[Python-checkins] [3.8] bpo-39453: Fix contains method of list to hold strong references (GH-18204)

[Dong-hee Na]

https://github.com/python/cpython/commit/f64abd10563c25a94011f9e3335fd8a1cf47c205
commit: f64abd10563c25a94011f9e3335fd8a1cf47c205
branch: 3.8
author: Dong-hee Na <donghee.na92 at gmail.com>
committer: GitHub <noreply at github.com>
date: 2020-02-17T10:13:52+01:00
summary:

[3.8] bpo-39453: Fix contains method of list to hold strong references (GH-18204)

files:
A Misc/NEWS.d/next/Core and Builtins/2020-01-25-23-51-17.bpo-39453.xCOkYk.rst
M Lib/test/test_list.py
M Objects/listobject.c

diff --git a/Lib/test/test_list.py b/Lib/test/test_list.py
index f4dcced9c167f..105ef650eee99 100644
--- a/Lib/test/test_list.py
+++ b/Lib/test/test_list.py
@@ -216,6 +216,13 @@ def __eq__(self, other):
         with self.assertRaises(ValueError):
             lst.remove(lst)
 
+        # bpo-39453: list.__contains__ was not holding strong references
+        # to list elements while calling PyObject_RichCompareBool().
+        lst = [X(), X()]
+        3 in lst
+        lst = [X(), X()]
+        X() in lst
+
 
 if __name__ == "__main__":
     unittest.main()
diff --git a/Misc/NEWS.d/next/Core and Builtins/2020-01-25-23-51-17.bpo-39453.xCOkYk.rst b/Misc/NEWS.d/next/Core and Builtins/2020-01-25-23-51-17.bpo-39453.xCOkYk.rst
new file mode 100644
index 0000000000000..8c2e49f9474c4
--- /dev/null
+++ b/Misc/NEWS.d/next/Core and Builtins/2020-01-25-23-51-17.bpo-39453.xCOkYk.rst	
@@ -0,0 +1,2 @@
+Fixed a possible crash in :meth:`list.__contains__` when a list is changed
+during comparing items. Patch by Dong-hee Na.
diff --git a/Objects/listobject.c b/Objects/listobject.c
index 73afc44c39e36..30444089ffaf9 100644
--- a/Objects/listobject.c
+++ b/Objects/listobject.c
@@ -445,12 +445,16 @@ list_length(PyListObject *a)
 static int
 list_contains(PyListObject *a, PyObject *el)
 {
+    PyObject *item;
     Py_ssize_t i;
     int cmp;
 
-    for (i = 0, cmp = 0 ; cmp == 0 && i < Py_SIZE(a); ++i)
-        cmp = PyObject_RichCompareBool(el, PyList_GET_ITEM(a, i),
-                                           Py_EQ);
+    for (i = 0, cmp = 0 ; cmp == 0 && i < Py_SIZE(a); ++i) {
+        item = PyList_GET_ITEM(a, i);
+        Py_INCREF(item);
+        cmp = PyObject_RichCompareBool(el, item, Py_EQ);
+        Py_DECREF(item);
+    }
     return cmp;
 }