homepage

Using failmalloc project to inject MemoryError, I found a reference counter issue in OSError constructor. args parameter passed to OSError_new() becomes invalid when OSError constructor fails.
I don't yet where is the bug exactly.
Traces when the bug occurs in test_urllib:
(gdb) where
...
#2 0x0000000000423f80 in Py_FatalError (msg=0x7ffffffd68e0 "Python/ceval.c:4456 object at 0x7fffed6c4ef8 has negative ref count -1")
 at Python/pythonrun.c:2531
#3 0x00000000004bd47f in _Py_NegativeRefcount (fname=0x686618 "Python/ceval.c", lineno=4456, op=(((0x0,),),)) at Objects/object.c:197
#4 0x00000000005a544d in do_call (func=<type at remote 0xcb0588>, pp_stack=0x7ffffffd6ba8, na=1, nk=0) at Python/ceval.c:4456
#5 0x00000000005a4624 in call_function (pp_stack=0x7ffffffd6ba8, oparg=1) at Python/ceval.c:4252
#6 0x000000000059c96e in PyEval_EvalFrameEx (f=
...
(gdb) frame 4
#4 0x00000000005a544d in do_call (func=<type at remote 0xcb0588>, pp_stack=0x7ffffffd6ba8, na=1, nk=0) at Python/ceval.c:4456
4456	 Py_XDECREF(callargs);
(gdb) print callargs
12ドル = (((0x0,),),)
(gdb) print _PyObject_Dump(func)
object : <class 'urllib.error.URLError'>
type : type
refcount: 16
address : 0xcb0728
10ドル = void

New changeset 61a712066770 by Victor Stinner in branch 'default':
Issue #19429, #19437: fix error handling in the OSError constructor
http://hg.python.org/cpython/rev/61a712066770