_PyObject_GetDictPtr(): when the offset is negative, always align --

we can't trust that tp_basicsize is aligned.  Fixes SF bug #462848.

diff --git a/Objects/object.c b/Objects/object.c
index 668bd4f33246fee6957f028877bafce94a0973db..6d7a5e9aeb02e205eb69fb621ae2aa4b0a46f673 100644 (file)
--- a/Objects/object.c
+++ b/Objects/object.c
@@ -1150,18 +1150,13 @@ _PyObject_GetDictPtr(PyObject *obj)
                return NULL;
        if (dictoffset < 0) {
                dictoffset += tp->tp_basicsize;
+               dictoffset += tp->tp_itemsize * ((PyVarObject *)obj)->ob_size;
                assert(dictoffset > 0); /* Sanity check */
-               if (tp->tp_itemsize > 0) {
-                       int n = ((PyVarObject *)obj)->ob_size;
-                       if (n > 0) {
-                               dictoffset += tp->tp_itemsize * n;
-                               /* Round up, if necessary */
-                               if (tp->tp_itemsize % PTRSIZE != 0) {
-                                       dictoffset += PTRSIZE - 1;
-                                       dictoffset /= PTRSIZE;
-                                       dictoffset *= PTRSIZE;
-                               }
-                       }
+               /* Round up, if necessary */
+               if (dictoffset % PTRSIZE != 0) {
+                       dictoffset /= PTRSIZE;
+                       dictoffset += 1;
+                       dictoffset *= PTRSIZE;
                }
        }
        return (PyObject **) ((char *)obj + dictoffset);