From 1fa2a1a74d99e83864dbb6eeed6e80df58d1d1c9 Mon Sep 17 00:00:00 2001 From: Campbell Barton Date: Tue, 12 Mar 2024 16:37:36 +1100 Subject: [PATCH] Fix error freeing bpy_struct sub-classes WITH_PYTHON_SECURITY enabled Python's behavior changed since this feature was added causing the object to be tracked when freed by Python's subtype_dealloc even if Blender has not tracked the data. Detect this case and untrack the object before freeing. --- source/blender/python/intern/bpy_rna.cc | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/source/blender/python/intern/bpy_rna.cc b/source/blender/python/intern/bpy_rna.cc index 97ca03f48f4..b6c658a52b5 100644 --- a/source/blender/python/intern/bpy_rna.cc +++ b/source/blender/python/intern/bpy_rna.cc @@ -1173,6 +1173,14 @@ static void pyrna_struct_dealloc(BPy_StructRNA *self) PyObject_GC_UnTrack(self); pyrna_struct_clear(self); } + else { + PyTypeObject *base = Py_TYPE(self)->tp_base; + /* Python temporarily tracks these types when freeing, see Python bug 26617. */ + if (base && PyType_IS_GC(base)) { + PyObject_GC_UnTrack(self); + } + BLI_assert(!PyObject_GC_IsTracked((PyObject *)self)); + } #endif /* !USE_PYRNA_STRUCT_REFERENCE */ /* NOTE: for subclassed PyObjects calling PyObject_DEL() directly crashes. */