Repository navigation
Crash in _asyncio._swap_current_task due to improper reference counting #105987
Description
First appeared in a474e04, where given function was introduced.
Repro:
import _asyncio
class DummyLoop:
pass
class DummyTask:
pass
l = DummyLoop()
_asyncio._swap_current_task(l, DummyTask())
t = _asyncio._swap_current_task(l, None)Output:
Modules/gcmodule.c:461: visit_decref: Assertion "!_PyObject_IsFreed(op)" failed
Enable tracemalloc to get the memory block allocation traceback
object address : 0x7fedad081130
object refcount : 1
object type : 0x55f665a81fe0
object type name: dict
object repr : Segmentation fault (core dumped)
I'm working on a fix.
Linked PRs
- gh-105987: Fix reference counting issue in
_asyncio._swap_current_task#105989 - [3.12] gh-105987: Fix reference counting issue in `_asyncio._swap_cur… #106099
- gh-105987: unskip
test_issue105987fromtest_asyncio.test_eager_task_factory#139538 - [3.14] gh-105987: unskip
test_issue105987fromtest_asyncio.test_eager_task_factory(GH-139538) #139539
Activity
gh-105987: Fix reference counting issue in `_asyncio._swap_current_ta…
[3.12] pythongh-105987: Fix reference counting issue in `_asyncio._sw…
[3.12] gh-105987: Fix reference counting issue in `_asyncio._swap_cur… (
fix lower bound on CVE-2023-38898
vstinner commentedon Oct 2, 2025
@kumaraditya303: test_issue105987() of test_asyncio.test_eager_task_factory is skipped since February, since commit 09fe550. What's the status of this test? Should it be fixed or removed?
kumaraditya303 commentedon Oct 3, 2025
Fixed it at #139538, thanks @vstinner for the reminder.
gh-105987: unskip `test_issue105987` from `test_asyncio.test_eager_ta…
pythongh-105987: unskip `test_issue105987` from `test_asyncio.test_ea…
[3.14] gh-105987: unskip `test_issue105987` from `test_asyncio.test_e…
pythongh-105987: unskip `test_issue105987` from `test_asyncio.test_ea…