homepage

The following script exploits a comment in funcobject.c:
 /* XXX This is broken if the caller deletes dict items! */
Because the code only borrows references to the items, it is possible to
have them destroyed before they are copied into the called frame.
class Name(str):
 def __eq__(self, other):
 del x[self]
 return str.__eq__(self, other)
 def __hash__(self):
 return str.__hash__(self)
x = {Name("a"):1, Name("b"):2}
def f(a, b): print a,b
f(**x) # Segfault