classification
Title: crash in dict_equal
Type: Stage:
Components: Interpreter Core Versions: Python 2.6
process
Status: closed Resolution: fixed
Dependencies: Superseder:
Assigned To: nnorwitz Nosy List: gvanrossum, nnorwitz (2)
Priority: normal Keywords patch

Created on 2006-08-24 22:04 by gvanrossum, last changed 2006-09-05 02:24 by nnorwitz.

Files
File name Uploaded Description Edit Remove
dict_equal.patch.txt gvanrossum, 2006-08-24 22:04 patches to dictobject.c and test_mutants.py
Messages (4)
msg50986 - (view) Author: Guido van Rossum (gvanrossum) Date: 2006-08-24 22:04 
I initially found this bug in the py3k branch, but it's
reproducible in 2.5 as well (and probably older
versions as well, as long as they have dict_equal()). 
It can be reproduced by using the attached patch to
test_mutants.py.

The problem is in this fragment in dict_equal():

 PyObject *key = a->ma_table[i].me_key;
 /* temporarily bump aval's refcount to ensure it stays
                                                  
    alive until we're done with it */
 Py_INCREF(aval);
 bval = PyDict_GetItem((PyObject *)b, key);

The problem is that the only reference to 'key' may be
in the hash table, and test_mutants.py removes it from
the hash table, apparently before the comparison code
is done with using it. The fix is to incref/decref key
around the GetItem call.
msg50987 - (view) Author: Neal Norwitz (nnorwitz) Date: 2006-08-25 00:23 
Logged In: YES 
user_id=33168

Defer until 2.5.1. I'll apply later.  (If I forget, someone
please checkin after 2.5 is out the door.
msg50988 - (view) Author: Neal Norwitz (nnorwitz) Date: 2006-09-05 01:54 
Logged In: YES 
user_id=33168

Committed revision 51713. 2.5
msg50989 - (view) Author: Neal Norwitz (nnorwitz) Date: 2006-09-05 02:24 
Logged In: YES 
user_id=33168

Committed revision 51720. (2.6)
History
Date User Action Args
2006-08-24 22:04:29gvanrossumcreate