`load_src` was a Python 2-era leftover. A removed branch used to reassign
it to a temporary unicode object; since that was deleted with Python 2
support, it is now an exact, never-reassigned alias of `src`. Use `src`
directly.
Spotted in review of #6092.
Assisted-by: ClaudeCode:claude-opus-4.8
Under free-threaded CPython (Py_GIL_DISABLED) the GIL provides no mutual
exclusion, so the plain pointer last_storage_ptr_ was read and written
concurrently without synchronization, a C++ data race. Make it a
std::atomic<T *>.
Also reorder get_stored() to check is_last_storage_valid() before loading
the cached pointer. The writer publishes the pointer before setting the
validity flag, so the flag must be observed first for correct
acquire/release ordering.
Assisted-by: ClaudeCode:claude-fable-5
* Fix handling of string_view to prevent GC'ing strings before they are used.
* style: pre-commit fixes
* Update cast.h
---------
Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>
Remove the module-level `cpp_flag_cache = None` variable and its stale
comment "Every call will cache the result". The actual caching is handled
by the `@lru_cache` decorator on `auto_cpp_level` directly below.
Also rename the typo'd parameter `obg` to `obj` in `no_recompile`.
Nothing passes this argument by keyword, so there is no API break.
Part of #6084
Assisted-by: ClaudeCode:claude-sonnet-4-6
The `# -*- coding: utf-8 -*-` line prepended to every string passed to
PyRun_String was a Python 2 workaround. Python 3's PyRun_String already
assumes UTF-8 source encoding, so the cookie is dead weight — and
harmful: it shifts all line numbers up by one in tracebacks and
SyntaxErrors from evaluated code (a `raise` on line 2 would incorrectly
appear as line 3).
Remove the cookie and replace the stale comment with one that explains
the actual reason for the `std::string` conversion (need a C string for
PyRun_String). No other location in eval.h uses this pattern
(eval_file reads directly from a FILE*).
Assisted-by: ClaudeCode:claude-fable-5
* ci: drop boost from 32-bit mingw32 install
MSYS2 removed the mingw-w64-i686-boost package (32-bit i686 is being
phased out), so the mingw32 matrix entry now fails at the pacman install
step with "target not found: mingw-w64-i686-boost". Boost is optional
test coverage (boost::optional / boost::variant casters, gated behind
PYBIND11_TEST_BOOST); without it those tests are skipped and the rest of
the job builds and runs normally. Move boost to the mingw64 extra_install
so the 64-bit job keeps that coverage.
Assisted-by: ClaudeCode:claude-opus-4.8
* Apply suggestion from @henryiii
* ci: update GraalPy from 24.2 to 25.0 (Python 3.12 based)
- Replace graalpy-24.2 with graalpy-25.0 in CI matrix
- Replace graalpy-24.1 with graalpy-24.2 (shift older version up)
- Remove dead GRAALPY_VERSION < (24, 2) xfail guards from tests
- Remove unused GRAALPY_VERSION from tests/env.py
- Update internals.h comment to reference v25.0
Assisted-by: OpenCode:glm-5
* fix: use numpy 2.2.x for GraalPy 3.12 (graalpy312 wheels)
numpy 1.26.x only has graalpy311 wheels; GraalPy 25.0 (Python 3.12)
requires numpy 2.2.x which has graalpy312 wheels on the GraalVM index.
Assisted-by: OpenCode:glm-5
* fix: simplify numpy requirement for GraalPy (drop 3.11 branch)
We no longer test GraalPy 3.11, so the version split is unnecessary.
Assisted-by: OpenCode:glm-5
* test passes on PyPy macOS
* adjust tests for pypy HEAD
* fixes from review
* pypy 7.3.23 was released, drop some PyPy testing
* pin to pypy version 7.3.23
* Restore xfail for cross-module translator platforms
Keep the expected failure for Android and FreeBSD while limiting the PyPy-specific part to versions before 7.3.23. Android CIBW still raises RuntimeError for this test, matching the existing tracked platform issue.
