python
diff --git a/‎Misc/NEWS.d/next/C API/2020-10-12-20-13-58.bpo-42015.X4H2_V.rst‎
Lines changed: 3 additions & 0 deletions b/‎Misc/NEWS.d/next/C API/2020-10-12-20-13-58.bpo-42015.X4H2_V.rst‎
Lines changed: 3 additions & 0 deletions
diff --git a/‎Objects/methodobject.c‎
Lines changed: 4 additions & 2 deletions b/‎Objects/methodobject.c‎
Lines changed: 4 additions & 2 deletions
@@ -0,0 +1,3 @@
+Fix potential crash in deallocating method objects when dynamically
+allocated `PyMethodDef`'s lifetime is managed through the ``self``
+argument of a `PyCFunction`.
@@ -164,9 +164,11 @@ meth_dealloc(PyCFunctionObject *m)
     if (m->m_weakreflist != NULL) {
         PyObject_ClearWeakRefs((PyObject*) m);
     }
+    // Dereference class before m_self: PyCFunction_GET_CLASS accesses
+    // PyMethodDef m_ml, which could be kept alive by m_self
+    Py_XDECREF(PyCFunction_GET_CLASS(m));
     Py_XDECREF(m->m_self);
     Py_XDECREF(m->m_module);
-    Py_XDECREF(PyCFunction_GET_CLASS(m));
     PyObject_GC_Del(m);
 }
 
@@ -243,9 +245,9 @@ meth_get__qualname__(PyCFunctionObject *m, void *closure)
 static int
 meth_traverse(PyCFunctionObject *m, visitproc visit, void *arg)
 {
+    Py_VISIT(PyCFunction_GET_CLASS(m));
     Py_VISIT(m->m_self);
     Py_VISIT(m->m_module);
-    Py_VISIT(PyCFunction_GET_CLASS(m));
     return 0;
 }
Original file line number	Diff line number	Diff line change
@@ -0,0 +1,3 @@
	1	+ Fix potential crash in deallocating method objects when dynamically
	2	+ allocated `PyMethodDef`'s lifetime is managed through the ``self``
	3	+ argument of a `PyCFunction`.
Original file line number	Diff line number	Diff line change
@@ -164,9 +164,11 @@ meth_dealloc(PyCFunctionObject *m)
164	164	if (m->m_weakreflist != NULL) {
165	165	PyObject_ClearWeakRefs((PyObject*) m);
166	166	}
	167	+ // Dereference class before m_self: PyCFunction_GET_CLASS accesses
	168	+ // PyMethodDef m_ml, which could be kept alive by m_self
	169	+ Py_XDECREF(PyCFunction_GET_CLASS(m));
167	170	Py_XDECREF(m->m_self);
168	171	Py_XDECREF(m->m_module);
169		- Py_XDECREF(PyCFunction_GET_CLASS(m));
170	172	PyObject_GC_Del(m);
171	173	}
172	174
@@ -243,9 +245,9 @@ meth_get__qualname__(PyCFunctionObject m, void closure)
243	245	static int
244	246	meth_traverse(PyCFunctionObject m, visitproc visit, void arg)
245	247	{
	248	+ Py_VISIT(PyCFunction_GET_CLASS(m));
246	249	Py_VISIT(m->m_self);
247	250	Py_VISIT(m->m_module);
248		- Py_VISIT(PyCFunction_GET_CLASS(m));
249	251	return 0;
250	252	}
251	253