[Python-checkins] python/dist/src/Lib/test test_weakref.py, 1.28, 1.29

[tim_one at users.sourceforge.net]

Update of /cvsroot/python/python/dist/src/Lib/test
In directory sc8-pr-cvs1:/tmp/cvs-serv32659/Lib/test

Modified Files:
	test_weakref.py 
Log Message:
SF bug 840829:  weakref callbacks and gc corrupt memory.

subtype_dealloc():  This left the dying object exposed to gc, so that
if cyclic gc triggered during the weakref callback, gc tried to delete
the dying object a second time.  That's a disaster.  subtype_dealloc()
had a (I hope!) unique problem here, as every normal dealloc routine
untracks the object (from gc) before fiddling with weakrefs etc.  But
subtype_dealloc has obscure technical reasons for re-registering the
dying object with gc (already explained in a large comment block at
the bottom of the function).

The fix amounts to simply refraining from reregistering the dying object
with gc until after the weakref callback (if any) has been called.

This is a critical bug (hard to predict, and causes seemingly random
memory corruption when it occurs).  I'll backport it to 2.3 later.


Index: test_weakref.py
===================================================================
RCS file: /cvsroot/python/python/dist/src/Lib/test/test_weakref.py,v
retrieving revision 1.28
retrieving revision 1.29
diff -C2 -d -r1.28 -r1.29
*** test_weakref.py	14 Jul 2003 21:37:17 -0000	1.28
--- test_weakref.py	12 Nov 2003 20:43:27 -0000	1.29
***************
*** 299,302 ****
--- 299,322 ----
              self.fail("exception not properly restored")
  
+     def test_sf_bug_840829(self):
+         # "weakref callbacks and gc corrupt memory"
+         # subtype_dealloc erroneously exposed a new-style instance
+         # already in the process of getting deallocated to gc,
+         # causing double-deallocation if the instance had a weakref
+         # callback that triggered gc.
+         # If the bug exists, there probably won't be an obvious symptom
+         # in a release build.  In a debug build, a segfault will occur
+         # when the second attempt to remove the instance from the "list
+         # of all objects" occurs.
+ 
+         import gc
+ 
+         class C(object):
+             pass
+ 
+         c = C()
+         wr = weakref.ref(c, lambda ignore: gc.collect())
+         del c
+ 
  
  class Object: