Fix double-free in chained ClassDerived Finalize

pythonnet · greateggsgreg · May 9, 2026 · May 9, 2026 · May 9, 2026 · May 9, 2026
commit af518bb57bfc5f3eaf0529a20b1f7d716112e8ff
diff --git a/src/runtime/Types/ClassDerived.cs b/src/runtime/Types/ClassDerived.cs
@@ -328,8 +328,14 @@ private static Type CreateDerivedTypeImpl(string name,
 #pragma warning disable CS0618 // PythonDerivedType is for internal use only
             il.Emit(OpCodes.Call, typeof(PythonDerivedType).GetMethod(nameof(PyFinalize)));
 #pragma warning restore CS0618 // PythonDerivedType is for internal use only
-            il.Emit(OpCodes.Ldarg_0);
-            il.Emit(OpCodes.Call, baseClass.GetMethod("Finalize", BindingFlags.NonPublic | BindingFlags.Instance));
+            // Only chain to the base Finalize if it's not another pythonnet-emitted
+            // type: those already call PyFinalize themselves, which would double-queue
+            // the same __pyobj__ and trigger PyObject_GC_Del on freed memory.
+            if (!typeof(IPythonDerivedType).IsAssignableFrom(baseClass))
+            {
+                il.Emit(OpCodes.Ldarg_0);
+                il.Emit(OpCodes.Call, baseClass.GetMethod("Finalize", BindingFlags.NonPublic | BindingFlags.Instance));
+            }
             il.Emit(OpCodes.Ret);
 
             Type type = typeBuilder.CreateType();

diff --git a/tests/test_subclass.py b/tests/test_subclass.py
@@ -338,6 +338,34 @@ class OverloadingSubclass2(OverloadingSubclass):
     obj = OverloadingSubclass2()
     assert obj.VirtMethod[int](5) == 5
 
+
+def test_nested_namespaced_subclass_finalize_no_double_queue():
+    """A Python subclass derived from a Python subclass with __namespace__ on
+    both must not double-queue PyFinalize when GC'd.
+
+    Each level emits a CLR type with a Finalize() that called PyFinalize(this)
+    and chained to the base's Finalize().  Chaining through another emitted
+    base ran PyFinalize twice for the same __pyobj__, so PythonDerivedType.Finalize
+    saw the same handle twice in the queue and called PyObject_GC_Del on freed
+    memory.  Reliably reproduced under Mono in CI during #2721 development
+    CoreCLR happened to mask it via GC timing.
+    """
+    from System import Object
+    class Base(Object):
+        __namespace__ = "test_nested_namespaced_subclass_finalize"
+    class Derived(Base):
+        __namespace__ = "test_nested_namespaced_subclass_finalize"
+
+    Derived()  # only the deepest level triggers the double-queue
+
+    import gc
+    gc.collect()
+
+    # Touch CLR namespace state — would crash inside PyType_GenericAlloc /
+    # PyObject_GC_Del if the previous finalize double-freed.
+    import System
+    list(System.__all__)
+
 def test_implement_interface_and_class():
     class DualSubClass0(ISayHello1, SimpleClass):
         __namespace__ = "Test"