Fix debug-mode segfault when the asyncgen finalizer hook runs during frame teardown

The asyncgen finalizer hook can be invoked by a dealloc while CPython is
mid-way through clearing the current interpreter frame
(_PyEval_FrameClearAndPop -> PyObject_CallFinalizerFromDealloc ->
_asyncgen_finalizer_hook). In debug mode the hook's call_soon_threadsafe
creates a Handle whose source-traceback capture calls sys._getframe(),
which dereferences the half-cleared frame (garbage frame_obj) and
segfaults the interpreter.

Observed in production on CPython 3.13.14 under streaming HTTP load
(starlette request.stream() async generators being GC'd under
cancellation churn): worker SIGSEGV within seconds of enabling
loop.set_debug(True). Reproduces on 3.13 and 3.14, x86_64 and aarch64.

Fix: skip source-traceback capture (per-thread flag) for handles created
from the finalizer hook -- the traceback of a GC point is meaningless for
debugging anyway -- and make extract_stack() tolerate AttributeError/
ValueError/TypeError from walk_stack, which py3.14 can raise when
non-frame objects (e.g. _asyncio.TaskStepMethWrapper) appear in the
stack (#715).

Author: David Sacerdote

uvloop/cbhandles.pyx

@@ -416,10 +416,21 @@ cdef new_MethodHandle3(Loop loop, str name, method3_t callback, object context,
     return handle
 
 
+# Set (per-thread) while handles are created from interpreter finalization
+# contexts, where walking the frame stack is not safe: the asyncgen
+# finalizer hook can be invoked by a dealloc while CPython is mid-way
+# through clearing the current frame (_PyEval_FrameClearAndPop ->
+# PyObject_CallFinalizerFromDealloc), and sys._getframe() then dereferences
+# the half-cleared frame and crashes the interpreter.
+_extract_stack_disabled = threading_local()
+
+
 cdef extract_stack():
     """Replacement for traceback.extract_stack() that only does the
     necessary work for asyncio debug mode.
     """
+    if getattr(_extract_stack_disabled, 'flag', False):
+        return None
     try:
         f = sys_getframe()
     # sys._getframe() might raise ValueError if being called without a frame, e.g.
@@ -433,6 +444,11 @@ cdef extract_stack():
         stack = tb_StackSummary.extract(tb_walk_stack(f),
                                         limit=DEBUG_STACK_DEPTH,
                                         lookup_lines=False)
+    except (AttributeError, ValueError, TypeError):
+        # The stack may contain non-frame objects (py3.14 can surface
+        # _asyncio.TaskStepMethWrapper to walk_stack; see #715) or be torn
+        # when invoked from finalization contexts.
+        return None
     finally:
         f = None
 

uvloop/includes/stdlib.pxi

@@ -139,6 +139,7 @@ cdef int ssl_SSL_ERROR_WANT_WRITE = ssl.SSL_ERROR_WANT_WRITE
 cdef int ssl_SSL_ERROR_SYSCALL = ssl.SSL_ERROR_SYSCALL
 
 cdef threading_Thread = threading.Thread
+cdef threading_local = threading.local
 cdef threading_main_thread = threading.main_thread
 
 cdef int subprocess_PIPE = subprocess.PIPE

uvloop/loop.pyx

@@ -3195,7 +3195,16 @@ cdef class Loop:
     def _asyncgen_finalizer_hook(self, agen):
         self._asyncgens.discard(agen)
         if not self.is_closed():
-            self.call_soon_threadsafe(self.create_task, agen.aclose())
+            # This hook can run from a dealloc while the interpreter is
+            # mid-way through clearing a frame; debug-mode source-traceback
+            # capture must not walk frames in that window (it segfaults;
+            # see extract_stack). The traceback of a GC point is
+            # meaningless for debugging anyway.
+            _extract_stack_disabled.flag = True
+            try:
+                self.call_soon_threadsafe(self.create_task, agen.aclose())
+            finally:
+                _extract_stack_disabled.flag = False
 
     def _asyncgen_firstiter_hook(self, agen):
         if self._asyncgens_shutdown_called: