merge 3.4 (#24552)

diff --cc Lib/test/pickletester.py
Simple merge

diff --cc Misc/NEWS
index 685ce411933aee56e65927ddfa05b163d07ac8c8,becb9ef1937ea892c54a228b8eb87881a920a338..50b1d0ee31820b899ef7de9f65b8d196cd1ac5f6
--- 1/Misc/NEWS
--- 2/Misc/NEWS
+++ b/Misc/NEWS
@@@ -14,93 -14,6 +14,95 @@@ Core and Builtin
    object now always allocates place for trailing null byte and it's buffer now
    is always null-terminated.
  
 +- Upgrade to Unicode 8.0.0.
 +
 +- Issue #24345: Add Py_tp_finalize slot for the stable ABI.
 +
 +- Issue #24400: Introduce a distinct type for PEP 492 coroutines; add
 +  types.CoroutineType, inspect.getcoroutinestate, inspect.getcoroutinelocals;
 +  coroutines no longer use CO_GENERATOR flag; sys.set_coroutine_wrapper
 +  works only for 'async def' coroutines; inspect.iscoroutine no longer
 +  uses collections.abc.Coroutine, it's intended to test for pure 'async def'
 +  coroutines only; add new opcode: GET_YIELD_FROM_ITER; fix generators wrapper
 +  used in types.coroutine to be instance of collections.abc.Generator;
 +  inspect.isawaitable was removed (use collections.abc.Awaitable).
 +
 +Library
 +-------
 +
++- Issue #24552: Fix use after free in an error case of the _pickle module.
++
 +- Issue #24514: tarfile now tolerates number fields consisting of only
 +  whitespace.
 +
 +- Issue #19176: Fixed doctype() related bugs in C implementation of ElementTree.
 +  A deprecation warning no longer issued by XMLParser subclass with default
 +  doctype() method.  Direct call of doctype() now issues a warning.  Parser's
 +  doctype() now is not called if target's doctype() is called.  Based on patch
 +  by Martin Panter.
 +
 +- Issue #20387: Restore semantic round-trip correctness in tokenize/untokenize
 +  for tab-indented blocks.
 +
 +- Issue #24456: Fixed possible buffer over-read in adpcm2lin() and lin2adpcm()
 +  functions of the audioop module.
 +
 +- Issue #24336: The contextmanager decorator now works with functions with
 +  keyword arguments called "func" and "self".  Patch by Martin Panter.
 +
 +- Issue #24522: Fix possible integer overflow in json accelerator module.
 +
 +- Issue #24489: ensure a previously set C errno doesn't disturb cmath.polar().
 +
 +- Issue #24408: Fixed AttributeError in measure() and metrics() methods of
 +  tkinter.Font.
 +
 +- Issue #14373: C implementation of functools.lru_cache() now can be used with
 +  methods.
 +
 +- Issue #8232: webbrowser support incomplete on Windows. Patch by Brandon
 +  Milam
 +
 +- Issue #24347: Set KeyError if PyDict_GetItemWithError returns NULL.
 +
 +- Issue #24348: Drop superfluous incref/decref.
 +
 +- Issue #24359: Check for changed OrderedDict size during iteration.
 +
 +- Issue #24368: Support keyword arguments in OrderedDict methods.
 +
 +- Issue #24362: Simplify the C OrderedDict fast nodes resize logic.
 +
 +- Issue #24377: Fix a ref leak in OrderedDict.__repr__.
 +
 +- Issue #24369: Defend against key-changes during iteration.
 +
 +Tests
 +-----
 +
 +- Issue #24373: _testmultiphase and xxlimited now use tp_traverse and
 +  tp_finalize to avoid reference leaks encountered when combining tp_dealloc
 +  with PyType_FromSpec (see issue #16690 for details)
 +
 +Documentation
 +-------------
 +
 +- Issue #24351: Clarify what is meant by "identifier" in the context of
 +  string.Template instances.
 +
 +
 +What's New in Python 3.5.0 beta 2?
 +==================================
 +
 +Release date: 2015-05-31
 +
 +Core and Builtins
 +-----------------
 +
 +- Issue #24284: The startswith and endswith methods of the str class no longer
 +  return True when finding the empty string and the indexes are completely out
 +  of range.
 +
  - Issue #24115: Update uses of PyObject_IsTrue(), PyObject_Not(),
    PyObject_IsInstance(), PyObject_RichCompareBool() and _PyDict_Contains()
    to check for and handle errors correctly.

diff --cc Modules/_pickle.c
Simple merge