Crash in garbage collection of the io.BytesIO buffer object

[serhiy-storchaka]

Crash report

What happened?

If the buffer created by io.BytesIO.getbuffer() is a part of a reference loop, the garbage collector can crash. Reproducer:

import gc, io
memio = io.BytesIO(b"1234567890")
buf = memio.getbuffer()
a = [buf]
a.append(a)
del memio, buf
del a
gc.collect()

It is because bytesiobuf_clear() clears self->source, but bytesiobuf_releasebuffer() uses it.

bytesiobuf_clear() was added in #101819.

CPython versions tested on:

3.12, CPython main branch

Operating systems tested on:

No response

Output from running 'python -VV' on the command line:

No response

[chgnrdv]

See also #111049

[serhiy-storchaka]

Indeed, it is the same bug.