➜

This issue tracker has been migrated to GitHub, and is currently read-only.
For more information, see the GitHub FAQs in the Python's Developer Guide.

Author vstinner
Recipients arigo, vstinner
Date 2012-03-09.00:05:36
SpamBayes Score 3.6328881e-06
Marked as misclassified No
Message-id <1331251537.37.0.172100522309.issue14231@psf.upfronthosting.co.za>
In-reply-to
Content 
Lib/test/crashers/borrowed_ref_1.py contains the docstring:
"_PyType_Lookup() returns a borrowed reference.
This attacks the call in dictobject.c."
The file was added by Armin in 2006 by the changeset 4dd1a9383e47.

I just fixed #14211 which was a similar bug (Lib/test/crashers/borrowed_ref_2.py), but I'm unable to reproduce this one.

Extract of dict_subscript():

            missing = _PyObject_LookupSpecial((PyObject *)mp, &PyId___missing__);
            if (missing != NULL) {
                res = PyObject_CallFunctionObjArgs(missing,
                                                   key, NULL);
                Py_DECREF(missing);
                return res;
            }

I fail to see how missing can be destroyed before being used. Is it a problem that missing is destroyed while we are calling it?

How can I trigger the crash in gdb?
History
Date User Action Args
2012-03-09 00:05:37vstinnersetrecipients: + vstinner, arigo
2012-03-09 00:05:37vstinnersetmessageid: <1331251537.37.0.172100522309.issue14231@psf.upfronthosting.co.za>
2012-03-09 00:05:36vstinnerlinkissue14231 messages
2012-03-09 00:05:36vstinnercreate