---------
Co-authored-by: Ralf W. Grosse-Kunstleve <rgrossekunst@nvidia.com>
* feat(subinterpreter): add opt-in TLS-cached thread state mode
subinterpreter_scoped_activate previously created and destroyed a fresh
PyThreadState on every activation when the calling OS thread was not
already running the target interpreter. Workloads that repeatedly
re-enter the same sub-interpreter from the same thread therefore churn
thread states and lose per-thread interpreter state between activations
(see pybind/pybind11#6040).
Add an opt-in subinterpreter_thread_state::cached policy: on first use a
PyThreadState is created and stored in OS-thread-local storage keyed by
the target interpreter; subsequent activations on that thread only swap
it in/out and never destroy it. The default stays transient, so existing
behavior is unchanged.
Since pybind11 does not control thread lifetime, cleanup is explicit:
subinterpreter::release_cached_thread_state() releases the calling
thread's cached state for one interpreter, and the static
release_all_cached_thread_states() releases all of the calling thread's
cached states as an end-of-thread hook. The TLS map's destructor only
frees its own nodes and never touches the Python C API, so an
unreleased state leaks rather than crashing at thread exit.
Includes test coverage and embedding docs.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* style: pre-commit fixes
* refactor(subinterpreter): replace cached enum/TLS with subinterpreter_thread_state RAII
Address review feedback on the original "cached" mode by switching to an
explicit two-RAII design suggested by @b-pass:
"Create a class ... to RAII-manage the PyThreadState but start its
lifetime in an already released state. You could create another
class (or modify scoped_activate) to scoped/RAII activate the
inactive threadstate."
Removed
- enum subinterpreter_thread_state { transient, cached } and the
defaulted ctor parameter on subinterpreter_scoped_activate.
- detail::subinterpreter_thread_state_cache thread_local map.
- subinterpreter::release_cached_thread_state() and
subinterpreter::release_all_cached_thread_states().
This eliminates: the hidden per-thread map, the "release_all" footgun
across pybind11 modules (the cache was module-local), and the implicit
"must not be active when called" contract on the release functions.
Added
- Public class subinterpreter_thread_state that owns one PyThreadState
for a given subinterpreter on its constructing OS thread, created in
a released state (not current, no GIL). Non-copyable, non-movable
(PyThreadState is bound to its creating OS thread).
- subinterpreter_scoped_activate(subinterpreter_thread_state &)
overload: swaps the owned PyThreadState in on entry, swaps it out
on exit, does not touch its lifetime.
Behavior
- The existing subinterpreter_scoped_activate(subinterpreter const &)
overload is unchanged (still transient: New on entry, Delete on
exit). All previously-working code keeps working.
- With subinterpreter_thread_state, one OS thread can alternate
between multiple subinterpreters and each PyThreadState is preserved
across activations -- the use case that gil_scoped_release/acquire
+ a long-lived scoped_activate cannot solve alone (the per-thread
internals.tstate slot holds only one inactive tstate).
- The dtor of subinterpreter_thread_state guards against the
"destroyed-while-active" contract violation: if Swap reveals the
cached tstate was current, do not Swap back to a now-deleted
pointer (the safe-when-active fix b-pass requested for the old
release_* functions, applied at the natural location instead).
Lifetime contract is enforced by ordinary C++ scope: typical placement
is `thread_local`. No new release/cleanup APIs are required.
Tests cover (a) tstate identity preserved across activations on a
thread, (b) transient and reusing modes do not share state, (c)
different OS threads get distinct PyThreadStates, and (d) the
multi-subinterpreter alternation case.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* fix(subinterpreter): address review on #6073 (same-thread checks, test scoping)
Per @b-pass's review:
- ~subinterpreter_thread_state(): add a PYBIND11_DETAILED_ERROR_MESSAGES-
guarded check that destruction happens on the OS thread that created the
PyThreadState (same PyThread_get_thread_native_id pattern as ~subinterpreter),
failing with pybind11_fail otherwise.
- subinterpreter_scoped_activate(subinterpreter_thread_state &): add the
matching DETAILED_ERROR_MESSAGES check that activation happens on the
creating OS thread, enforcing the newly documented rule.
- docs: document that activating a subinterpreter_thread_state on another OS
thread is illegal.
