Fix SF bug #1546288, crash in dict_equal.

3 files changed, 15 insertions, 2 deletions

diff --git a/Lib/test/test_mutants.py b/Lib/test/test_mutants.py
index df58944..a219450 100644
--- a/Lib/test/test_mutants.py
+++ b/Lib/test/test_mutants.py
@@ -91,12 +91,17 @@ class Horrid:
         self.hashcode = random.randrange(1000000000)
 
     def __hash__(self):
+        return 42
         return self.hashcode
 
     def __cmp__(self, other):
         maybe_mutate()   # The point of the test.
         return cmp(self.i, other.i)
 
+    def __eq__(self, other):
+        maybe_mutate()   # The point of the test.
+        return self.i == other.i
+
     def __repr__(self):
         return "Horrid(%d)" % self.i
 
@@ -132,7 +137,10 @@ def test_one(n):
     while dict1 and len(dict1) == len(dict2):
         if verbose:
             print ".",
-        c = cmp(dict1, dict2)
+        if random.random() < 0.5:
+            c = cmp(dict1, dict2)
+        else:
+            c = dict1 == dict2
     if verbose:
         print
 
diff --git a/Misc/NEWS b/Misc/NEWS
index 04c78c0..c7bd4d6 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -17,12 +17,14 @@ Core and builtins
 
 - Patch #1542451: disallow continue anywhere under a finally.
 
+- Patch #1546288: fix seg fault in dict_equal due to ref counting bug.
+
 
 Library
 -------
 
 - Patch #1550886: Fix decimal module context management implementation
-  to match the localcontext() example from PEP 343
+  to match the localcontext() example from PEP 343.
 
 - Bug #1541863: uuid.uuid1 failed to generate unique identifiers
   on systems with low clock resolution.
diff --git a/Objects/dictobject.c b/Objects/dictobject.c
index f3b6b7f..4e82798 100644
--- a/Objects/dictobject.c
+++ b/Objects/dictobject.c
@@ -1585,7 +1585,10 @@ dict_equal(dictobject *a, dictobject *b)
 			/* temporarily bump aval's refcount to ensure it stays
 			   alive until we're done with it */
 			Py_INCREF(aval);
+			/* ditto for key */
+			Py_INCREF(key);
 			bval = PyDict_GetItem((PyObject *)b, key);
+			Py_DECREF(key);
 			if (bval == NULL) {
 				Py_DECREF(aval);
 				return 0;