Crash when freeing sibling Elements

[Olli Pottonen]

import lxml.etree

root = lxml.etree.fromstring('<root><element/><element/></root>')
e1, e2 = root[0], root[1]
root.remove(e1)
root.remove(e2)
e1.addnext(e2)
del e1
print(e2.getprevious())

Sometimes this simply prints None, sometimes it segfaults. The reason is obvious: the previous sibling of e2, namely e1, was garbage collected and free()'d, but we can still access it via e2.getprevious().

The bug seems to be in proxy.pxi:getDeallocationTop(). When trying to deallocate a tree, it finds the root and verifies that none of the descendants of the root are still in use. Naturally the check fails in this case.

Version info:

Python : sys.version_info(major=2, minor=7, micro=8, releaselevel='final', serial=0)
lxml.etree : (3, 3, 5, 0)
libxml used : (2, 9, 0)
libxml compiled : (2, 9, 1)
libxslt used : (1, 1, 28)
libxslt compiled : (1, 1, 28)

[Olli Pottonen (olli-pottonen)]

Another fun thing to try:

import lxml.etree

root = lxml.etree.fromstring('<root><element/><element/></root>')
e1, e2= root[0], root[1]

e1.append(e2)
e2.addnext(e1)

Result: infinite loop.

[scoder (scoder)]

Thanks for the report and the test cases. Fixed here:

https://github.com/lxml/lxml/commit/beab69f059d24b7cdc03d7df4a70c551f6835192

https://github.com/lxml/lxml/commit/11589fcf5b28101ec7b8de286ad0133a4894f83c

[Olli Pottonen (olli-pottonen)]

Thanks for the quick fix.

[scoder (scoder)]

Fixed in lxml 3.3.6.