[Python-Dev] XXX - in funcobject.c

[Amaury Forgeot d'Arc]

Guido van Rossum wrote:
> I think we really *are* talking about the caller -- the caller owns
> the dict, if it managed to delete something from the dict before the
> callee can incref it, you'd have trouble. I don't immediately see how
> this could happen, which is probably why I left it as an XXX
> comment...

I found one way to call python code before the callee can incref the
args: the __eq__ between variable names and the dict entries. The
following snippet crashes the trunk version on win32:

class Name(str):
  def __eq__(self, other):
     del d[self]
     return str.__eq__(self, other)
  def __hash__(self):
     return str.__hash__(self)

d = {Name("a"):1, Name("b"):2}
def f(a, b): print a,b

f(**d)   # Segfault


There are several variants of this crasher; they all have more than
one keyword argument, and keywords strings must override __eq__ or
__hash__.
I could not find any other way to execute python code in this area.

-- 
Amaury Forgeot d'Arc