Fix issue

Author: Mohamed Koubaa

hpy/devel/src/runtime/ctx_type.c

@@ -208,8 +208,39 @@ static int _decref_visitor(HPyField *pf, void *arg)
     return 0;
 }
 
-static void hpytype_clear(PyObject *self)
+/* Python 3.13+ requires proper handling of Py_TPFLAGS_MANAGED_DICT.
+ * Types that inherit from object get this flag, and must call
+ * PyObject_VisitManagedDict in tp_traverse and PyObject_ClearManagedDict
+ * in tp_clear/tp_dealloc. Without this, attribute lookup crashes.
+ */
+#if PY_VERSION_HEX >= 0x030D0000
+#define HPY_HAS_MANAGED_DICT 1
+#else
+#define HPY_HAS_MANAGED_DICT 0
+#endif
+
+#if HPY_HAS_MANAGED_DICT
+/* Generic tp_traverse for HPy types that don't define their own HPy_tp_traverse.
+ * This is needed on Python 3.13+ because we need to visit the managed dict.
+ * For types WITH a user-defined traverse, the trampoline calls
+ * call_traverseproc_from_trampoline which handles managed dict. */
+static int hpytype_traverse(PyObject *self, cpy_visitproc visit, void *arg)
+{
+    /* On Python 3.13+, we must visit the managed dict */
+    PyObject_VisitManagedDict(self, visit, arg);
+    /* Visit the type object (required for heap types) */
+    Py_VISIT(Py_TYPE(self));
+    return 0;
+}
+#endif /* HPY_HAS_MANAGED_DICT */
+
+static int hpytype_clear(PyObject *self)
 {
+#if HPY_HAS_MANAGED_DICT
+    /* On Python 3.13+, we must clear the managed dict */
+    PyObject_ClearManagedDict(self);
+#endif
+
     // call tp_traverse on all the HPy types of the hierarchy
     PyTypeObject *tp = Py_TYPE(self);
     PyTypeObject *base = tp;
@@ -223,6 +254,7 @@ static void hpytype_clear(PyObject *self)
         }
         base = base->tp_base;
     }
+    return 0;
 }
 
 /* this is a generic tp_dealloc which we use for all the user-defined HPy
@@ -243,6 +275,13 @@ static void hpytype_dealloc(PyObject *self)
     // decref and clear all the HPyFields
     hpytype_clear(self);
 
+#if HPY_HAS_MANAGED_DICT
+    /* On Python 3.13+, ensure managed dict is cleared before dealloc.
+     * Note: hpytype_clear already calls PyObject_ClearManagedDict, but
+     * calling it again is safe and ensures proper cleanup. */
+    PyObject_ClearManagedDict(self);
+#endif
+
     // call tp_destroy on all the HPy types of the hierarchy
     PyTypeObject *base = tp;
     while(base) {
@@ -668,8 +707,18 @@ create_slot_defs(HPyType_Spec *hpyspec, HPyType_Extra_t *extra,
     hpyslot_count++;        // Py_tp_getset
     if (needs_dealloc)
         hpyslot_count++;        // Py_tp_dealloc
+#if HPY_HAS_MANAGED_DICT
+    /* On Python 3.13+, we always need tp_traverse and tp_clear to handle
+     * the managed dict properly, even for types without user-defined traverse.
+     * If user provides HPy_tp_traverse, their trampoline handles managed dict.
+     * If not, we add hpytype_traverse. Either way, we add hpytype_clear. */
+    if (!has_tp_traverse(hpyspec))
+        hpyslot_count++;    // Py_tp_traverse (only if user didn't provide one)
+    hpyslot_count++;    // Py_tp_clear (always needed on 3.13+)
+#else
     if (has_tp_traverse(hpyspec))
         hpyslot_count++;    // Py_tp_clear
+#endif
 
     // allocate the result PyType_Slot array
     HPy_ssize_t total_slot_count = hpyslot_count + legacy_slot_count;
@@ -824,10 +873,26 @@ create_slot_defs(HPyType_Spec *hpyspec, HPyType_Extra_t *extra,
         result[dst_idx++] = (PyType_Slot){Py_tp_dealloc, (void*)hpytype_dealloc};
     }
 
+#if HPY_HAS_MANAGED_DICT
+    /* On Python 3.13+, we always need tp_traverse and tp_clear to handle
+     * the managed dict properly. Py_TPFLAGS_MANAGED_DICT is inherited from
+     * object, and requires calling PyObject_VisitManagedDict/ClearManagedDict.
+     * If user provides HPy_tp_traverse, their trampoline handles managed dict
+     * via call_traverseproc_from_trampoline. Otherwise, add hpytype_traverse.
+     *
+     * IMPORTANT: Py_TPFLAGS_MANAGED_DICT requires Py_TPFLAGS_HAVE_GC to be set.
+     * Since managed dict is inherited from object, we must ensure HAVE_GC is set. */
+    *flags |= Py_TPFLAGS_HAVE_GC;
+    if (!has_tp_traverse(hpyspec)) {
+        result[dst_idx++] = (PyType_Slot){Py_tp_traverse, (void*)hpytype_traverse};
+    }
+    result[dst_idx++] = (PyType_Slot){Py_tp_clear, (void*)hpytype_clear};
+#else
     // add a tp_clear, if the user provided a tp_traverse
     if (has_tp_traverse(hpyspec)) {
         result[dst_idx++] = (PyType_Slot){Py_tp_clear, (void*)hpytype_clear};
     }
+#endif
 
