From: Antoine Pitrou <solipsis@pitrou.net>
Date: Sat, 12 Dec 2009 19:13:08 +0000 (+0000)
Subject: Issue #7466: segmentation fault when the garbage collector is called
X-Git-Tag: v2.7a2~187
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=c169c781a807e0d0e1463d510be9523b1d6c2689;p=python

Issue #7466: segmentation fault when the garbage collector is called
in the middle of populating a tuple.  Patch by Florent Xicluna.

(note: no NEWS entry for trunk since the bug was introduced in 2.7/3.1)
---

diff --git a/Lib/test/test_tuple.py b/Lib/test/test_tuple.py
index 6436412b1d..2e34642559 100644
--- a/Lib/test/test_tuple.py
+++ b/Lib/test/test_tuple.py
@@ -146,6 +146,9 @@ class TupleTest(seq_tests.CommonTest):
             pass
         self.check_track_dynamic(MyTuple, True)
 
+    def test_bug7466(self):
+        # Trying to untrack an unfinished tuple could crash Python
+        self._not_tracked(tuple(gc.collect() for i in range(101)))
 
 def test_main():
     test_support.run_unittest(TupleTest)
diff --git a/Objects/tupleobject.c b/Objects/tupleobject.c
index 0a9c71835f..384b83068a 100644
--- a/Objects/tupleobject.c
+++ b/Objects/tupleobject.c
@@ -875,7 +875,8 @@ _PyTuple_Resize(PyObject **pv, Py_ssize_t newsize)
 
 	/* XXX UNREF/NEWREF interface should be more symmetrical */
 	_Py_DEC_REFTOTAL;
-	_PyObject_GC_UNTRACK(v);
+	if (_PyObject_GC_IS_TRACKED(v))
+		_PyObject_GC_UNTRACK(v);
 	_Py_ForgetReference((PyObject *) v);
 	/* DECREF items deleted by shrinkage */
 	for (i = newsize; i < oldsize; i++) {