changeset:   99357:99839a1c9c6d
branch:      3.5
parent:      99353:46e95e0eaae5
parent:      99356:eed36e19f8b8
user:        Serhiy Storchaka <storchaka@gmail.com>
date:        Wed Nov 25 18:34:19 2015 +0200
files:       Lib/test/test_descr.py Misc/NEWS Objects/typeobject.c
description:
Issue #24097: Fixed crash in object.__reduce__() if slot name is freed inside
__getattr__.  Original patch by Antoine Pitrou.


diff -r 46e95e0eaae5 -r 99839a1c9c6d Lib/test/test_descr.py
--- a/Lib/test/test_descr.py	Wed Nov 25 17:12:02 2015 +0200
+++ b/Lib/test/test_descr.py	Wed Nov 25 18:34:19 2015 +0200
@@ -5092,6 +5092,23 @@
                     objcopy2 = deepcopy(objcopy)
                     self._assert_is_copy(obj, objcopy2)
 
+    def test_issue24097(self):
+        # Slot name is freed inside __getattr__ and is later used.
+        class S(str):  # Not interned
+            pass
+        class A:
+            __slotnames__ = [S('spam')]
+            def __getattr__(self, attr):
+                if attr == 'spam':
+                    A.__slotnames__[:] = [S('spam')]
+                    return 42
+                else:
+                    raise AttributeError
+
+        import copyreg
+        expected = (copyreg.__newobj__, (A,), (None, {'spam': 42}), None, None)
+        self.assertEqual(A().__reduce__(2), expected)  # Shouldn't crash
+
 
 class SharedKeyTests(unittest.TestCase):
 
diff -r 46e95e0eaae5 -r 99839a1c9c6d Misc/NEWS
--- a/Misc/NEWS	Wed Nov 25 17:12:02 2015 +0200
+++ b/Misc/NEWS	Wed Nov 25 18:34:19 2015 +0200
@@ -10,6 +10,9 @@
 Core and Builtins
 -----------------
 
+- Issue #24097: Fixed crash in object.__reduce__() if slot name is freed inside
+  __getattr__.
+
 - Issue #24731: Fixed crash on converting objects with special methods
   __bytes__, __trunc__, and __float__ returning instances of subclasses of
   bytes, int, and float to subclasses of bytes, int, and float correspondingly.
diff -r 46e95e0eaae5 -r 99839a1c9c6d Objects/typeobject.c
--- a/Objects/typeobject.c	Wed Nov 25 17:12:02 2015 +0200
+++ b/Objects/typeobject.c	Wed Nov 25 18:34:19 2015 +0200
@@ -3889,8 +3889,10 @@
                 PyObject *name, *value;
 
                 name = PyList_GET_ITEM(slotnames, i);
+                Py_INCREF(name);
                 value = PyObject_GetAttr(obj, name);
                 if (value == NULL) {
+                    Py_DECREF(name);
                     if (!PyErr_ExceptionMatches(PyExc_AttributeError)) {
                         goto error;
                     }
@@ -3899,6 +3901,7 @@
                 }
                 else {
                     int err = PyDict_SetItem(slots, name, value);
+                    Py_DECREF(name);
                     Py_DECREF(value);
                     if (err) {
                         goto error;