fix a segfault when setting __class__ in __del__ #5283

diff --git a/Lib/test/test_descr.py b/Lib/test/test_descr.py
index 05b4486b67d75626b2dc5c339691046613d5458c..ae22af7ffc38a03b5f3761c608c50499e357c17c 100644 (file)
--- a/Lib/test/test_descr.py
+++ b/Lib/test/test_descr.py
@@ -3003,6 +3003,16 @@ order (MRO) for bases """
                     continue
                 cant(cls(), cls2)
 
+        # Issue5283: when __class__ changes in __del__, the wrong
+        # type gets DECREF'd.
+        class O(object):
+            pass
+        class A(object):
+            def __del__(self):
+                self.__class__ = O
+        l = [A() for x in range(100)]
+        del l
+
     def test_set_dict(self):
         # Testing __dict__ assignment...
         class C(object): pass

diff --git a/Misc/NEWS b/Misc/NEWS
index 110044ac4020975f50ec235b78f030a97f5526c1..472c7e602ebdd9b5b8a171329d5ce2ad6bb84860 100644 (file)
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -12,6 +12,8 @@ What's New in Python 2.7 alpha 1
 Core and Builtins
 -----------------
 
+- Issue #5283: Setting __class__ in __del__ caused a segfault.
+
 - Issue #5816: complex(repr(z)) now recovers z exactly, even when
   z involves nans, infs or negative zeros.
 

diff --git a/Objects/typeobject.c b/Objects/typeobject.c
index cf5e2a9a8306fbb4b1447e238dcb4370ba64cb7f..304066f80d3bfed5937dc2d62582d13da83c702b 100644 (file)
--- a/Objects/typeobject.c
+++ b/Objects/typeobject.c
@@ -928,6 +928,9 @@ subtype_dealloc(PyObject *self)
                        assert(base);
                }
 
+               /* Extract the type again; tp_del may have changed it */
+               type = Py_TYPE(self);
+
                /* Call the base tp_dealloc() */
                assert(basedealloc);
                basedealloc(self);
@@ -1009,6 +1012,9 @@ subtype_dealloc(PyObject *self)
                }
        }
 
+       /* Extract the type again; tp_del may have changed it */
+       type = Py_TYPE(self);
+
        /* Call the base tp_dealloc(); first retrack self if
         * basedealloc knows about gc.
         */