Merged revisions 71862 via svnmerge from

svn+ssh://pythondev@svn.python.org/python/branches/py3k

................
  r71862 | benjamin.peterson | 2009-04-24 20:08:45 -0500 (Fri, 24 Apr 2009) | 9 lines

  Merged revisions 71860 via svnmerge from
  svn+ssh://pythondev@svn.python.org/python/trunk

  ........
    r71860 | benjamin.peterson | 2009-04-24 19:41:22 -0500 (Fri, 24 Apr 2009) | 1 line

    fix a segfault when setting __class__ in __del__ #5283
  ........
................

diff --git a/Lib/test/test_descr.py b/Lib/test/test_descr.py
index 8b27af050b1d7879bafbf0c33ce0eb415a5f1749..073305f5b9c63be6b61429b35f4e08a741073aaa 100644 (file)
--- a/Lib/test/test_descr.py
+++ b/Lib/test/test_descr.py
@@ -2712,6 +2712,16 @@ order (MRO) for bases """
                     continue
                 cant(cls(), cls2)
 
+        # Issue5283: when __class__ changes in __del__, the wrong
+        # type gets DECREF'd.
+        class O(object):
+            pass
+        class A(object):
+            def __del__(self):
+                self.__class__ = O
+        l = [A() for x in range(100)]
+        del l
+
     def test_set_dict(self):
         # Testing __dict__ assignment...
         class C(object): pass

diff --git a/Misc/NEWS b/Misc/NEWS
index f867d84700d7be4d7a49a6334e04e1ec2b7cdcd2..8c6e6302d7dfc578fbc4147a42ef504c6b752371 100644 (file)
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -16,6 +16,8 @@ Core and Builtins
   imp.find_module() were converted to UTF-8 while the path is
   converted to the default filesystem encoding, causing nonsense.
 
+- Issue #5283: Setting __class__ in __del__ caused a segfault.
+
 - Issue #5759: float() didn't call __float__ on str subclasses.
 
 - Issue #5787: object.__getattribute__(some_type, "__bases__") segfaulted on

diff --git a/Objects/typeobject.c b/Objects/typeobject.c
index e7f68d693ede144bc056ca35e65d2a66c88cfadc..fa6250b18f6c9d01592618fc4d551ae6427ebadf 100644 (file)
--- a/Objects/typeobject.c
+++ b/Objects/typeobject.c
@@ -877,6 +877,9 @@ subtype_dealloc(PyObject *self)
                        assert(base);
                }
 
+               /* Extract the type again; tp_del may have changed it */
+               type = Py_TYPE(self);
+
                /* Call the base tp_dealloc() */
                assert(basedealloc);
                basedealloc(self);
@@ -958,6 +961,9 @@ subtype_dealloc(PyObject *self)
                }
        }
 
+       /* Extract the type again; tp_del may have changed it */
+       type = Py_TYPE(self);
+
        /* Call the base tp_dealloc(); first retrack self if
         * basedealloc knows about gc.
         */