homepage

There is a reference counting error in PyFloat_AsDouble.
When the function calls the nb_float conversion, if the method does not return an actual float object, an exception is set, but the object is not collected.
--- Objects/floatobject.c	2014年10月08日 04:18:15.000000000 -0400
+++ Objects/floatobject.c.patched	2015年03月05日 09:17:15.171455648 -0500
@@ -214,6 +214,7 @@
 if (fo == NULL)
 return -1;
 if (!PyFloat_Check(fo)) {
+ Py_DECREF(fo);
 PyErr_SetString(PyExc_TypeError,
 "nb_float should return float object");
 return -1;

Here's a simple recreator... It returns a 100-meg string instead of a float. The memory is leaked each time through the loop

Simple script to reproduce the issue:
import sys, time
class C(object):
 def __float__(self):
 return ""
for x in range(10000):
 try:
 time.sleep(C())
 except TypeError:
 pass
 if x % 1000 == 0:
 print(sys.getrefcount(""))

Shout out to amaury for a much simpler recreator :-)
Checked to see if the int conversion suffered the same problem... it does not as it is structured somewhat differently. Note that it DOES do the proper DECREF (missing in PyFloat_AsDouble).
 result = nb->nb_int(integral);
 if (!result || PyLong_CheckExact(result))
 return (PyLongObject *)result;
 if (!PyLong_Check(result)) {
 PyErr_Format(PyExc_TypeError,
 "__int__ returned non-int (type %.200s)",
 result->ob_type->tp_name);
 Py_DECREF(result);
 return NULL;
 }

This is also in the 2.7.x branch. Same patch.

Patch LGTM. Marking as high priority.

The patch should have a test before it goes in. As an aside, it's a bit disturbing that we apparently don't have any code already in our test-suite that exercises this case.

New changeset 30925a3b2324 by Benjamin Peterson in branch '3.4':
fix potential refleak in PyFloat_AsDouble (closes #23590)
https://hg.python.org/cpython/rev/30925a3b2324
New changeset f31b91b6683a by Benjamin Peterson in branch '2.7':
fix potential refleak in PyFloat_AsDouble (closes #23590)
https://hg.python.org/cpython/rev/f31b91b6683a
New changeset 4d9594018edd by Benjamin Peterson in branch 'default':
merge 3.4 (#23590)
https://hg.python.org/cpython/rev/4d9594018edd 

Thanks, Benjamin!