diff -r e8f3c011e2b4 Lib/test/test_descr.py --- a/Lib/test/test_descr.py Mon Nov 02 15:06:09 2015 +0200 +++ b/Lib/test/test_descr.py Tue Nov 03 18:43:27 2015 +0200 @@ -4763,6 +4763,26 @@ class PTypesLongInitTest(unittest.TestCa type.mro(tuple) +class PicklingTests(unittest.TestCase): + + def test_issue24097(self): + # Slot name is freed inside __getattr__ and is later used. + class S(str): # Not interned + pass + class A(object): + __slotnames__ = [S('spam')] + def __getattr__(self, attr): + if attr == 'spam': + A.__slotnames__[:] = [S('spam')] + return 42 + else: + raise AttributeError + + import copy_reg + expected = (copy_reg.__newobj__, (A,), ({}, {'spam': 42}), None, None) + self.assertEqual(A().__reduce__(2), expected) + + def test_main(): deprecations = [(r'complex divmod\(\), // and % are deprecated$', DeprecationWarning)] @@ -4774,7 +4794,8 @@ def test_main(): with test_support.check_warnings(*deprecations): # Run all local test cases, with PTypesLongInitTest first. test_support.run_unittest(PTypesLongInitTest, OperatorsTest, - ClassPropertiesAndMethods, DictProxyTests) + ClassPropertiesAndMethods, DictProxyTests, + PicklingTests) if __name__ == "__main__": test_main() diff -r e8f3c011e2b4 Misc/NEWS --- a/Misc/NEWS Mon Nov 02 15:06:09 2015 +0200 +++ b/Misc/NEWS Tue Nov 03 18:43:27 2015 +0200 @@ -10,6 +10,9 @@ What's New in Python 2.7.11? Core and Builtins ----------------- +- Issue #24097: Fixed crash in object.__reduce__() if slot name is freed inside + __getattr__. + - Issue #24806: Prevent builtin types that are not allowed to be subclassed from being subclassed through multiple inheritance. diff -r e8f3c011e2b4 Objects/typeobject.c --- a/Objects/typeobject.c Mon Nov 02 15:06:09 2015 +0200 +++ b/Objects/typeobject.c Tue Nov 03 18:43:27 2015 +0200 @@ -3262,12 +3262,16 @@ reduce_2(PyObject *obj) for (i = 0; i < PyList_GET_SIZE(names); i++) { PyObject *name, *value; name = PyList_GET_ITEM(names, i); + Py_INCREF(name); value = PyObject_GetAttr(obj, name); - if (value == NULL) + if (value == NULL) { + Py_DECREF(name); PyErr_Clear(); + } else { int err = PyDict_SetItem(slots, name, value); + Py_DECREF(name); Py_DECREF(value); if (err) goto end;