     // add the NULL sentinel at the end
     result[dst_idx++] = (PyType_Slot){0, NULL};
@@ -956,6 +1021,13 @@ static bool has_tp_traverse(HPyType_Spec *hpyspec)
 
 static bool needs_hpytype_dealloc(HPyType_Spec *hpyspec)
 {
+#if HPY_HAS_MANAGED_DICT
+    /* On Python 3.13+, we always need hpytype_dealloc because we set
+     * Py_TPFLAGS_HAVE_GC for proper managed dict handling. The dealloc
+     * must call PyObject_GC_UnTrack and PyObject_ClearManagedDict. */
+    (void)hpyspec;  /* unused */
+    return true;
+#else
     if (hpyspec->defines != NULL)
         for (int i = 0; hpyspec->defines[i] != NULL; i++) {
             HPyDef *def = hpyspec->defines[i];
@@ -964,6 +1036,7 @@ static bool needs_hpytype_dealloc(HPyType_Spec *hpyspec)
                 return true;
         }
     return false;
+#endif
 }
 
 static int check_have_gc_and_tp_traverse(HPyContext *ctx, HPyType_Spec *hpyspec)
@@ -1585,6 +1658,26 @@ _HPy_HIDDEN int call_traverseproc_from_trampoline(HPyFunc_traverseproc tp_traver
                                                   cpy_visitproc cpy_visit,
                                                   void *cpy_arg)
 {
+    /* Visit the type object (required for heap types on Python 3.9+) */
+#if PY_VERSION_HEX >= 0x03090000
+    {
+        PyObject *_py_type = (PyObject*)Py_TYPE(self);
+        int res = cpy_visit(_py_type, cpy_arg);
+        if (res)
+            return res;
+    }
+#endif
+
+#if HPY_HAS_MANAGED_DICT
+    /* On Python 3.13+, we must visit the managed dict */
+    {
+        int res = PyObject_VisitManagedDict(self, cpy_visit, cpy_arg);
+        if (res)
+            return res;
+    }
+#endif
+
+    /* Now call the user's traverse implementation */
     hpy2cpy_visit_args_t args = { cpy_visit, cpy_arg };
     return tp_traverse(_pyobj_as_struct(self), hpy2cpy_visit, &args);
 }

test/test_type_method_crash.py

@@ -10,12 +10,12 @@
 class TestTypeMethodCrash(HPyTest):
     """
     Reproducer for crash when calling methods on custom types in Universal ABI.
-    
+
     The crash occurs when:
     1. A custom type is created via HPyType_FromSpec
     2. An instance is created via HPy_New
     3. A method (defined via HPyDef_METH) is called on the instance
-    
+
     The crash happens before the method body is entered, suggesting an issue
     in the method dispatch mechanism for Universal ABI.
     """
@@ -28,9 +28,9 @@ def test_simple_noargs_method(self):
             typedef struct {
                 long value;
             } MyObject;
-            
+
             HPyType_HELPERS(MyObject)
-            
+
             HPyDef_SLOT(My_new, HPy_tp_new)
             static HPy My_new_impl(HPyContext *ctx, HPy cls, const HPy *args,
                                    HPy_ssize_t nargs, HPy kw)
@@ -42,26 +42,26 @@ def test_simple_noargs_method(self):
                 obj->value = 42;
                 return h;
             }
-            
+
             HPyDef_METH(My_get_value, "get_value", HPyFunc_NOARGS)
             static HPy My_get_value_impl(HPyContext *ctx, HPy self)
             {
                 MyObject *obj = MyObject_AsStruct(ctx, self);
                 return HPyLong_FromLong(ctx, obj->value);
             }
-            
+
             static HPyDef *My_defines[] = {
                 &My_new,
                 &My_get_value,
                 NULL
             };
-            
+
             static HPyType_Spec My_spec = {
                 .name = "mytest.MyType",
                 .basicsize = sizeof(MyObject),
                 .defines = My_defines,
             };
-            
+
             @EXPORT_TYPE("MyType", My_spec)
             @INIT
         """)
@@ -78,9 +78,9 @@ def test_simple_noargs_method_no_struct_access(self):
             typedef struct {
                 long value;
             } MyObject;
-            
+
             HPyType_HELPERS(MyObject)
-            
+
             HPyDef_SLOT(My_new, HPy_tp_new)
             static HPy My_new_impl(HPyContext *ctx, HPy cls, const HPy *args,
                                    HPy_ssize_t nargs, HPy kw)
@@ -92,26 +92,26 @@ def test_simple_noargs_method_no_struct_access(self):
                 obj->value = 42;
                 return h;
             }
-            
+
             HPyDef_METH(My_constant, "constant", HPyFunc_NOARGS)
             static HPy My_constant_impl(HPyContext *ctx, HPy self)
             {
                 // Doesn't access struct at all - just returns a constant
                 return HPyLong_FromLong(ctx, 123);
             }
-            
+
             static HPyDef *My_defines[] = {
                 &My_new,
                 &My_constant,
                 NULL
             };
-            
+
             static HPyType_Spec My_spec = {
                 .name = "mytest.MyType",
                 .basicsize = sizeof(MyObject),
                 .defines = My_defines,
             };
-            
+
             @EXPORT_TYPE("MyType", My_spec)
             @INIT
         """)
@@ -130,17 +130,17 @@ def test_type_without_basicsize(self):
             {
                 return HPyLong_FromLong(ctx, 456);
             }
-            
+
             static HPyDef *My_defines[] = {
                 &My_constant,
                 NULL
             };
-            
+
             static HPyType_Spec My_spec = {
                 .name = "mytest.MyType",
                 .defines = My_defines,
             };
-            
+
             @EXPORT_TYPE("MyType", My_spec)
             @INIT
         """)