[Python-checkins] r60871 - in python/trunk: Lib/test/test_scope.py Misc/NEWS Objects/cellobject.c

[amaury.forgeotdarc]

Author: amaury.forgeotdarc
Date: Sat Feb 16 21:55:24 2008
New Revision: 60871

Modified:
   python/trunk/Lib/test/test_scope.py
   python/trunk/Misc/NEWS
   python/trunk/Objects/cellobject.c
Log:
Prevent a crash with nested scopes, again caused by calling Py_DECREF when the pointer
is still present in the containing structure.


Modified: python/trunk/Lib/test/test_scope.py
==============================================================================
--- python/trunk/Lib/test/test_scope.py	(original)
+++ python/trunk/Lib/test/test_scope.py	Sat Feb 16 21:55:24 2008
@@ -597,6 +597,24 @@
 
         f(4)()
 
+    def testFreeingCell(self):
+        # Test what happens when a finalizer accesses
+        # the cell where the object was stored.
+        class Special:
+            def __del__(self):
+                nestedcell_get()
+
+        def f():
+            global nestedcell_get
+            def nestedcell_get():
+                return c
+
+            c = (Special(),)
+            c = 2
+
+        f() # used to crash the interpreter...
+
+
 
 def test_main():
     run_unittest(ScopeTests)

Modified: python/trunk/Misc/NEWS
==============================================================================
--- python/trunk/Misc/NEWS	(original)
+++ python/trunk/Misc/NEWS	Sat Feb 16 21:55:24 2008
@@ -12,6 +12,9 @@
 Core and builtins
 -----------------
 
+- Fixed several potential crashes, all caused by specially crafted __del__
+  methods exploiting objects in temporarily inconsistent state.
+
 - Issue #2115: Important speedup in setting __slot__ attributes.  Also 
   prevent a possible crash: an Abstract Base Class would try to access a slot 
   on a registered virtual subclass.

Modified: python/trunk/Objects/cellobject.c
==============================================================================
--- python/trunk/Objects/cellobject.c	(original)
+++ python/trunk/Objects/cellobject.c	Sat Feb 16 21:55:24 2008
@@ -31,13 +31,15 @@
 int
 PyCell_Set(PyObject *op, PyObject *obj)
 {
+	PyObject* oldobj;
 	if (!PyCell_Check(op)) {
 		PyErr_BadInternalCall();
 		return -1;
 	}
-	Py_XDECREF(((PyCellObject*)op)->ob_ref);
+	oldobj = PyCell_GET(op);
 	Py_XINCREF(obj);
 	PyCell_SET(op, obj);
+	Py_XDECREF(oldobj);
 	return 0;
 }