuntu 22.04) and CPython 3.12.7 (Fedora 40). PyPy does not appear to be affected (tested with PyPy 7.3.15 / Python 3.10.13).
With GCC’s address sanitizer, I get the following error message directly after
before: (<cdata 'void *' 0x7efec7aa0760>, 21):