From: Benjamin Peterson <benjamin@python.org>
Date: Sat, 25 Apr 2009 00:41:22 +0000 (+0000)
Subject: fix a segfault when setting __class__ in __del__ #5283
X-Git-Tag: v2.7a1~1419
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=5083dc552b4e7026c2f405b37d7691131bc96955;p=python

fix a segfault when setting __class__ in __del__ #5283
---

diff --git a/Lib/test/test_descr.py b/Lib/test/test_descr.py
index 05b4486b67..ae22af7ffc 100644
--- a/Lib/test/test_descr.py
+++ b/Lib/test/test_descr.py
@@ -3003,6 +3003,16 @@ order (MRO) for bases """
                     continue
                 cant(cls(), cls2)
 
+        # Issue5283: when __class__ changes in __del__, the wrong
+        # type gets DECREF'd.
+        class O(object):
+            pass
+        class A(object):
+            def __del__(self):
+                self.__class__ = O
+        l = [A() for x in range(100)]
+        del l
+
     def test_set_dict(self):
         # Testing __dict__ assignment...
         class C(object): pass
diff --git a/Misc/NEWS b/Misc/NEWS
index 110044ac40..472c7e602e 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -12,6 +12,8 @@ What's New in Python 2.7 alpha 1
 Core and Builtins
 -----------------
 
+- Issue #5283: Setting __class__ in __del__ caused a segfault.
+
 - Issue #5816: complex(repr(z)) now recovers z exactly, even when
   z involves nans, infs or negative zeros.
 
diff --git a/Objects/typeobject.c b/Objects/typeobject.c
index cf5e2a9a83..304066f80d 100644
--- a/Objects/typeobject.c
+++ b/Objects/typeobject.c
@@ -928,6 +928,9 @@ subtype_dealloc(PyObject *self)
 			assert(base);
 		}
 
+		/* Extract the type again; tp_del may have changed it */
+		type = Py_TYPE(self);
+
 		/* Call the base tp_dealloc() */
 		assert(basedealloc);
 		basedealloc(self);
@@ -1009,6 +1012,9 @@ subtype_dealloc(PyObject *self)
 		}
 	}
 
+	/* Extract the type again; tp_del may have changed it */
+	type = Py_TYPE(self);
+
 	/* Call the base tp_dealloc(); first retrack self if
 	 * basedealloc knows about gc.
 	 */