Issue #7466: segmentation fault when the garbage collector is called

in the middle of populating a tuple.  Patch by Florent Xicluna.

(note: no NEWS entry for trunk since the bug was introduced in 2.7/3.1)

diff --git a/Lib/test/test_tuple.py b/Lib/test/test_tuple.py
index 6436412b1d973159752a58d945a02b3216f8de5c..2e346425599b52ebcc52e17407a4336deeaba752 100644 (file)
--- a/Lib/test/test_tuple.py
+++ b/Lib/test/test_tuple.py
@@ -146,6 +146,9 @@ class TupleTest(seq_tests.CommonTest):
             pass
         self.check_track_dynamic(MyTuple, True)
 
+    def test_bug7466(self):
+        # Trying to untrack an unfinished tuple could crash Python
+        self._not_tracked(tuple(gc.collect() for i in range(101)))
 
 def test_main():
     test_support.run_unittest(TupleTest)

diff --git a/Objects/tupleobject.c b/Objects/tupleobject.c
index 0a9c71835f9f87be2d6df08a5654558aa264c474..384b83068a62323ce714b7e294ec02bcdf58ee2b 100644 (file)
--- a/Objects/tupleobject.c
+++ b/Objects/tupleobject.c
@@ -875,7 +875,8 @@ _PyTuple_Resize(PyObject **pv, Py_ssize_t newsize)
 
        /* XXX UNREF/NEWREF interface should be more symmetrical */
        _Py_DEC_REFTOTAL;
-       _PyObject_GC_UNTRACK(v);
+       if (_PyObject_GC_IS_TRACKED(v))
+               _PyObject_GC_UNTRACK(v);
        _Py_ForgetReference((PyObject *) v);
        /* DECREF items deleted by shrinkage */
        for (i = newsize; i < oldsize; i++) {