[issue3299] invalid object destruction in re.finditer()

[STINNER Victor]

STINNER Victor <haypo at users.sourceforge.net> added the comment:

F*ck, Firefox just crashed! I have to rewrite my long comment...

First, to explain why the problem only occurs in pydebug mode: a 
PyObject has only _ob_next and _ob_prev attributes if Py_TRACE_REFS is 
set (eg. by pydebug). PyObject_NEW() and PyObject_NEW_VAR() call 
PyObject_Init() which register the new object to the object list, 
whereas PyObject_DEL() only free the memory.

PyObject_DEL() doesn't the dealloc() method nor removing the object 
from the object list. So Py_DECREF() should be used instead: it calls 
the dealloc method and remove the object from the object list.

PyObject_DEL() is misused in _sre and in curses modules. See attached 
patches.

Added file: http://bugs.python.org/file10891/_sre-2.patch

_______________________________________
Python tracker <report at bugs.python.org>
<http://bugs.python.org/issue3299>
_______________________________________