[Python-checkins] r73564 - in python/trunk: Lib/test/test_extcall.py Misc/NEWS Objects/funcobject.c

Fri Jun 26 00:29:29 CEST 2009

Author: amaury.forgeotdarc
Date: Fri Jun 26 00:29:29 2009
New Revision: 73564
Log:
#2016 Fix a crash in function call when the **kwargs dictionary is mutated
during the function call setup.
This even gives a slight speedup, probably because tuple allocation
is faster than PyMem_NEW.
Modified:
 python/trunk/Lib/test/test_extcall.py
 python/trunk/Misc/NEWS
 python/trunk/Objects/funcobject.c
Modified: python/trunk/Lib/test/test_extcall.py
==============================================================================

--- python/trunk/Lib/test/test_extcall.py	(original)
+++ python/trunk/Lib/test/test_extcall.py	Fri Jun 26 00:29:29 2009
@@ -251,6 +251,24 @@
 ...
 TypeError: id() takes no keyword arguments
 
+A corner case of keyword dictionary items being deleted during
+the function call setup. See <http://bugs.python.org/issue2016>.
+
+ >>> class Name(str):
+ ... def __eq__(self, other):
+ ... try:
+ ... del x[self]
+ ... except KeyError:
+ ... pass
+ ... return str.__eq__(self, other)
+ ... def __hash__(self):
+ ... return str.__hash__(self)
+
+ >>> x = {Name("a"):1, Name("b"):2}
+ >>> def f(a, b):
+ ... print a,b
+ >>> f(**x)
+ 1 2
 """
 
 import unittest
Modified: python/trunk/Misc/NEWS
==============================================================================
--- python/trunk/Misc/NEWS	(original)
+++ python/trunk/Misc/NEWS	Fri Jun 26 00:29:29 2009
@@ -12,6 +12,9 @@
 Core and Builtins
 -----------------
 
+- Issue #2016: Fixed a crash in a corner case where the dictionary of keyword
+ arguments could be modified during the function call setup.
+
 - Removed the ipaddr module.
 
 - Issue #6329: Fixed iteration for memoryview objects (it was being blocked
Modified: python/trunk/Objects/funcobject.c
==============================================================================
--- python/trunk/Objects/funcobject.c	(original)
+++ python/trunk/Objects/funcobject.c	Fri Jun 26 00:29:29 2009
@@ -489,13 +489,14 @@
 {
 	PyObject *result;
 	PyObject *argdefs;
+	PyObject *kwtuple = NULL;
 	PyObject **d, **k;
 	Py_ssize_t nk, nd;
 
 	argdefs = PyFunction_GET_DEFAULTS(func);
 	if (argdefs != NULL && PyTuple_Check(argdefs)) {
 		d = &PyTuple_GET_ITEM((PyTupleObject *)argdefs, 0);
-		nd = PyTuple_Size(argdefs);
+		nd = PyTuple_GET_SIZE(argdefs);
 	}
 	else {
 		d = NULL;
@@ -505,16 +506,17 @@
 	if (kw != NULL && PyDict_Check(kw)) {
 		Py_ssize_t pos, i;
 		nk = PyDict_Size(kw);
-		k = PyMem_NEW(PyObject *, 2*nk);
-		if (k == NULL) {
-			PyErr_NoMemory();
+		kwtuple = PyTuple_New(2*nk);
+		if (kwtuple == NULL)
 			return NULL;
-		}
+		k = &PyTuple_GET_ITEM(kwtuple, 0);
 		pos = i = 0;
-		while (PyDict_Next(kw, &pos, &k[i], &k[i+1]))
+		while (PyDict_Next(kw, &pos, &k[i], &k[i+1])) {
+			Py_INCREF(k[i]);
+			Py_INCREF(k[i+1]);
 			i += 2;
+		}
 		nk = i/2;
-		/* XXX This is broken if the caller deletes dict items! */
 	}
 	else {
 		k = NULL;
@@ -524,12 +526,11 @@
 	result = PyEval_EvalCodeEx(
 		(PyCodeObject *)PyFunction_GET_CODE(func),
 		PyFunction_GET_GLOBALS(func), (PyObject *)NULL,
-		&PyTuple_GET_ITEM(arg, 0), PyTuple_Size(arg),
+		&PyTuple_GET_ITEM(arg, 0), PyTuple_GET_SIZE(arg),
 		k, nk, d, nd,
 		PyFunction_GET_CLOSURE(func));
 
-	if (k != NULL)
-		PyMem_DEL(k);
+	Py_XDECREF(kwtuple);
 
 	return result;
 }