- tests: keep each subinterpreter (and its subinterpreter_thread_state) in an
enclosing scope so destruction order is thread-state -> subinterpreter ->
unsafe_reset_internals_for_single_interpreter(). The previous top-level
declarations ran the reset while the subinterpreters were still alive, which
is the likely cause of the CI crashes.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* docs: fix codespell (re-used -> reused) in embedding.rst
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>
* fix: prioritize custom enum __str__
* test: strengthen custom enum __str__ regression
* refactor: move enum __str__ handling into enum_
Keep class_::def() generic and let enum_ own the enum-specific
behavior for custom __str__ overloads. This avoids using the private
__entries attribute as a runtime sentinel for py::enum_ while preserving
the prepend behavior that lets user-defined enum __str__ methods take
precedence over the generated default.
One caveat is that this applies to normal py::enum_ API usage. Code that
intentionally upcasts an enum_ binding to class_& and then calls
class_::def("__str__", ...) will bypass this enum_ override and keep the
generic class_ behavior.
* fix: avoid enum def ambiguity on MinGW
Remove the inherited class_::def overload set from enum_ and add an explicit forwarding overload for non-string def() calls. GCC 15 on MinGW otherwise sees the duplicate dependent-base def(const char *, ...) template as ambiguous with enum_::def(const char *, ...), breaking the C++11 build.
---------
Co-authored-by: ctmd1234567 <ctmd1234567@users.noreply.github.com>
Co-authored-by: Ralf W. Grosse-Kunstleve <rgrossekunst@nvidia.com>
Lock down the current behavior discussed in issue #6064: py::cast() from std::shared_ptr<T> remains rejected for custom holder bindings that are not std::shared_ptr or py::smart_holder.
This extracts the incompatible-holder coverage from PR #6068 and adds a test shaped like issue #6064, while PR #6065 and PR #6066 explore alternative support paths.
When the Callable itself is an input (parameter) to a C++ function, its
arguments are outputs (C++ passes them to the Python callback), and vice
versa.
Therefore, we must invert them if C++ calls a Python function, but keep
them the same in the other direction.
Drop the last remaining deadsnakes-based Linux job because it mostly duplicates the main Ubuntu coverage while failing in external Launchpad/PPA setup, and the old Valgrind/debug path it used to complement has already been retired.
Co-authored-by: Cursor <cursoragent@cursor.com>
Avoid relying on Python_ROOT_DIR alone because CMake FindPython can still resolve the hosted x64 python.org install on the Windows ARM runner and then fail at link time with an x64/arm64 mismatch.
Co-authored-by: Cursor <cursoragent@cursor.com>
Temporarily pin the two failing PyPy 3.11 jobs while investigating the PyPy 7.3.22 import regression.
Refs #6049.
Co-authored-by: Cursor <cursoragent@cursor.com>
Run ci.yml and tests-cibw.yml twice weekly so master bitrot is easier to spot and root-cause before weekend maintenance.
Co-authored-by: Cursor <cursoragent@cursor.com>
* build: support Eigen 5
fix#6034
* build: probe Eigen 3 and 5 separately in CMake config mode
Avoid relying on package-specific handling of a bounded version range when discovering Eigen through Eigen3Config.cmake.
Made-with: Cursor
* [skip ci] build: clarify Eigen 5 module fallback comment
Explain that the MODULE-mode fallback only exists for older Eigen 3 setups so the remaining fallback path does not look like an unresolved Eigen 5 issue.
Made-with: Cursor
* [skip ci] docs: add Eigen 5 entry to v3.0.4 changelog
Document the Eigen 5 CMake package detection fix in the 3.0.4 release notes before merging the PR.
Made-with: Cursor
---------
Co-authored-by: Eisuke Kawashima <e-kwsm@users.noreply.github.com>
Co-authored-by: Ralf W. Grosse-Kunstleve <rgrossekunst@nvidia.com>
Document the post-v3.0.3 fixes and CI changes ahead of the patch release so the release prep can be reviewed before the version bump work.
