[Patches] [ python-Patches-637176 ] list.sort crasher

noreply@sourceforge.net noreply@sourceforge.net
Tue, 12 Nov 2002 16:16:49 -0800


Patches item #637176, was opened at 2002-11-12 15:32
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=305470&aid=637176&group_id=5470

Category: Core (C code)
Group: None
Status: Closed
Resolution: Accepted
Priority: 5
Submitted By: Armin Rigo (arigo)
Assigned to: Tim Peters (tim_one)
Summary: list.sort crasher

Initial Comment:
Solves the list.sort() crash of
http://www.python.org/sf/453523.

Removes the immutable list trick. Makes the list empty
during sort. Raises ValueError if the (temporarily
empty) list is detected to have been modified at the
end of the sort.


----------------------------------------------------------------------

>Comment By: Armin Rigo (arigo)
Date: 2002-11-13 00:16

Message:
Logged In: YES 
user_id=4771

I overlooked the case you mention.  I believe it is now
bulletproof, because no other code in listobject.c will ever
let an empty list have a non-NULL ob_item. But right, who
cares :-)

----------------------------------------------------------------------

Comment By: Tim Peters (tim_one)
Date: 2002-11-12 22:15

Message:
Logged In: YES 
user_id=31435

Thanks, Armin!  It's not ideal, but better than a crash for sure, 
and nobody has had a better idea.

Doc/lib/libstdtypes.tex; new revision: 1.108
Lib/test/test_sort.py; new revision: 1.3
Lib/test/test_types.py; new revision: 1.39
Misc/NEWS; new revision: 1.520
Objects/listobject.c; new revision: 2.141

Note that I fiddled the patch to check ob_size > 0 at the end 
too -- because we use realloc to grow space for lists, it was 
possible for a comparison function to grow empty_ob_item in-
place, and then the mutation wasn't caught.  Ditto if a whole 
bunch of inserts and deletes managed to recycle memory in 
such a way that malloc() just happened to return the same 
address as empty_ob_item a second time.  Those aren't 
hypothetical, cuz I saw them happening when writing a test 
case and wondering why it only caught the mutations *some* 
of the times.  I'm still not sure it's bulletproof mutation 
detection, but the test case triggers every time now, so who 
cares <wink>.

----------------------------------------------------------------------

Comment By: Tim Peters (tim_one)
Date: 2002-11-12 21:44

Message:
Logged In: YES 
user_id=31435

Assigned to me.

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=305470&aid=637176&group_id=5470