uninit-dealloc-and-init-bypass

uninit-dealloc + init-bypass — Modules/ sample (informed)

Toolkit v0.8.0. Target /home/danzin/projects/cpython @ 4f3be1b5777 (3.16.0a0). Builds used: /home/danzin/projects/python_build_matrix/builds/{debug,release}-{gil,ft}-nojit[-asan] @ a1d580430c8. Every file cited below is byte-identical between a1d580430c8 and 4f3be1b5777 (git diff --quiet on _elementtree.c, _pickle.c, _csv.c, _datetimemodule.c, _zoneinfo.c, _sre/sre.c, hmacmodule.c, _asynciomodule.c).

Scanner volume

scanner	raw (sample)	confirmed	dismissed	precision
scan_uninit_dealloc	1	1	0	100%
scan_init_bypass	0	—	—	n/a — denominator 2, see below

Hand-audit added 1 FIX outside the sample (_asynciomodule.c), found by chasing the init-bypass recall gap rather than by either scanner.

---

Findings

FIX

1. Modules/_asynciomodule.c:2788 · _asyncio_Task_get_context_impl — new, reproduced SIGSEGV

static PyObject *
_asyncio_Task_get_context_impl(TaskObj *self)
{
    return Py_NewRef(self->task_context);
}

Task_slots (:2936) wires {Py_tp_init, _asyncio_Task___init__} with {Py_tp_new, PyType_GenericNew}. PyType_GenericNew allocates a zeroed instance and never runs tp_init, so Task.__new__(Task) yields task_context == NULL; task_context is written only in _asyncio_Task___init__ (:2324 / :2329). Py_NewRef(NULL) dereferences ob_refcnt.

Guarded twin — literally the two neighbouring functions. _asyncio_Task_get_coro_impl (:2774) and _asyncio_Task_get_name_impl (:2808) both open with if (self->task_<x>) { ... } Py_RETURN_NONE;. Wider family: 16 sites use ENSURE_FUTURE_ALIVE(state, self) / future_ensure_alive() (:401, :412), which raises RuntimeError("Future object is not initialized.") — that is why every other Task/Future method in the sweep below returned an exception instead of crashing. get_context is the single hole.