[Python-checkins] python/dist/src/Objects typeobject.c, 2.241.6.4, 2.241.6.5

[tim_one at users.sourceforge.net]

Update of /cvsroot/python/python/dist/src/Objects
In directory sc8-pr-cvs1:/tmp/cvs-serv22584/Objects

Modified Files:
      Tag: release23-maint
	typeobject.c 
Log Message:
Backport of fix for SF bug 840829, memory corruption in some cases of
weakref callbacks.

This is a critical bugfix.  It's already been fixed on the trunk (2.4
development).  I don't intend to backport it to the 22 line, but if a
2.2.4 ever gets released, this should be in it.


Index: typeobject.c
===================================================================
RCS file: /cvsroot/python/python/dist/src/Objects/typeobject.c,v
retrieving revision 2.241.6.4
retrieving revision 2.241.6.5
diff -C2 -d -r2.241.6.4 -r2.241.6.5
*** typeobject.c	20 Oct 2003 14:34:47 -0000	2.241.6.4
--- typeobject.c	13 Nov 2003 01:17:55 -0000	2.241.6.5
***************
*** 640,644 ****
  	Py_TRASHCAN_SAFE_BEGIN(self);
  	--_PyTrash_delete_nesting;
! 	_PyObject_GC_TRACK(self); /* We'll untrack for real later */
  
  	/* Find the nearest base with a different tp_dealloc */
--- 640,648 ----
  	Py_TRASHCAN_SAFE_BEGIN(self);
  	--_PyTrash_delete_nesting;
! 	/* DO NOT restore GC tracking at this point.  The weakref callback
! 	 * (if any) may trigger GC, and if self is tracked at that point,
! 	 * it will look like trash to GC and GC will try to delete it
! 	 * again.  Double-deallocation is a subtle disaster.
! 	 */
  
  	/* Find the nearest base with a different tp_dealloc */
***************
*** 655,658 ****
--- 659,663 ----
  	if (type->tp_weaklistoffset && !base->tp_weaklistoffset)
  		PyObject_ClearWeakRefs(self);
+ 	_PyObject_GC_TRACK(self); /* We'll untrack for real later */
  
  	/* Maybe call finalizer; exit early if resurrected */