diff -r c3cec0f77eff Lib/test/test_collections.py --- a/Lib/test/test_collections.py Tue Oct 20 18:22:36 2015 +0300 +++ b/Lib/test/test_collections.py Tue Oct 20 20:41:29 2015 +0300 @@ -2033,6 +2033,30 @@ class OrderedDictTests: items = [('a', 1), ('c', 3), ('b', 2)] self.assertEqual(list(MyOD(items).items()), items) + def test_highly_nested(self): + # Issue 25395: crashes during garbage collection + OrderedDict = self.module.OrderedDict + obj = None + for _ in range(1000): + obj = OrderedDict([(None, obj)]) + del obj + support.gc_collect() + + def test_highly_nested_subclass(self): + # Issue 25395: crashes during garbage collection + OrderedDict = self.module.OrderedDict + deleted = [] + class MyOD(OrderedDict): + def __del__(self): + deleted.append(self.i) + obj = None + for i in range(100): + obj = MyOD([(None, obj)]) + obj.i = i + del obj + support.gc_collect() + self.assertEqual(deleted, list(reversed(range(100)))) + class PurePythonOrderedDictTests(OrderedDictTests, unittest.TestCase): diff -r c3cec0f77eff Misc/NEWS --- a/Misc/NEWS Tue Oct 20 18:22:36 2015 +0300 +++ b/Misc/NEWS Tue Oct 20 20:41:29 2015 +0300 @@ -10,6 +10,9 @@ Release date: XXXX-XX-XX Core and Builtins ----------------- +- Issue #25395: Fix crash when highly nested OrderedDict structures were + garbage collected. + - Issue #25401: Optimize bytes.fromhex() and bytearray.fromhex(): they are now between 2x and 3.5x faster. diff -r c3cec0f77eff Objects/odictobject.c --- a/Objects/odictobject.c Tue Oct 20 18:22:36 2015 +0300 +++ b/Objects/odictobject.c Tue Oct 20 20:41:29 2015 +0300 @@ -1437,17 +1437,28 @@ static PyMemberDef odict_members[] = { static void odict_dealloc(PyODictObject *self) { + PyThreadState *tstate = PyThreadState_GET(); + PyObject_GC_UnTrack(self); - Py_TRASHCAN_SAFE_BEGIN(self); + Py_TRASHCAN_SAFE_BEGIN(self) + Py_XDECREF(self->od_inst_dict); if (self->od_weakreflist != NULL) PyObject_ClearWeakRefs((PyObject *)self); _odict_clear_nodes(self); - Py_TRASHCAN_SAFE_END(self); - /* must be last */ + /* Call the base tp_dealloc(). Since it too uses the trashcan mechanism, + * temporary decrement trash_delete_nesting to prevent triggering it + * and putting the partially deallocated object on the trashcan's + * to-be-deleted-later list. + */ + --tstate->trash_delete_nesting; + assert(_tstate->trash_delete_nesting < PyTrash_UNWIND_LEVEL); PyDict_Type.tp_dealloc((PyObject *)self); + ++tstate->trash_delete_nesting; + + Py_TRASHCAN_SAFE_END(self) }; /* tp_repr */