Author: mark.dickinson Date: Fri Jan 29 18:29:21 2010 New Revision: 77824 Log: Merged revisions 77823 via svnmerge from svn+ssh://pythondev@svn.python.org/python/branches/py3k ................ r77823 | mark.dickinson | 2010-01-29 17:27:24 +0000 (Fri, 29 Jan 2010) | 10 lines Merged revisions 77821 via svnmerge from svn+ssh://pythondev@svn.python.org/python/trunk ........ r77821 | mark.dickinson | 2010-01-29 17:11:39 +0000 (Fri, 29 Jan 2010) | 3 lines Issue #7788: Fix a crash produced by deleting a list slice with huge step value. Patch by Marcin Bachry. ........ ................ Modified: python/branches/release31-maint/ (props changed) python/branches/release31-maint/Lib/test/list_tests.py python/branches/release31-maint/Lib/test/test_array.py python/branches/release31-maint/Lib/test/test_bytes.py python/branches/release31-maint/Misc/NEWS python/branches/release31-maint/Modules/arraymodule.c python/branches/release31-maint/Objects/bytearrayobject.c python/branches/release31-maint/Objects/listobject.c Modified: python/branches/release31-maint/Lib/test/list_tests.py ============================================================================== --- python/branches/release31-maint/Lib/test/list_tests.py (original) +++ python/branches/release31-maint/Lib/test/list_tests.py Fri Jan 29 18:29:21 2010 @@ -540,6 +540,9 @@ a = self.type2test(range(10)) a[::2] = tuple(range(5)) self.assertEqual(a, self.type2test([0, 1, 1, 3, 2, 5, 3, 7, 4, 9])) + # test issue7788 + a = self.type2test(range(10)) + del a[9::1<<333] def test_constructor_exception_handling(self): # Bug #1242657 Modified: python/branches/release31-maint/Lib/test/test_array.py ============================================================================== --- python/branches/release31-maint/Lib/test/test_array.py (original) +++ python/branches/release31-maint/Lib/test/test_array.py Fri Jan 29 18:29:21 2010 @@ -848,6 +848,9 @@ a = array.array(self.typecode, range(10)) del a[::1000] self.assertEqual(a, array.array(self.typecode, [1,2,3,4,5,6,7,8,9])) + # test issue7788 + a = array.array(self.typecode, range(10)) + del a[9::1<<333] def test_assignment(self): a = array.array(self.typecode, range(10)) Modified: python/branches/release31-maint/Lib/test/test_bytes.py ============================================================================== --- python/branches/release31-maint/Lib/test/test_bytes.py (original) +++ python/branches/release31-maint/Lib/test/test_bytes.py Fri Jan 29 18:29:21 2010 @@ -595,7 +595,7 @@ self.assertEqual(b, bytearray([0, 1, 2, 42, 42, 42, 3, 4, 5, 6, 7, 8, 9])) def test_extended_set_del_slice(self): - indices = (0, None, 1, 3, 19, 300, -1, -2, -31, -300) + indices = (0, None, 1, 3, 19, 300, 1<<333, -1, -2, -31, -300) for start in indices: for stop in indices: # Skip invalid step 0 Modified: python/branches/release31-maint/Misc/NEWS ============================================================================== --- python/branches/release31-maint/Misc/NEWS (original) +++ python/branches/release31-maint/Misc/NEWS Fri Jan 29 18:29:21 2010 @@ -12,6 +12,9 @@ Core and Builtins ----------------- +- Issue #7788: Fix an interpreter crash produced by deleting a list + slice with very large step value. + - Issue #7561: Operations on empty bytearrays (such as `int(bytearray())`) could crash in many places because of the PyByteArray_AS_STRING() macro returning NULL. The macro now returns a statically allocated empty Modified: python/branches/release31-maint/Modules/arraymodule.c ============================================================================== --- python/branches/release31-maint/Modules/arraymodule.c (original) +++ python/branches/release31-maint/Modules/arraymodule.c Fri Jan 29 18:29:21 2010 @@ -1733,8 +1733,9 @@ } else if (needed == 0) { /* Delete slice */ - Py_ssize_t cur, i; - + size_t cur; + Py_ssize_t i; + if (step < 0) { stop = start + 1; start = stop + step * (slicelength - 1) - 1; Modified: python/branches/release31-maint/Objects/bytearrayobject.c ============================================================================== --- python/branches/release31-maint/Objects/bytearrayobject.c (original) +++ python/branches/release31-maint/Objects/bytearrayobject.c Fri Jan 29 18:29:21 2010 @@ -650,7 +650,8 @@ else { if (needed == 0) { /* Delete slice */ - Py_ssize_t cur, i; + size_t cur; + Py_ssize_t i; if (!_canresize(self)) return -1; Modified: python/branches/release31-maint/Objects/listobject.c ============================================================================== --- python/branches/release31-maint/Objects/listobject.c (original) +++ python/branches/release31-maint/Objects/listobject.c Fri Jan 29 18:29:21 2010 @@ -2430,7 +2430,8 @@ if (value == NULL) { /* delete slice */ PyObject **garbage; - Py_ssize_t cur, i; + size_t cur; + Py_ssize_t i; if (slicelength <= 0) return 0;