Bug report: repr(dict)

[Greg McFarlane]

Python 1.5.2

There is a bug in repr(dict) which causes core dumps and other such
nasties.  The function dict_repr() in dictobject.c iterates over the
keys and values in a dictionary, calling PyObject_Repr() on each. 
Problems occur if one of the values is an instance with its own
__repr__ method and that method modifies the dictionary.  If the
dictionary is modified while it is being iterated over, you can end up
with wild pointers.  Perhaps the solution is to use PyDict_Next to
iterate over the dictionary.

An example which demonstrates the bug:
==================================================================
class MyModuleLoader:
    def __repr__(self):
        global dict
        for i in range(10):
            dict[i] = i
	return 'This is a test module'

dict = {1 : MyModuleLoader()}

print len(dict)
print repr(dict)
print len(dict)
==================================================================

A more realistic example, which assigns to sys.modules to implement
special loading of modules:
==================================================================
import sys

class MyModuleLoader:
    def __repr__(self):
        import regex
        import string
	import os
	import socket
	import UserDict
	import UserList
	import operator
	import copy
	import symbol
        import re
        import code
	return 'This is a test module'

# Create a module hook for MyModule.
sys.modules['MyModule'] = MyModuleLoader()

print len(sys.modules)
print repr(sys.modules)
print len(sys.modules)
==================================================================

The problem is also in dict_print() and perhaps in other parts of
dictobject.c.

-- 
Greg McFarlane     INMS Telstra Australia     gregm at iname.com