Message217968
Sorry for the earlier noise. I'm fighting a flu and my head is mush :-(
Anyway, this doesn't look obvious. We get to this point:
if (Py_REFCNT(op) == 1) {
/* op will be destroyed */
gc = gc->gc.gc_prev;
}
and op is the type object for class B. gc gets set to the previous object, a list. Everything looks fine at this point. But when we get back from:
Py_DECREF(op);
the list's gc.gc_next field has been overwritten with NULL. That's why gc gets set to NULL on the next trip through the loop.
I spaced out stepping through all the type deallocation code, and didn't find exactly when the list's gc_next is overwritten. The list's gc_prev is still fine. Perhaps some code called _PyObject_GC_UNTRACK on the list object (which NULLs out the gc_next pointer but not the gc_prev pointer). |
|
Date |
User |
Action |
Args |
2014-05-06 04:51:51 | tim.peters | set | recipients:
+ tim.peters, gvanrossum, pitrou, vstinner, tim.golden, inglesp, Guido.van.Rossum |
2014-05-06 04:51:51 | tim.peters | set | messageid: <1399351911.26.0.882247594837.issue21435@psf.upfronthosting.co.za> |
2014-05-06 04:51:51 | tim.peters | link | issue21435 messages |
2014-05-06 04:51:50 | tim.peters | create | |
|