Fix SIGSEGV/SIGABRT during interpreter shutdown on Python < 3.11

[nbouvrette]

Summary

During interpreter finalization (Py_FinalizeEx), active greenlets being deallocated trigger g_switch() to throw GreenletExit. This performs a stack switch and executes Python code in a partially-torn-down interpreter, causing:

• SIGSEGV (signal 11) on greenlet 3.x
• SIGABRT (signal 6 / std::runtime_error: Accessing state after destruction) on greenlet 2.x

On Python >= 3.11, CPython's restructured finalization internals (frame representation, data stack management, recursion tracking) make g_switch() during finalization safe — so no crash occurs. On Python < 3.11, this was not the case, leading to crashes during shutdown when active greenlets exist.

Root Cause

We traced this to two unsafe operations during Py_FinalizeEx:

1. _green_dealloc_kill_started_non_main_greenlet in PyGreenlet.cpp — calls g_switch() to throw GreenletExit into the greenlet, which performs a stack switch and runs Python code via _PyEval_EvalFrameDefault in a partially-torn-down interpreter.

2. ~ThreadState in TThreadState.hpp — calls PyImport_ImportModule(\"gc\") for leak detection, which is unsafe when the import machinery is partially torn down.

Fix

This PR adds two _Py_IsFinalizing() guards, compiled only on Python < 3.11 (#if !GREENLET_PY311):

1. In _green_dealloc_kill_started_non_main_greenlet: When finalizing, call murder_in_place() directly instead of g_switch(). This marks the greenlet as dead without throwing GreenletExit — avoiding the crash at the cost of not running cleanup code inside the greenlet.

2. In ~ThreadState: When finalizing, skip the GC-based leak detection and perform only minimal safe cleanup (clearing strong references to prevent leaks).

On Python >= 3.11, no changes are made — the existing behavior (throwing GreenletExit via g_switch(), running cleanup code) continues to work correctly during finalization.

Behavioral Difference by Python Version

Python Version	Behavior During Shutdown
< 3.11 (with fix)	murder_in_place() — greenlet killed without cleanup (safe)
>= 3.11 (unchanged)	g_switch() + GreenletExit — cleanup code runs normally (already safe)

Tests

Adds test_interpreter_shutdown.py with 9 subprocess-based tests:

• Safety tests (all Python versions): single, multiple, nested, threaded, deeply-nested active greenlets at shutdown, active exception context, stress test with 50 greenlets
• Version-aware behavioral tests: verify that GreenletExit cleanup runs on Python >= 3.11, but is correctly skipped (via murder_in_place) on < 3.11

Reproduction

This was discovered in a production environment running Python 3.9.7 + uWSGI + greenlet where worker recycling caused active greenlets to be cleaned up during interpreter shutdown, generating core dumps that filled disk space (P0 incident). A full reproduction environment and detailed analysis is available at: https://github.com/nbouvrette/scheduling-tools/tree/main/greenlet-tests

Motivation

This fix stabilizes greenlet for the many production deployments still running Python 3.9 and 3.10, where upgrading Python is not immediately feasible. It also closes a longstanding gap in the test suite by adding the first interpreter-shutdown tests.

Fixes #411
See also #351, #376

[nbouvrette]

@jamadden please let me know if you have any questions but I think if this would fix the worst stability bug I am aware of, it could possibly make a lot of people happy 🙏