Using failmalloc project to inject MemoryError, I found a reference counter issue in OSError constructor. args parameter passed to OSError_new() becomes invalid when OSError constructor fails.

I don't yet where is the bug exactly.


Traces when the bug occurs in test_urllib:

(gdb) where
...
#2  0x0000000000423f80 in Py_FatalError (msg=0x7ffffffd68e0 "Python/ceval.c:4456 object at 0x7fffed6c4ef8 has negative ref count -1")
    at Python/pythonrun.c:2531
#3  0x00000000004bd47f in _Py_NegativeRefcount (fname=0x686618 "Python/ceval.c", lineno=4456, op=(((0x0,),),)) at Objects/object.c:197
#4  0x00000000005a544d in do_call (func=<type at remote 0xcb0588>, pp_stack=0x7ffffffd6ba8, na=1, nk=0) at Python/ceval.c:4456
#5  0x00000000005a4624 in call_function (pp_stack=0x7ffffffd6ba8, oparg=1) at Python/ceval.c:4252
#6  0x000000000059c96e in PyEval_EvalFrameEx (f=
...

(gdb) frame 4
#4  0x00000000005a544d in do_call (func=<type at remote 0xcb0588>, pp_stack=0x7ffffffd6ba8, na=1, nk=0) at Python/ceval.c:4456
4456	    Py_XDECREF(callargs);
(gdb) print callargs
$12 = (((0x0,),),)

(gdb) print _PyObject_Dump(func)
object  : <class 'urllib.error.URLError'>
type    : type
refcount: 16
address : 0xcb0728
$10 = void

New changeset 61a712066770 by Victor Stinner in branch 'default':
Issue #19429, #19437: fix error handling in the OSError constructor
http://hg.python.org/cpython/rev/61a712066770