Issue 8420: Fix obscure set crashers.

diff --git a/Lib/test/test_set.py b/Lib/test/test_set.py
index ff88a3485b57ce352cfc8b26dbea3ce1b08bf29a..c9d04668a874d161e7d41a45ff99c46f48450ed0 100644 (file)
--- a/Lib/test/test_set.py
+++ b/Lib/test/test_set.py
@@ -1660,6 +1660,39 @@ class TestVariousIteratorArgs(unittest.TestCase):
                 self.assertRaises(TypeError, getattr(set('january'), methname), N(data))
                 self.assertRaises(ZeroDivisionError, getattr(set('january'), methname), E(data))
 
+class bad_eq:
+    def __eq__(self, other):
+        if be_bad:
+            set2.clear()
+            raise ZeroDivisionError
+        return self is other
+    def __hash__(self):
+        return 0
+
+class bad_dict_clear:
+    def __eq__(self, other):
+        if be_bad:
+            dict2.clear()
+        return self is other
+    def __hash__(self):
+        return 0
+
+class Test_Weird_Bugs(unittest.TestCase):
+    def test_8420_set_merge(self):
+        # This used to segfault
+        global be_bad, set2, dict2
+        be_bad = False
+        set1 = {bad_eq()}
+        set2 = {bad_eq() for i in range(75)}
+        be_bad = True
+        self.assertRaises(ZeroDivisionError, set1.update, set2)
+
+        be_bad = False
+        set1 = {bad_dict_clear()}
+        dict2 = {bad_dict_clear(): None}
+        be_bad = True
+        set1.symmetric_difference_update(dict2)
+
 # Application tests (based on David Eppstein's graph recipes ====================================
 
 def powerset(U):
@@ -1804,6 +1837,7 @@ def test_main(verbose=None):
         TestIdentities,
         TestVariousIteratorArgs,
         TestGraphs,
+        Test_Weird_Bugs,
         )
 
     support.run_unittest(*test_classes)

diff --git a/Objects/setobject.c b/Objects/setobject.c
index a99beec36c697e477ff973ef6c972c260acdd18a..6cd90b1f164d88e06c98811b869ec38147e93af5 100644 (file)
--- a/Objects/setobject.c
+++ b/Objects/setobject.c
@@ -364,12 +364,13 @@ static int
 set_add_entry(register PySetObject *so, setentry *entry)
 {
     register Py_ssize_t n_used;
+    PyObject *key = entry->key;
 
     assert(so->fill <= so->mask);  /* at least one empty slot */
     n_used = so->used;
-    Py_INCREF(entry->key);
-    if (set_insert_key(so, entry->key, (long) entry->hash) == -1) {
-        Py_DECREF(entry->key);
+    Py_INCREF(key);
+    if (set_insert_key(so, key, (long) entry->hash) == -1) {
+        Py_DECREF(key);
         return -1;
     }
     if (!(so->used > n_used && so->fill*3 >= (so->mask+1)*2))
@@ -637,6 +638,7 @@ static int
 set_merge(PySetObject *so, PyObject *otherset)
 {
     PySetObject *other;
+    PyObject *key;
     register Py_ssize_t i;
     register setentry *entry;
 
@@ -657,11 +659,12 @@ set_merge(PySetObject *so, PyObject *otherset)
     }
     for (i = 0; i <= other->mask; i++) {
         entry = &other->table[i];
-        if (entry->key != NULL &&
-            entry->key != dummy) {
-            Py_INCREF(entry->key);
-            if (set_insert_key(so, entry->key, (long) entry->hash) == -1) {
-                Py_DECREF(entry->key);
+        key = entry->key;
+        if (key != NULL &&
+            key != dummy) {
+            Py_INCREF(key);
+            if (set_insert_key(so, key, (long) entry->hash) == -1) {
+                Py_DECREF(key);
                 return -1;
             }
         }
@@ -1642,15 +1645,22 @@ set_symmetric_difference_update(PySetObject *so, PyObject *other)
         while (_PyDict_Next(other, &pos, &key, &value, &hash)) {
             setentry an_entry;
 
+            Py_INCREF(key);
             an_entry.hash = hash;
             an_entry.key = key;
+
             rv = set_discard_entry(so, &an_entry);
-            if (rv == -1)
+                       if (rv == -1) {
+                Py_DECREF(key);
                 return NULL;
+            }
             if (rv == DISCARD_NOTFOUND) {
-                if (set_add_entry(so, &an_entry) == -1)
+                if (set_add_entry(so, &an_entry) == -1) {
+                    Py_DECREF(key);
                     return NULL;
+                }
             }
+                       Py_DECREF(key);
         }
         Py_RETURN_NONE;
     }