Made-with: Cursor
* fix: segfault when moving `scoped_ostream_redirect`
The default move constructor left the stream (`std::cout`) pointing at
the moved-from `pythonbuf`, whose internal buffer and streambuf pointers
were nulled by the move. Any subsequent write through the stream
dereferenced null, causing a segfault.
Replace `= default` with an explicit move constructor that re-points
the stream to the new buffer and disarms the moved-from destructor.
* fix: mark move constructor noexcept to satisfy clang-tidy
* fix: use bool flag instead of nullptr sentinel for moved-from state
Using `old == nullptr` as the moved-from sentinel was incorrect because
nullptr is a valid original rdbuf() value (e.g. `std::ostream os(nullptr)`).
Replace with an explicit `active` flag so the destructor correctly
restores nullptr buffers.
Add tests for the nullptr-rdbuf edge case.
* fix: remove noexcept and propagate active flag from source
- Remove noexcept: pythonbuf inherits from std::streambuf whose move
is not guaranteed nothrow on all implementations. Suppress clang-tidy
with NOLINTNEXTLINE instead.
- Initialize active from other.active so that moving an already
moved-from object does not incorrectly re-activate the redirect.
- Only rebind the stream and disarm the source when active.
* test: add unflushed ostream redirect regression
Cover the buffered-before-move case for `scoped_ostream_redirect`, which still crashes despite the current move fix. This gives the PR a direct reproducer for the remaining bug path.
Made-with: Cursor
* fix: disarm moved-from pythonbuf after redirect move
The redirect guard now survives moves, but buffered output could still remain in the moved-from `pythonbuf` and be flushed during destruction through moved-out Python handles. Rebuild the destination put area from the transferred storage and clear the source put area so unflushed bytes follow the active redirect instead of crashing in the moved-from destructor.
Made-with: Cursor
---------
Co-authored-by: Ralf W. Grosse-Kunstleve <rgrossekunst@nvidia.com>
* Handle result from PyObject_VisitManagedDict
* add unit test
* style: pre-commit fixes
* use different variable name
This avoids a warning on msvc about Py_Visit shadowing the vret variable.
* skip test_get_referrers on unsupported runtimes
The managed-dict referrer check is only known to work on CPython 3.13.13+ and 3.14.4+, while earlier releases and non-CPython interpreters can report different traversal behavior.
Made-with: Cursor
---------
Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>
Co-authored-by: Ralf W. Grosse-Kunstleve <rgrossekunst@nvidia.com>
* tests: add regressions for shared_ptr reference_internal fallback
* fix: avoid copy constructor instantiation in shared_ptr fallback cast
* Remove stray empty line
* tests: rename PyTorch shared_ptr regression test files
* refactor: add cast_non_owning helper for reference-like casts
Name the non-owning generic cast path so callers do not have to rediscover that
reference-like policies must pass null copy/move constructor callbacks. This
keeps the shared_ptr reference_internal fallback self-documenting and points
future maintainers toward the safe API.
Made-with: Cursor
* tests: guard deprecated-copy warning probes with __has_warning
Use __has_warning for the Clang-only regression test so older compiler jobs skip
unsupported warning groups instead of failing with -Wunknown-warning-option. A
simple __clang_major__ >= 13 guard would be shorter, but it bakes in a version
cutoff; __has_warning is slightly more verbose while being more robust to
vendor builds, backports, and future packaging differences.
Made-with: Cursor
---------
Co-authored-by: Ralf W. Grosse-Kunstleve <rgrossekunst@nvidia.com>
* Fix heap-buffer-overflow in pythonbuf with undersized buffers (gh-5886)
The _sync() UTF-8 remainder logic can leave pptr() past the end of
the allocated buffer when buf_size < 4: after moving up to 3 bytes
of an incomplete UTF-8 sequence to the front, pbump(remainder) pushes
pptr() beyond epptr() and the buffer boundary. The next overflow()
then writes out of bounds.
Fix by clamping the buffer size to a minimum of 4 in the constructor,
ensuring the maximum UTF-8 remainder (3 bytes) plus the overflow slot
(1 byte) always fits within the allocated buffer.
