Fix SF bug #1546288, crash in dict_equal

diff --git a/Lib/test/test_mutants.py b/Lib/test/test_mutants.py
index df58944d884f53d06131c9807ad3482aadd2755d..a219450b2556e96cbd47606bacb2d2b5e62d77af 100644 (file)
--- a/Lib/test/test_mutants.py
+++ b/Lib/test/test_mutants.py
@@ -91,12 +91,17 @@ class Horrid:
         self.hashcode = random.randrange(1000000000)
 
     def __hash__(self):
+        return 42
         return self.hashcode
 
     def __cmp__(self, other):
         maybe_mutate()   # The point of the test.
         return cmp(self.i, other.i)
 
+    def __eq__(self, other):
+        maybe_mutate()   # The point of the test.
+        return self.i == other.i
+
     def __repr__(self):
         return "Horrid(%d)" % self.i
 
@@ -132,7 +137,10 @@ def test_one(n):
     while dict1 and len(dict1) == len(dict2):
         if verbose:
             print ".",
-        c = cmp(dict1, dict2)
+        if random.random() < 0.5:
+            c = cmp(dict1, dict2)
+        else:
+            c = dict1 == dict2
     if verbose:
         print
 

diff --git a/Misc/NEWS b/Misc/NEWS
index 3b9dba0f0023b7e2a4e64c1028dc177094ba39c3..3275c7af27bbc143121786bc28b99b0ffbb23d43 100644 (file)
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -9,6 +9,13 @@ What's New in Python 2.5?
 
 *Release date: XX-SEP-2006*
 
+(Hopefully nothing.)
+
+What's New in Python 2.5 release candidate 2?
+=============================================
+
+*Release date: XX-SEP-2006*
+
 Core and builtins
 -----------------
 
@@ -18,12 +25,14 @@ Core and builtins
 - Patch #1541585: fix buffer overrun when performing repr() on
   a unicode string in a build with wide unicode (UCS-4) support.
 
+- Patch #1546288: fix seg fault in dict_equal due to ref counting bug.
+
 
 Library
 -------
 
 - Patch #1550886: Fix decimal module context management implementation
-  to match the localcontext() example from PEP 343
+  to match the localcontext() example from PEP 343.
 
 - Bug #1541863: uuid.uuid1 failed to generate unique identifiers
   on systems with low clock resolution.

diff --git a/Objects/dictobject.c b/Objects/dictobject.c
index f3b6b7fda6a23f12317c4d8bb41c2ef8638ba7f0..4e827980b57f88241554756595d3e5454b9fe09b 100644 (file)
--- a/Objects/dictobject.c
+++ b/Objects/dictobject.c
@@ -1585,7 +1585,10 @@ dict_equal(dictobject *a, dictobject *b)
                        /* temporarily bump aval's refcount to ensure it stays
                           alive until we're done with it */
                        Py_INCREF(aval);
+                       /* ditto for key */
+                       Py_INCREF(key);
                        bval = PyDict_GetItem((PyObject *)b, key);
+                       Py_DECREF(key);
                        if (bval == NULL) {
                                Py_DECREF(aval);
                                return 0;