#2016 Fix a crash in function call when the **kwargs dictionary is mutated

during the function call setup.

This even gives a slight speedup, probably because tuple allocation
is faster than PyMem_NEW.

diff --git a/Lib/test/test_extcall.py b/Lib/test/test_extcall.py
index f4ab204279a5855b473aab8091ca4f29a5ba1a91..a10887e1630a2c63be46fa18bdd4bde8d545ad76 100644 (file)
--- a/Lib/test/test_extcall.py
+++ b/Lib/test/test_extcall.py
@@ -251,6 +251,24 @@ TypeError if te dictionary is not empty
       ...
     TypeError: id() takes no keyword arguments
 
+A corner case of keyword dictionary items being deleted during
+the function call setup. See <http://bugs.python.org/issue2016>.
+
+    >>> class Name(str):
+    ...     def __eq__(self, other):
+    ...         try:
+    ...              del x[self]
+    ...         except KeyError:
+    ...              pass
+    ...         return str.__eq__(self, other)
+    ...     def __hash__(self):
+    ...         return str.__hash__(self)
+
+    >>> x = {Name("a"):1, Name("b"):2}
+    >>> def f(a, b):
+    ...     print a,b
+    >>> f(**x)
+    1 2
 """
 
 import unittest

diff --git a/Misc/NEWS b/Misc/NEWS
index c9c9b55d958ec38867c2d006c01e61163335a1fd..571094ca8817c9a60fab1f74acd0af407bbd22c9 100644 (file)
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -12,6 +12,9 @@ What's New in Python 2.7 alpha 1
 Core and Builtins
 -----------------
 
+- Issue #2016: Fixed a crash in a corner case where the dictionary of keyword
+  arguments could be modified during the function call setup.
+
 - Removed the ipaddr module.
 
 - Issue #6329: Fixed iteration for memoryview objects (it was being blocked

diff --git a/Objects/funcobject.c b/Objects/funcobject.c
index 14484e5b3c30c09a260f65cad0ffe38d4d4ba232..7774e6d1e5e2baa6ecbe039632281f405a9bec98 100644 (file)
--- a/Objects/funcobject.c
+++ b/Objects/funcobject.c
@@ -489,13 +489,14 @@ function_call(PyObject *func, PyObject *arg, PyObject *kw)
 {
        PyObject *result;
        PyObject *argdefs;
+       PyObject *kwtuple = NULL;
        PyObject **d, **k;
        Py_ssize_t nk, nd;
 
        argdefs = PyFunction_GET_DEFAULTS(func);
        if (argdefs != NULL && PyTuple_Check(argdefs)) {
                d = &PyTuple_GET_ITEM((PyTupleObject *)argdefs, 0);
-               nd = PyTuple_Size(argdefs);
+               nd = PyTuple_GET_SIZE(argdefs);
        }
        else {
                d = NULL;
@@ -505,16 +506,17 @@ function_call(PyObject *func, PyObject *arg, PyObject *kw)
        if (kw != NULL && PyDict_Check(kw)) {
                Py_ssize_t pos, i;
                nk = PyDict_Size(kw);
-               k = PyMem_NEW(PyObject *, 2*nk);
-               if (k == NULL) {
-                       PyErr_NoMemory();
+               kwtuple = PyTuple_New(2*nk);
+               if (kwtuple == NULL)
                        return NULL;
-               }
+               k = &PyTuple_GET_ITEM(kwtuple, 0);
                pos = i = 0;
-               while (PyDict_Next(kw, &pos, &k[i], &k[i+1]))
+               while (PyDict_Next(kw, &pos, &k[i], &k[i+1])) {
+                       Py_INCREF(k[i]);
+                       Py_INCREF(k[i+1]);
                        i += 2;
+               }
                nk = i/2;
-               /* XXX This is broken if the caller deletes dict items! */
        }
        else {
                k = NULL;
@@ -524,12 +526,11 @@ function_call(PyObject *func, PyObject *arg, PyObject *kw)
        result = PyEval_EvalCodeEx(
                (PyCodeObject *)PyFunction_GET_CODE(func),
                PyFunction_GET_GLOBALS(func), (PyObject *)NULL,
-               &PyTuple_GET_ITEM(arg, 0), PyTuple_Size(arg),
+               &PyTuple_GET_ITEM(arg, 0), PyTuple_GET_SIZE(arg),
                k, nk, d, nd,
                PyFunction_GET_CLOSURE(func));
 
-       if (k != NULL)
-               PyMem_DEL(k);
+       Py_XDECREF(kwtuple);
 
        return result;
 }