[Patches] [ python-Patches-413552 ] Premature decref on object
noreply@sourceforge.net
noreply@sourceforge.net
Sat, 07 Apr 2001 13:36:04 -0700
Patches item #413552, was updated on 2001-04-03 15:44
You can respond by visiting:
http://sourceforge.net/tracker/?func=detail&atid=305470&aid=413552&group_id=5470
Category: core (C code)
Group: None
>Status: Closed
Priority: 5
Submitted By: Jeffery D. Collins (tokeneater)
Assigned to: Tim Peters (tim_one)
Summary: Premature decref on object
Initial Comment:
This is a fairly subtle decref problem in
filterstring() that takes advantage of a side effect in
string_item. The value "item" returned from sq_item
(string_item) normally has at least two reference
counts, one from membership in the array characters[]
and another acquired by upon return from string_item()
(plus possibly others). So, the current order of
decrefing item in filterstring() works without causing
a failure. For some work we are doing in Pippy, we
have eliminated the character[] array in stringobject.c
to save space. As a result, the reference count of the
returned object is one. So, when "item" is decrefed
prematurely, the object is garbage collected and the
next use of it causes an error (on the Palm). This
patch fixes the problem by delaying the decref of
"item" until it is no longer needed by filterstring().
This patch was successfully tested via "make test".
----------------------------------------------------------------------
>Comment By: Tim Peters (tim_one)
Date: 2001-04-07 13:36
Message:
Logged In: YES
user_id=31435
Thanks, Jeffrey! I applied the patch:
Python/bltinmodule.c
new revision: 2.197
----------------------------------------------------------------------
Comment By: Tim Peters (tim_one)
Date: 2001-04-07 13:16
Message:
Logged In: YES
user_id=31435
Assigned to me. I agree filterstring should not drop the
refcount on item before it finishes using it, and doubt
this code *intended* to rely on the cross-module accident
that's letting it work now.
----------------------------------------------------------------------
You can respond by visiting:
http://sourceforge.net/tracker/?func=detail&atid=305470&aid=413552&group_id=5470