Fix for

[ 587875 ] crash on deleting extended slice

The array code got simpler, always a good thing!

diff --git a/Lib/test/test_array.py b/Lib/test/test_array.py
index 023af9ae1604b6668a06a4b1efd942914ee0f98e..b650033292fc64574e1608db84a5725aaf1d582f 100755 (executable)
--- a/Lib/test/test_array.py
+++ b/Lib/test/test_array.py
@@ -336,6 +336,9 @@ def testtype(type, example):
         a = array.array(type, range(5))
         del a[1::-2]
         vereq(a, array.array(type, [0,2,3,4]))
+        a = array.array(type, range(10))
+        del a[::1000]
+        vereq(a, array.array(type, [1,2,3,4,5,6,7,8,9]))
         #  assignment
         a = array.array(type, range(10))
         a[::2] = array.array(type, [-1]*5)

diff --git a/Lib/test/test_types.py b/Lib/test/test_types.py
index 7efca216fe6c3bf781c8ae9e8a02a2fbd224fab7..a38eb7f7d4dd18e05a3f215468c8d6d93cd6271e 100644 (file)
--- a/Lib/test/test_types.py
+++ b/Lib/test/test_types.py
@@ -405,6 +405,9 @@ vereq(a, [0,2,4])
 a = range(5)
 del a[1::-2]
 vereq(a, [0,2,3,4])
+a = range(10)
+del a[::1000]
+vereq(a, [1, 2, 3, 4, 5, 6, 7, 8, 9])
 #  assignment
 a = range(10)
 a[::2] = [-1]*5

diff --git a/Modules/arraymodule.c b/Modules/arraymodule.c
index 8a79027d6a299200291daa670cf06f9f74ede67a..e757d9f4943222b7b2745e3b6201668f6c55c2bb 100644 (file)
--- a/Modules/arraymodule.c
+++ b/Modules/arraymodule.c
@@ -1564,7 +1564,7 @@ array_ass_subscr(arrayobject* self, PyObject* item, PyObject* value)
 
                if (value == NULL) {
                        /* delete slice */
-                       int cur, i;
+                       int cur, i, extra;
                        
                        if (slicelength <= 0)
                                return 0;
@@ -1575,16 +1575,17 @@ array_ass_subscr(arrayobject* self, PyObject* item, PyObject* value)
                                step = -step;
                        }
 
-                       for (cur = start, i = 0; cur < stop; 
+                       for (cur = start, i = 0; i < slicelength - 1;
                             cur += step, i++) {
                                memmove(self->ob_item + (cur - i)*itemsize,
                                        self->ob_item + (cur + 1)*itemsize,
                                        (step - 1) * itemsize);
                        }
-                       if (self->ob_size > (start + slicelength*step)) {
-                               memmove(self->ob_item + (start + slicelength*(step - 1))*itemsize,
-                                       self->ob_item + (start + slicelength*step)*itemsize,
-                                       (self->ob_size - (start + slicelength*step))*itemsize);
+                       extra = self->ob_size - (cur + 1);
+                       if (extra > 0) {
+                               memmove(self->ob_item + (cur - i)*itemsize,
+                                       self->ob_item + (cur + 1)*itemsize,
+                                       extra*itemsize);
                        }
 
                        self->ob_size -= slicelength;

diff --git a/Objects/listobject.c b/Objects/listobject.c
index 1aa68ed7be8e716ea77ca9d7dc5699db5284da96..9a1a6b4705e9897247ceb73cdf5fd4ee2bbcefdd 100644 (file)
--- a/Objects/listobject.c
+++ b/Objects/listobject.c
@@ -1780,11 +1780,16 @@ list_ass_subscript(PyListObject* self, PyObject* item, PyObject* value)
                           understand these for loops */
                        for (cur = start, i = 0;
                             cur < stop;
-                            cur += step, i++)
-                       {
+                            cur += step, i++) {
+                               int lim = step;
+
                                garbage[i] = PyList_GET_ITEM(self, cur);
 
-                               for (j = 0; j < step; j++) {
+                               if (cur + step >= self->ob_size) {
+                                       lim = self->ob_size - cur - 1;
+                               }
+
+                               for (j = 0; j < lim; j++) {
                                        PyList_SET_ITEM(self, cur + j - i,
                                                PyList_GET_ITEM(self,
                                                                cur + j + 1));