* revert: "revert: add life support to handles cast to string_view (#6092)"
This re-applies #6092 (reverting #6097) so the follow-up fixes in this PR can build on it.
Assisted-by: ClaudeCode:claude-opus-4.8
* fix: don't throw from string_view life support outside a bound function
PR #6092 added loader_life_support::add_patient(src) to keep the source
object alive when loading a string view, fixing a real use-after-free when
a container of views is built from a non-sequence iterable (e.g. a
generator): list_caster materializes a temporary tuple that owns the
strings and destroys it when load() returns, before the bound function
body runs.
add_patient throws when there is no life support frame, so casting to a
view outside a bound function (e.g. a manual py::cast<std::string_view>)
now raises instead of relying on the caller-owned source, a regression
from #6092.
For these view-into-src cases registration is best effort: inside a bound
function it keeps src alive (fixing the UAF), and outside one the caller
owns src's lifetime as before. Add try_add_patient(), which returns false
instead of throwing when there is no frame, and use it at the three view
load sites. add_patient() keeps its strict contract for value-creating
conversions.
Assisted-by: ClaudeCode:claude-opus-4.8
* fix: only add string_view life support for transient sources
Refine the previous commit. Best-effort registration (try_add_patient)
silently produces a dangling view when a container of views is built from
a generator outside a bound function: there the materialized temporary is
released before the view is used, and with no frame nothing keeps it
alive. Such a cast cannot be made safe, so it should fail loudly, while a
view into a durable, caller-owned object needs no life support at all.
The view caster cannot tell a durable source from a pybind11-managed
transient one; that provenance lives in the container caster. Introduce an
ambient transient_source_guard that the list, set, map, and array casters
set around their generator/materialized paths, and have the string caster
keep the source alive only when loading from a transient source (via the
throwing add_patient, so try_add_patient is no longer needed). This means:
- views into durable sources (direct arguments, sequences, manual casts)
add no life support and no longer throw outside a bound function, and
- a generator used outside a frame throws, rather than silently dangling.
The guard restores (rather than clears) the previous value, so a durable
container nested in a transient one is correctly treated as transient.
Verified with AddressSanitizer: the in-frame generator case is clean, the
out-of-frame durable cases succeed, and the out-of-frame generator case
throws.
Assisted-by: ClaudeCode:claude-opus-4.8
* Revert "fix: only add string_view life support for transient sources"
This reverts commit e18b8346a2.
* test: cover string_view argument life support
* test: cover generated and nested string_view lifetimes
* test: cover temporary-backed string_view casts
* test: explain string_view lifetime regression tests
* docs: clarify string_view lifetime requirements
* docs: explain life support for custom view casters
---------
Co-authored-by: Ralf W. Grosse-Kunstleve <rgrossekunst@nvidia.com>
Created using [mini-swe-agent](https://mini-swe-agent.com) and the propmt:
I'd like to find usages of PYBIND11_MODULE in the docs folder and add py::mod_gil_not_used() as a third argument if there ar
e only two arguments. These are examples, and it's really a good idea to always include that now.
I removed a few of the changes.
Signed-off-by: Henry Schreiner <henryschreineriii@gmail.com>
* Added rework of arg/return typing
* Changed `Path` to `pathlib.Path` for compatibility with pybind11-stubgen
* Removed old arg/return type hint implementation
* Added noconvert support for arg/return type hints
* Added commented failing tests for Literals with special characters
* Added return_descr/arg_descr for correct typing in typing::Callable
* Fixed clang-tidy issues
* Changed io_name to have explicit return type (for C++11 support)
* style: pre-commit fixes
* Added support for nested callables
* Fixed missing include
* Fixed is_return_value constructor call
* Fixed clang-tidy issue
* Uncommented test cases for special characters in literals
* Moved literal tests to correct test case
* Added escaping of special characters in typing::Literal
* Readded mistakenly deleted bracket
* Moved sanitize_string_literal to correct namespace
* Added test for Literal with `!` and changed StringLiteral template param name
* Added test for Literal with multiple and repeated special chars
* Simplified string literal sanitization function
* Added test for `->` in literal
* Added test for `->` with io_name
* Removed unused parameter name to prevent warning
* Added escaping of `-` in literal to prevent processing of `->`
* Fixed wrong computation of sanitized string literal length
* Added cast to prevent error with MSVC
* Simplified special character check
---------
Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>
* Added arg/return type handling.
* Added support for nested arg/return type in py::typing::List
* Added support for arg/return type in stl/filesystem
* Added tests for arg/return type in stl/filesystem and py::typing::List
* Added arg/return name to more py::typing classes
* Added arg/return type to Callable[...]
* Added tests for typing container classes (also nested)
* Changed typing classes to avoid using C++14 auto return type deduction.
* Fixed clang-tidy errors.
* Changed Enable to SFINAE
* Added test for Tuple[T, ...]
* Added RealNumber with custom caster for testing typing classes.
* Added tests for Set, Iterable, Iterator, Union, and Optional
* Added tests for Callable
* Fixed Callable with ellipsis test
* Changed TypeGuard/TypeIs to use return type (being the narrower type) + Tests
* Added test for use of fallback type name with stl vector
* Updated documentation.
* Fixed unnecessary constructor call in test.
* Fixed reference counting in example type caster.
* Fixed clang-tidy issues.
* Fix for clang-tidy
* Updated cast method to use pybind11 API rather than Python C API in custom caster example
* Updated load to use pybind11 API rather than Python C API in custom caster example
* Changed test of arg/return name to use pybind11 API instead of Python C API
* Updated code in adcanced/cast example and improved documentation text
* Fixed references in custom type caster docs
* Fixed wrong logical and operator in test
* Fixed wrong logical operator in doc example
* Added comment to test about `float` vs `float | int`
* Updated std::filesystem::path docs in cast/overview section
* Remove one stray dot.
---------
Co-authored-by: Ralf W. Grosse-Kunstleve <rgrossekunst@nvidia.com>
* Wrap PYBIND11_OVERLOAD_NAME and PYBIND11_OVERLOAD_PURE_NAME in do { ... } while (false), and resolve trailing semicolon
* Deprecate PYBIND11_OVERLOAD_* and get_overload in favor of PYBIND11_OVERRIDE_* and get_override
* Correct erroneous usage of 'overload' instead of 'override' in the implementation and internals
* Fix tests to use non-deprecated PYBIND11_OVERRIDE_* macros
* Update docs to use override instead of overload where appropriate, and add warning about deprecated aliases
* Add semicolons to deprecated PYBIND11_OVERLOAD macros to match original behavior
* Remove deprecation of PYBIND11_OVERLOAD_* macros and get_overload
* Add note to changelog and upgrade guide
