SF bug #483469: crash on unbounded recursion in __del__.

PyEval_EvalCodeEx():  increment tstate->recursion_depth around the
decref of the frame, because the C stack for this call is still in
use and the decref can lead to __del__ methods getting called.

While this gives tstate->recursion_depth a value proportional to the
depth of the C stack (instead of a small constant no matter how
deeply __del__s recurse), it's not enough to stop the reported crash
when using the default recursion limit on Windows.

Bugfix candidate.

diff --git a/Python/ceval.c b/Python/ceval.c
index 21ee3dbb96c9dfba405950273c752991c8c22154..fd602b0a321a8f88ca32e3047b71a4a9e076064e 100644 (file)
--- a/Python/ceval.c
+++ b/Python/ceval.c
@@ -2560,7 +2560,15 @@ PyEval_EvalCodeEx(PyCodeObject *co, PyObject *globals, PyObject *locals,
 
   fail: /* Jump here from prelude on failure */
 
+       /* decref'ing the frame can cause __del__ methods to get invoked,
+          which can call back into Python.  While we're done with the
+          current Python frame (f), the associated C stack is still in use,
+          so recursion_depth must be boosted for the duration.
+       */
+       assert(tstate != NULL);
+       ++tstate->recursion_depth;
         Py_DECREF(f);
+       --tstate->recursion_depth;
        return retval;
 }