Made-with: Cursor
* Avoid C++14 ODR-use linker error for minimum_buffer_size
std::max takes arguments by const&, which ODR-uses the static constexpr
member and requires an out-of-line definition in C++14. Replace with a
ternary expression that uses the value without taking its address.
Made-with: Cursor
Virtual inheritance places the base subobject at a dynamic offset, but
load_impl Case 2a uses reinterpret_cast which assumes a fixed offset.
This caused segfaults when dispatching inherited methods through virtual
bases (e.g. SftVirtDerived2::name()).
Add an is_static_downcastable SFINAE trait that detects whether
static_cast<Derived*>(Base*) is valid. When it is not (virtual
inheritance), set multiple_inheritance = true in add_base to force the
implicit_casts path, which correctly adjusts pointers at runtime.
Remove the workaround .def("name", &SftVirtDerived2::name) from
test_smart_ptr.cpp that was papering over the issue.
Made-with: Cursor
* fix: strdup args added after initialize_generic in def_property_static (gh-5976)
`def_property_static` calls `process_attributes::init` on already-initialized
function records (after `initialize_generic`'s strdup loop has run).
Args added at this stage (e.g. "self" via `append_self_arg_if_needed`) remain
as string literals, so `destruct()` would call `free()` on them.
Fix by strdup'ing name/descr of any args appended by the late
`process_attributes::init` call. Root cause introduced by gh-5486.
Made-with: Cursor
* Partially revert gh-6010: remove py_is_finalizing() workarounds
Now that the root cause (free of string literals in def_property_static,
gh-5976) is fixed in the previous commit, the py_is_finalizing() guards
introduced in gh-6010 are no longer needed:
- tp_dealloc_impl: remove early return during finalization (was leaking
all function records instead of properly destroying them)
- destruct(): remove guard around arg.value.dec_ref()
- common.h: remove py_is_finalizing() helper (no remaining callers)
The genuine fix from gh-6010 (PyObject_Free + Py_DECREF ordering in
tp_dealloc_impl) is retained.
Made-with: Cursor
* test: add embedding test for py::enum_ across interpreter restart (gh-5976)
py::enum_ is the primary trigger for gh-5976 because its constructor
creates properties via def_property_static / def_property_readonly_static,
which call process_attributes::init on already-initialized function records.
Yet none of the existing embedding tests used py::enum_ at all.
Add an PYBIND11_EMBEDDED_MODULE with py::enum_ and a test case that imports
it, finalize/reinitializes the interpreter, and re-imports it. This exercises
the def_property_static code path that was fixed in the preceding commit.
Note: on Python 3.14.2 (and likely 3.12+), tp_dealloc_impl is not called
during Py_FinalizeEx for function record PyObjects — they simply leak because
types are effectively immortalized. As a result, this test cannot trigger the
original free()-on-string-literal crash on this Python version. However, it
remains valuable as a regression guard: on Python builds where finalization
does clean up function records (or if CPython changes this behavior), the
test would catch the crash. It also verifies that py::enum_ survives
interpreter restart correctly, which was previously untested.
Made-with: Cursor
* test: skip enum restart test on Python 3.12 (pre-existing crash)
Made-with: Cursor
* Add test_standalone_enum_module.py, standalone_enum_module.cpp
* Make standalone_enum_module.cpp more similar to #5976 reproducer. Also fix clang-tidy error.
