Fix two crashers (borrowed_ref_[34].py from the trunk).

diff --git a/Python/bltinmodule.c b/Python/bltinmodule.c
index ceb2fc77f42a0b15ef3051298a011ee6d4724475..f82430cba6fbdace0852b25f022d600478ca2e53 100644 (file)
--- a/Python/bltinmodule.c
+++ b/Python/bltinmodule.c
@@ -1218,11 +1218,14 @@ min_max(PyObject *args, PyObject *kwds, int op)
                                "%s() got an unexpected keyword argument", name);
                        return NULL;
                }
+               Py_INCREF(keyfunc);
        }
 
        it = PyObject_GetIter(v);
-       if (it == NULL)
+       if (it == NULL) {
+               Py_XDECREF(keyfunc);
                return NULL;
+       }
 
        maxitem = NULL; /* the result */
        maxval = NULL;  /* the value associated with the result */
@@ -1271,6 +1274,7 @@ min_max(PyObject *args, PyObject *kwds, int op)
        else
                Py_DECREF(maxval);
        Py_DECREF(it);
+       Py_XDECREF(keyfunc);
        return maxitem;
 
 Fail_it_item_and_val:
@@ -1281,6 +1285,7 @@ Fail_it:
        Py_XDECREF(maxval);
        Py_XDECREF(maxitem);
        Py_DECREF(it);
+       Py_XDECREF(keyfunc);
        return NULL;
 }
 

diff --git a/Python/ceval.c b/Python/ceval.c
index 4f6b731f2bed3a2f07f145f6d51794e726461cb6..06d524b275d118a863e618f3597fb0bd31fdf27f 100644 (file)
--- a/Python/ceval.c
+++ b/Python/ceval.c
@@ -2036,6 +2036,7 @@ PyEval_EvalFrameEx(PyFrameObject *f, int throwflag)
                                                "__import__ not found");
                                break;
                        }
+                       Py_INCREF(x);
                        v = POP();
                        u = TOP();
                        if (PyInt_AsLong(u) != -1 || PyErr_Occurred())
@@ -2057,11 +2058,14 @@ PyEval_EvalFrameEx(PyFrameObject *f, int throwflag)
                        Py_DECREF(u);
                        if (w == NULL) {
                                u = POP();
+                               Py_DECREF(x);
                                x = NULL;
                                break;
                        }
                        READ_TIMESTAMP(intr0);
-                       x = PyEval_CallObject(x, w);
+                       v = x;
+                       x = PyEval_CallObject(v, w);
+                       Py_DECREF(v);
                        READ_TIMESTAMP(intr1);
                        Py_DECREF(w);
                        SET_TOP(x);