Message282525
(C6) I didn't try, but it seems that typeobject.c:mro_internal() is prone
to a refcount crash. It does this::
old_mro = type->tp_mro;
...mro_invoke()... /* might cause reentrance */
type->tp_mro = new_mro;
...
Py_XDECREF(old_mro);
This last XDECREF drops the reference held by the previous value of
``type->tp_mro`` after we changed it. But ``type->tp_mro`` might have
changed because of mro_invoke(), which calls pure Python code. If it
did change, then old_mro is no longer the old value of
``type->tp_mro``. The wrong object gets decrefed. |
|
Date |
User |
Action |
Args |
2016-12-06 11:53:06 | arigo | set | recipients:
+ arigo |
2016-12-06 11:53:06 | arigo | set | messageid: <1481025186.28.0.487795876763.issue28883@psf.upfronthosting.co.za> |
2016-12-06 11:53:06 | arigo | link | issue28883 messages |
2016-12-06 11:53:06 | arigo | create | |
|