* This crashes when testing locally:
( cd /wrk/forked/pybind11/tests && PYTHONPATH=/wrk/bld/pybind11_gcc_v3.14.2_df793163d58_default/lib /wrk/bld/pybind11_gcc_v3.14.2_df793163d58_default/TestVenv/bin/python3 -m pytest test_standalone_enum_module.py )
============================= test session starts ==============================
platform linux -- Python 3.14.2, pytest-9.0.2, pluggy-1.6.0
installed packages of interest: build==1.4.2 numpy==2.4.3 scipy==1.17.1
C++ Info: 13.3.0 C++20 __pybind11_internals_v12_system_libstdcpp_gxx_abi_1xxx_use_cxx11_abi_1__ PYBIND11_SIMPLE_GIL_MANAGEMENT=False
rootdir: /wrk/forked/pybind11/tests
configfile: pytest.ini
plugins: timeout-2.4.0, xdist-3.8.0
collected 1 item
test_standalone_enum_module.py F [100%]
=================================== FAILURES ===================================
________________________ test_enum_import_exit_no_crash ________________________
def test_enum_import_exit_no_crash():
# Modeled after reproducer under issue #5976
> env.check_script_success_in_subprocess(
f"""
import sys
sys.path.insert(0, {os.path.dirname(env.__file__)!r})
import standalone_enum_module as m
assert m.SomeEnum.__class__.__name__ == "pybind11_type"
""",
rerun=1,
)
test_standalone_enum_module.py:10:
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
code = 'import sys\nsys.path.insert(0, \'/wrk/forked/pybind11/tests\')\nimport standalone_enum_module as m\nassert m.SomeEnum.__class__.__name__ == "pybind11_type"'
def check_script_success_in_subprocess(code: str, *, rerun: int = 8) -> None:
"""Runs the given code in a subprocess."""
import os
import subprocess
import sys
import textwrap
if ANDROID or IOS or sys.platform.startswith("emscripten"):
pytest.skip("Requires subprocess support")
code = textwrap.dedent(code).strip()
try:
for _ in range(rerun): # run flakily failing test multiple times
subprocess.check_output(
[sys.executable, "-c", code],
cwd=os.getcwd(),
stderr=subprocess.STDOUT,
text=True,
)
except subprocess.CalledProcessError as ex:
> raise RuntimeError(
f"Subprocess failed with exit code {ex.returncode}.\n\n"
f"Code:\n"
f"```python\n"
f"{code}\n"
f"```\n\n"
f"Output:\n"
f"{ex.output}"
) from None
E RuntimeError: Subprocess failed with exit code -6.
E
E Code:
E ```python
E import sys
E sys.path.insert(0, '/wrk/forked/pybind11/tests')
E import standalone_enum_module as m
E assert m.SomeEnum.__class__.__name__ == "pybind11_type"
E ```
E
E Output:
E munmap_chunk(): invalid pointer
_ = 0
code = 'import sys\nsys.path.insert(0, \'/wrk/forked/pybind11/tests\')\nimport standalone_enum_module as m\nassert m.SomeEnum.__class__.__name__ == "pybind11_type"'
os = <module 'os' (frozen)>
rerun = 1
subprocess = <module 'subprocess' from '/wrk/cpython_installs/v3.14.2_df793163d58_default/lib/python3.14/subprocess.py'>
sys = <module 'sys' (built-in)>
textwrap = <module 'textwrap' from '/wrk/cpython_installs/v3.14.2_df793163d58_default/lib/python3.14/textwrap.py'>
env.py:68: RuntimeError
=========================== short test summary info ============================
FAILED test_standalone_enum_module.py::test_enum_import_exit_no_crash - Runti...
============================== 1 failed in 0.23s ===============================
ERROR: completed_process.returncode=1
* Add "Added in PR #6015" comments, for easy reference back to this PR
* test: use PYBIND11_CATCH2_SKIP_IF for Python 3.12 enum restart skip
Replace #if/#else/#endif preprocessor guard with runtime
PYBIND11_CATCH2_SKIP_IF so the test is always compiled and
shows [ SKIPPED ] in output on Python 3.12.
Made-with: Cursor
* fix: suppress MSVC C4127 in PYBIND11_CATCH2_SKIP_IF macro
The constant condition in PYBIND11_CATCH2_SKIP_IF triggers MSVC
warning C4127 (conditional expression is constant), which becomes
a build error under /WX.
Made-with: Cursor
* Wrap ensure_internals() in try-catch in PYBIND11_MODULE_PYINIT
Previously, ensure_internals() was called without exception handling
in the PyInit_* function (PYBIND11_MODULE_PYINIT), while the same call
in PYBIND11_MODULE_EXEC was already wrapped in try-catch. On MSVC,
a C++ exception propagating through the extern "C" PyInit_* boundary
is undefined behavior, which can manifest as an access violation
instead of a clean error message. This is a potential contributor to
crashes like gh-5993. Wrap the entire PyInit body in try/catch using
the existing PYBIND11_CATCH_INIT_EXCEPTIONS pattern.
