Message 155190 - Python tracker

➜

This issue tracker has been migrated to GitHub , and is currently read-only.
For more information, see the GitHub FAQs in the Python's Developer Guide.

In-reply-to
Author	vstinner
Recipients	arigo, vstinner
Date	2012年03月09日.00:05:36
SpamBayes Score	3.6328881e-06
Marked as misclassified	No
Message-id	<1331251537.37.0.172100522309.issue14231@psf.upfronthosting.co.za>

Content
Lib/test/crashers/borrowed_ref_1.py contains the docstring: "_PyType_Lookup() returns a borrowed reference. This attacks the call in dictobject.c." The file was added by Armin in 2006 by the changeset 4dd1a9383e47. I just fixed #14211 which was a similar bug (Lib/test/crashers/borrowed_ref_2.py), but I'm unable to reproduce this one. Extract of dict_subscript(): missing = _PyObject_LookupSpecial((PyObject *)mp, &PyId___missing__); if (missing != NULL) { res = PyObject_CallFunctionObjArgs(missing, key, NULL); Py_DECREF(missing); return res; } I fail to see how missing can be destroyed before being used. Is it a problem that missing is destroyed while we are calling it? How can I trigger the crash in gdb?

Content

Lib/test/crashers/borrowed_ref_1.py contains the docstring:
"_PyType_Lookup() returns a borrowed reference.
This attacks the call in dictobject.c."
The file was added by Armin in 2006 by the changeset 4dd1a9383e47.
I just fixed #14211 which was a similar bug (Lib/test/crashers/borrowed_ref_2.py), but I'm unable to reproduce this one.
Extract of dict_subscript():
 missing = _PyObject_LookupSpecial((PyObject *)mp, &PyId___missing__);
 if (missing != NULL) {
 res = PyObject_CallFunctionObjArgs(missing,
 key, NULL);
 Py_DECREF(missing);
 return res;
 }
I fail to see how missing can be destroyed before being used. Is it a problem that missing is destroyed while we are calling it?
How can I trigger the crash in gdb?

History
Date	User	Action	Args
2012年03月09日 00:05:37	vstinner	set	recipients: + vstinner, arigo
2012年03月09日 00:05:37	vstinner	set	messageid: <1331251537.37.0.172100522309.issue14231@psf.upfronthosting.co.za>
2012年03月09日 00:05:36	vstinner	link	issue14231 messages
2012年03月09日 00:05:36	vstinner	create

homepage