Merged revisions 76763 via svnmerge from

svn+ssh://pythondev@svn.python.org/python/trunk

........
  r76763 | antoine.pitrou | 2009-12-12 20:13:08 +0100 (sam., 12 déc. 2009) | 7 lines

  Issue #7466: segmentation fault when the garbage collector is called
  in the middle of populating a tuple.  Patch by Florent Xicluna.

  (note: no NEWS entry for trunk since the bug was introduced in 2.7/3.1)
........

diff --git a/Lib/test/test_tuple.py b/Lib/test/test_tuple.py
index c37adc25458f7c025be46b9910cef28a5615150c..53065bb2046c6d82408eaa152a0c9c7a45fea76f 100644 (file)
--- a/Lib/test/test_tuple.py
+++ b/Lib/test/test_tuple.py
@@ -146,6 +146,9 @@ class TupleTest(seq_tests.CommonTest):
             pass
         self.check_track_dynamic(MyTuple, True)
 
+    def test_bug7466(self):
+        # Trying to untrack an unfinished tuple could crash Python
+        self._not_tracked(tuple(gc.collect() for i in range(101)))
 
 def test_main():
     support.run_unittest(TupleTest)

diff --git a/Misc/NEWS b/Misc/NEWS
index 850369e1579f191afb0e632bd6732cdb72200d58..d3b26a4e0f724a2a875e401994ea7ff8b807d567 100644 (file)
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -12,6 +12,9 @@ What's New in Python 3.2 Alpha 1?
 Core and Builtins
 -----------------
 
+- Issue #7466: segmentation fault when the garbage collector is called
+  in the middle of populating a tuple.  Patch by Florent Xicluna.
+
 - Issue #7419: setlocale() could crash the interpreter on Windows when called
   with invalid values.
 

diff --git a/Objects/tupleobject.c b/Objects/tupleobject.c
index 290107ad346ca86fda9190f0089ffc48a52d5c20..884174dca4e852e61972d33c8f55665aec77bfc1 100644 (file)
--- a/Objects/tupleobject.c
+++ b/Objects/tupleobject.c
@@ -850,7 +850,8 @@ _PyTuple_Resize(PyObject **pv, Py_ssize_t newsize)
 
        /* XXX UNREF/NEWREF interface should be more symmetrical */
        _Py_DEC_REFTOTAL;
-       _PyObject_GC_UNTRACK(v);
+       if (_PyObject_GC_IS_TRACKED(v))
+               _PyObject_GC_UNTRACK(v);
        _Py_ForgetReference((PyObject *) v);
        /* DECREF items deleted by shrinkage */
        for (i = newsize; i < oldsize; i++) {