Vladimir Marangozov:

Avoid calling the dealloc function, previously triggered with
DECREF(inst).  This caused a segfault in PyDict_GetItem, called with a
NULL dict, whenever inst->in_dict fails under low-memory conditions.

diff --git a/Objects/classobject.c b/Objects/classobject.c
index 9e1d1b2b3f97c33977dadc35f21c5fd6504abaca..cd0bb1d9d83fb2d8d54be44666319f7c86ab75a5 100644 (file)
--- a/Objects/classobject.c
+++ b/Objects/classobject.c
@@ -489,13 +489,13 @@ PyInstance_New(class, arg, kw)
        inst = PyObject_NEW(PyInstanceObject, &PyInstance_Type);
        if (inst == NULL)
                return NULL;
-       Py_INCREF(class);
-       inst->in_class = (PyClassObject *)class;
        inst->in_dict = PyDict_New();
        if (inst->in_dict == NULL) {
-               Py_DECREF(inst);
+               PyObject_DEL(inst);
                return NULL;
        }
+       Py_INCREF(class);
+       inst->in_class = (PyClassObject *)class;
        if (initstr == NULL)
                initstr = PyString_InternFromString("__init__");
        init = instance_getattr2(inst, initstr);