Made-with: Cursor
* Add nullptr guards in get_internals() for better crash diagnostics
Add explicit null checks after get_pp() and create_pp_content_once()
in get_internals(), calling pybind11_fail() with descriptive messages.
These guards convert potential null-pointer dereferences (which produce
unhelpful access-violation crashes, especially on Windows) into clear
runtime_error messages that can be caught and reported as ImportError
by the try-catch added in the previous commit.
Made-with: Cursor
Replace `static thread_specific_storage<int>` with `thread_local bool`
in the implicit conversion reentrancy guard. Since implicitly_convertible
is a template function, each unique <InputType, OutputType> pair created
its own TSS key via PyThread_tss_create(). Projects with hundreds of
modules and many implicit conversions could exhaust PTHREAD_KEYS_MAX
(1024 on Linux, 512 on macOS), especially on Python 3.12+ where CPython
itself consumes more TSS keys for subinterpreter support.
thread_local bool is safe here because:
- bool is trivially destructible, so it works on all C++11 platforms
including older macOS (the concern that motivated the TSS approach in
PR #5777 applied only to types with non-trivial destructors needing
__cxa_thread_atexit runtime support)
- Each thread gets its own copy, so it is thread-safe for free-threading
- Subinterpreter sharing is benign: the guard prevents recursive implicit
conversions on the same thread regardless of which interpreter is active
- The v3.0.0 code already used thread_local bool under Py_GIL_DISABLED
This effectively reverts the core change from PR #5777 while keeping
the non-copyable/non-movable set_flag guard.
Made-with: Cursor
* Add regression test for #5989: static_pointer_cast fails with virtual inheritance
When a class uses virtual inheritance and its holder type is shared_ptr,
passing a shared_ptr of the derived type as a method argument triggers
a compilation error because static_pointer_cast cannot downcast through
a virtual base (dynamic_pointer_cast is needed instead).
Made-with: Cursor
* Fix#5989: use dynamic_pointer_cast for virtual inheritance in esft downcast
Replace the unconditional static_pointer_cast in set_via_shared_from_this
with a SFINAE-dispatched esft_downcast helper that falls back to
dynamic_pointer_cast when static_cast through a virtual base is ill-formed.
Also add a workaround in the test binding (.def("name") on SftVirtDerived2)
for a separate pre-existing issue with inherited method dispatch through
virtual bases.
Made-with: Cursor
* Strip noexcept from cpp17 function type bindings
* Fix a bug and increase test coverage
* Does this fix it?
* Silence clang-tidy issue
* Simplify method adapter with macro and add missing rvalue adaptors + tests
* Supress clang-tidy errors
* Improve test coverage
* Add additional static assert
* Try to resolve MSVC C4003 warning
* Simplify method adaptor into 2 template instatiations with enable_if_t
* Fix ambiguous STL template
* Close remaining qualifier consistency gaps for member pointer bindings.
A production-code review after #2234 showed that ref-qualified member pointers were still inconsistently handled across def_buffer, vectorize, and overload_cast, so this adds the missing overloads with focused tests for each newly-supported signature.
Co-authored-by: Cursor <cursoragent@cursor.com>
* Clarify why def_buffer/vectorize omit rvalue-qualified overloads.
These comments were added while reviewing the qualifier coverage follow-up, to document that buffer/vectorized calls operate on existing Python-owned instances and should not move-from self.
Co-authored-by: Cursor <cursoragent@cursor.com>
* Add compile-only overload_cast guard for ref-qualified methods.
This was added as a maintenance follow-up to the qualifier-consistency work, so future changes that introduce overload_cast ambiguity or wrong ref/noexcept resolution fail at compile time.
Co-authored-by: Cursor <cursoragent@cursor.com>
* Refactor overload_cast_impl qualifier overloads with a macro.
As part of the qualifier-consistency maintenance follow-up, this reduces duplication in overload_cast_impl while preserving the same ref/noexcept coverage and keeping pedantic-clean macro expansion.
