From: Victor Stinner <victor.stinner@gmail.com>
Date: Tue, 13 Sep 2016 14:56:38 +0000 (+0200)
Subject: Fix _PyDict_Pop() on pending key
X-Git-Tag: v3.6.0b2~226
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=d0ad11f6b4b0c617b5b57f0dbc97a2a173f6309b;p=thirdparty%2FPython%2Fcpython.git

Fix _PyDict_Pop() on pending key

Issue #28120: Fix dict.pop() for splitted dictionary when trying to remove a
"pending key" (Not yet inserted in split-table).

Patch by Xiang Zhang.
---

diff --git a/Lib/test/test_dict.py b/Lib/test/test_dict.py
index fb954c813257..ed66ddbcb4ec 100644
--- a/Lib/test/test_dict.py
+++ b/Lib/test/test_dict.py
@@ -891,6 +891,15 @@ class DictTest(unittest.TestCase):
         self.assertEqual(list(a), ['x', 'z', 'y'])
         self.assertEqual(list(b), ['x', 'y', 'z'])
 
+    @support.cpython_only
+    def test_splittable_pop_pending(self):
+        """pop a pending key in a splitted table should not crash"""
+        a, b = self.make_shared_key_dict(2)
+
+        a['a'] = 4
+        with self.assertRaises(KeyError):
+            b.pop('a')
+
     @support.cpython_only
     def test_splittable_popitem(self):
         """split table must be combined when d.popitem()"""
diff --git a/Misc/NEWS b/Misc/NEWS
index 34c3748ee4f5..57f1b5393859 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -10,6 +10,9 @@ What's New in Python 3.6.0 beta 2
 Core and Builtins
 -----------------
 
+- Issue #28120: Fix dict.pop() for splitted dictionary when trying to remove a
+  "pending key" (Not yet inserted in split-table). Patch by Xiang Zhang.
+
 Library
 -------
 
diff --git a/Objects/dictobject.c b/Objects/dictobject.c
index bb5962a1a5e2..06c54b566550 100644
--- a/Objects/dictobject.c
+++ b/Objects/dictobject.c
@@ -1721,7 +1721,7 @@ _PyDict_Pop(PyDictObject *mp, PyObject *key, PyObject *deflt)
     ix = (mp->ma_keys->dk_lookup)(mp, key, hash, &value_addr, &hashpos);
     if (ix == DKIX_ERROR)
         return NULL;
-    if (ix == DKIX_EMPTY) {
+    if (ix == DKIX_EMPTY || *value_addr == NULL) {
         if (deflt) {
             Py_INCREF(deflt);
             return deflt;