Defer deleted item decref until after the deque is restored to a consistent state.

diff --git a/Misc/NEWS b/Misc/NEWS
index c52ad729eb889e1b85954412e6e7e596a83e412d..9eaaf58155df4aef7216c6f3a4a3988a3d589e58 100644 (file)
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -45,6 +45,10 @@ Library
 - Issues #24099, #24100, and #24101: Fix free-after-use bug in heapq's siftup
   and siftdown functions.
 
+- Backport collections.deque fixes from Python 3.5.  Prevents reentrant badness
+  during deletion by deferring the decref until the container has been restored
+  to a consistent state.
+
 - Issue #23008: Fixed resolving attributes with boolean value is False in pydoc.
 
 - Fix asyncio issue 235: LifoQueue and PriorityQueue's put didn't

diff --git a/Modules/_collectionsmodule.c b/Modules/_collectionsmodule.c
index c1aa9a30bcd72737ec1a54a382263526791a7f0c..627fad57539313fe4167ebcc6625fcb1ac4e2c78 100644 (file)
--- a/Modules/_collectionsmodule.c
+++ b/Modules/_collectionsmodule.c
@@ -698,9 +698,9 @@ deque_remove(dequeobject *deque, PyObject *value)
         if (cmp > 0) {
             PyObject *tgt = deque_popleft(deque, NULL);
             assert (tgt != NULL);
-            Py_DECREF(tgt);
-            if (_deque_rotate(deque, i) == -1)
+            if (_deque_rotate(deque, i))
                 return NULL;
+            Py_DECREF(tgt);
             Py_RETURN_NONE;
         }
         else if (cmp < 0) {
@@ -781,16 +781,16 @@ static int
 deque_del_item(dequeobject *deque, Py_ssize_t i)
 {
     PyObject *item;
+    int rv;
 
     assert (i >= 0 && i < Py_SIZE(deque));
-    if (_deque_rotate(deque, -i) == -1)
+    if (_deque_rotate(deque, -i))
         return -1;
-
     item = deque_popleft(deque, NULL);
+    rv = _deque_rotate(deque, i);
     assert (item != NULL);
     Py_DECREF(item);
-
-    return _deque_rotate(deque, i);
+    return rv;
 }
 
 static int