https://github.com/python/cpython/commit/3c57ca699910be74e7cf67d747b24bbc486... commit: 3c57ca699910be74e7cf67d747b24bbc486932f1 branch: 3.7 author: Miss Islington (bot) <31488909+miss-islington@users.noreply.github.com> committer: GitHub <noreply@github.com> date: 2020-02-17T01:30:44-08:00 summary: [3.8] bpo-39453: Fix contains method of list to hold strong references (GH-18204) (cherry picked from commit f64abd10563c25a94011f9e3335fd8a1cf47c205) Co-authored-by: Dong-hee Na <donghee.na92@gmail.com> files: A Misc/NEWS.d/next/Core and Builtins/2020-01-25-23-51-17.bpo-39453.xCOkYk.rst M Lib/test/test_list.py M Objects/listobject.c diff --git a/Lib/test/test_list.py b/Lib/test/test_list.py index 553ac8c1cef81..32bf17564c9d9 100644 --- a/Lib/test/test_list.py +++ b/Lib/test/test_list.py @@ -212,6 +212,13 @@ def __eq__(self, other): with self.assertRaises(ValueError): lst.remove(lst) + # bpo-39453: list.__contains__ was not holding strong references + # to list elements while calling PyObject_RichCompareBool(). + lst = [X(), X()] + 3 in lst + lst = [X(), X()] + X() in lst + if __name__ == "__main__": unittest.main() diff --git a/Misc/NEWS.d/next/Core and Builtins/2020-01-25-23-51-17.bpo-39453.xCOkYk.rst b/Misc/NEWS.d/next/Core and Builtins/2020-01-25-23-51-17.bpo-39453.xCOkYk.rst new file mode 100644 index 0000000000000..8c2e49f9474c4 --- /dev/null +++ b/Misc/NEWS.d/next/Core and Builtins/2020-01-25-23-51-17.bpo-39453.xCOkYk.rst @@ -0,0 +1,2 @@ +Fixed a possible crash in :meth:`list.__contains__` when a list is changed +during comparing items. Patch by Dong-hee Na. diff --git a/Objects/listobject.c b/Objects/listobject.c index 856f3215e8855..158ca11d03299 100644 --- a/Objects/listobject.c +++ b/Objects/listobject.c @@ -397,12 +397,16 @@ list_length(PyListObject *a) static int list_contains(PyListObject *a, PyObject *el) { + PyObject *item; Py_ssize_t i; int cmp; - for (i = 0, cmp = 0 ; cmp == 0 && i < Py_SIZE(a); ++i) - cmp = PyObject_RichCompareBool(el, PyList_GET_ITEM(a, i), - Py_EQ); + for (i = 0, cmp = 0 ; cmp == 0 && i < Py_SIZE(a); ++i) { + item = PyList_GET_ITEM(a, i); + Py_INCREF(item); + cmp = PyObject_RichCompareBool(el, item, Py_EQ); + Py_DECREF(item); + } return cmp; }