For safety, wait to decref deleted values until the deque state has been restored.

diff --git a/Modules/_collectionsmodule.c b/Modules/_collectionsmodule.c
index 7d7f0cfc032f2a12fa80979e3efd3c69d3f6d921..28aacc3317c62beec42a98d8cc38969962ffe060 100644 (file)
--- a/Modules/_collectionsmodule.c
+++ b/Modules/_collectionsmodule.c
@@ -864,9 +864,9 @@ deque_remove(dequeobject *deque, PyObject *value)
         if (cmp > 0) {
             PyObject *tgt = deque_popleft(deque, NULL);
             assert (tgt != NULL);
-            Py_DECREF(tgt);
             if (_deque_rotate(deque, i) == -1)
                 return NULL;
+            Py_DECREF(tgt);
             Py_RETURN_NONE;
         }
         else if (cmp < 0) {
@@ -956,16 +956,16 @@ static int
 deque_del_item(dequeobject *deque, Py_ssize_t i)
 {
     PyObject *item;
+    int rv;
 
     assert (i >= 0 && i < Py_SIZE(deque));
     if (_deque_rotate(deque, -i) == -1)
         return -1;
-
     item = deque_popleft(deque, NULL);
+    rv = _deque_rotate(deque, i);
     assert (item != NULL);
     Py_DECREF(item);
-
-    return _deque_rotate(deque, i);
+    return rv;
 }
 
 static int