Co-authored-by: Cursor <cursoragent@cursor.com>
* Expose __cpp_noexcept_function_type to Python tests and use explicit skip guards.
This replaces hasattr-based optional assertions with skipif-gated noexcept-only tests so skipped coverage is visible in pytest output while keeping non-noexcept checks always active.
Co-authored-by: Cursor <cursoragent@cursor.com>
* Add static_assert in method_adaptor to guard that T is a member function pointer.
Suggested by @Skylion007 in PR #5992 review comment [T007].
Made-with: Cursor
* automatic clang-format change (because of #6002)
---------
Co-authored-by: Ralf W. Grosse-Kunstleve <rgrossekunst@nvidia.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
* Add tests that cause crash in def_readwrite
- Occurs with non-smart-holder property of smart-holder class
* Fix crash in def_readwrite for non-smart-holder properties of smart-holder classes
* Use default policy
* Address PR comments
* Add test for cast error path
* style: pre-commit fixes
* Revert "Use default policy"
This reverts commit b299f32104.
* Disable test_shared_ptr_return_for_unique_ptr_holder when PYBIND11_TEST_SMART_HOLDER=ON
* Add counterexample
---------
Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>
Co-authored-by: Ralf W. Grosse-Kunstleve <rgrossekunst@nvidia.com>
Explicitly specify the 4th template parameter in the
single-factory partial specialization of `factory` to
disambiguate it from the dual-factory specialization
when compiled with nvcc + GCC 14. Fixes#5565.
Co-authored-by: Oz <oz-agent@warp.dev>
* fix: clear managed dict in pybind11_object_dealloc on Python 3.13+
On Python 3.14, PyObject_GC_Del (tp_free) no longer implicitly clears
the managed dict of objects with Py_TPFLAGS_MANAGED_DICT. Without an
explicit PyObject_ClearManagedDict() call before tp_free(), objects
stored in the __dict__ of py::dynamic_attr() instances have their
refcounts permanently abandoned, causing memory leaks — capsule
destructors for numpy arrays (and other objects) never run.
Adds a regression test: stores a py::capsule in the __dict__ of a
DynamicClass instance and asserts the capsule destructor is called
when the instance is deleted.
* [tests]: mark test_dynamic_attr_dealloc_frees_dict_contents to be strict=False xfail on PYPY
* [docs]: clarify Python version comments in pybind11_object_dealloc
Distinguish between when the API is available (3.13+, where
PyObject_ClearManagedDict was introduced) and when the leak actually
manifests (3.14+, where tp_free stopped implicitly clearing the
managed dict).
---------
Co-authored-by: Yury Matveev <yury.matveev@desy.de>
* gh-5991: Fix segfault during finalization related to function_record
This patch was developed with assistance from Claude Code Opus 4.6
Here's Claude's explanation of the crash mechanism and some reasoning for the difficulty to repro:
`tp_dealloc_impl` calls `cpp_function::destruct` which:
1. Calls `std::free()` on function_record string members (`name`, `doc`, `signature`)
2. Calls `arg.value.dec_ref()` on default argument values
3. Calls `delete rec` on the function_record
But it never calls `PyObject_Free(self)` or `Py_DECREF(Py_TYPE(self))`, which are
required for heap types.
During `_Py_Finalize`, final GC collects the heap types (which survive module dict
clearing via `tp_mro` self-references). This triggers a massive cascade:
`type_dealloc → property_dealloc → meth_dealloc → tp_dealloc_impl → destruct`.
At scale (~1,200+ function_records), the volume of `delete`/`free` calls corrupts
heap metadata, causing subsequent `std::free()` to receive garbage pointers → SEGV.
* Add detail::py_is_finalizing() wrapper to deduplicate version-guarded #ifdef blocks
Also fixes clang-tidy readability-implicit-bool-conversion warnings.
Made-with: Cursor
---------
Co-authored-by: Ralf W. Grosse-Kunstleve <rgrossekunst@nvidia.com>
* Re-enable Android tests in CIBW workflow
* Skip subprocess tests on Android
* Remove Android workarounds no longer necessary with current cibuildwheel version
* Skip more subprocess tests on Android
