Issue #7084: Fix a (very unlikely) crash when printing a list from one

thread, and mutating it from another one.  Patch by Scott Dial.

diff --git a/Misc/ACKS b/Misc/ACKS
index 6383a46a3abe75208191bdda63b178a154312ce4..c8f80e6c2435888f026dc0ae8884a16d6f80f2d8 100644 (file)
--- a/Misc/ACKS
+++ b/Misc/ACKS
@@ -175,6 +175,7 @@ Arnaud Delobelle
 Erik Demaine
 Roger Dev
 Raghuram Devarakonda
+Scott Dial
 Toby Dickenson
 Mark Dickinson
 Jack Diederich

diff --git a/Misc/NEWS b/Misc/NEWS
index 42a8cd9ba77a831e074c51cb8ed2fac0d92c1776..9fc3edc350f1b822c5443fe8018f5868764d0783 100644 (file)
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -12,6 +12,9 @@ What's New in Python 2.7 alpha 1
 Core and Builtins
 -----------------
 
+- Issue #7084: Fix a (very unlikely) crash when printing a list from one
+  thread, and mutating it from another one.  Patch by Scott Dial.
+
 - Issue #1571184: The Unicode database contains properties for more characters.
   The tables for code points representing numeric values, white spaces or line
   breaks are now generated from the official Unicode Character Database files,

diff --git a/Objects/listobject.c b/Objects/listobject.c
index 98d7e473549e0a2c557a0754fc0ea64ac38fbf3a..c5b147580292c55ccca97509d3f0b23482c3303c 100644 (file)
--- a/Objects/listobject.c
+++ b/Objects/listobject.c
@@ -319,6 +319,7 @@ list_print(PyListObject *op, FILE *fp, int flags)
 {
        int rc;
        Py_ssize_t i;
+       PyObject *item;
 
        rc = Py_ReprEnter((PyObject*)op);
        if (rc != 0) {
@@ -333,15 +334,19 @@ list_print(PyListObject *op, FILE *fp, int flags)
        fprintf(fp, "[");
        Py_END_ALLOW_THREADS
        for (i = 0; i < Py_SIZE(op); i++) {
+               item = op->ob_item[i];
+               Py_INCREF(item);
                if (i > 0) {
                        Py_BEGIN_ALLOW_THREADS
                        fprintf(fp, ", ");
                        Py_END_ALLOW_THREADS
                }
-               if (PyObject_Print(op->ob_item[i], fp, 0) != 0) {
+               if (PyObject_Print(item, fp, 0) != 0) {
+                       Py_DECREF(item);
                        Py_ReprLeave((PyObject *)op);
                        return -1;
                }
+               Py_DECREF(item);
        }
        Py_BEGIN_ALLOW_THREADS
        fprintf(fp, "]");