Author methane
Recipients audric, methane, serhiy.storchaka, vstinner, xiang.zhang
Date 2017-02-04.19:15:48
SpamBayes Score -1.0
Marked as misclassified Yes
Message-id <1486235748.76.0.964233955276.issue29438@psf.upfronthosting.co.za>
In-reply-to
Content
It's similar to issue27945, but different.

I confirmed this issue is in 3.4 too.
https://github.com/python/cpython/blob/3.4/Objects/dictobject.c#L3798

    // _PyObjectDict_SetItem()
    if ((tp->tp_flags & Py_TPFLAGS_HEAPTYPE) && (cached = CACHED_KEYS(tp))) {
    ...
            res = PyDict_DelItem(dict, key);  // <- may run arbitrary code.  CACHED_KEYS(tp) can be changed and cached can be freed here.
            if (cached != ((PyDictObject *)dict)->ma_keys) {
                CACHED_KEYS(tp) = NULL;
                DK_DECREF(cached);  // !!!
            }
        } else {
            res = PyDict_SetItem(dict, key, value); // Same to DelItem().
            if (cached != ((PyDictObject *)dict)->ma_keys) {
                /* Either update tp->ht_cached_keys or delete it */
                if (cached->dk_refcnt == 1) { // !!!
History
Date User Action Args
2017-02-04 19:15:48methanesetrecipients: + methane, vstinner, serhiy.storchaka, xiang.zhang, audric
2017-02-04 19:15:48methanesetmessageid: <1486235748.76.0.964233955276.issue29438@psf.upfronthosting.co.za>
2017-02-04 19:15:48methanelinkissue29438 messages
2017-02-04 19:15:48methanecreate