#11845: Merge with 3.2.

3 files changed, 13 insertions, 1 deletions

diff --git a/Lib/test/test_range.py b/Lib/test/test_range.py
index fc310c1..ede0791 100644
--- a/Lib/test/test_range.py
+++ b/Lib/test/test_range.py
@@ -498,6 +498,15 @@ class RangeTest(unittest.TestCase):
                   ]:
             self.assertEqual(list(reversed(r)), list(r)[::-1])
 
+    def test_issue11845(self):
+        r = range(*slice(1, 18, 2).indices(20))
+        values = {None, 0, 1, -1, 2, -2, 5, -5, 19, -19,
+                  20, -20, 21, -21, 30, -30, 99, -99}
+        for i in values:
+            for j in values:
+                for k in values - {0}:
+                    r[i:j:k]
+
 
 def test_main():
     test.support.run_unittest(RangeTest)
diff --git a/Misc/NEWS b/Misc/NEWS
index bf75d8b..553adcd 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -10,6 +10,9 @@ What's New in Python 3.3 Alpha 1?
 Core and Builtins
 -----------------
 
+- Issue #11845: Fix typo in rangeobject.c that caused a crash in
+  compute_slice_indices.  Patch by Daniel Urban.
+
 - Issue #5673: Added a `timeout` keyword argument to subprocess.Popen.wait,
   subprocess.Popen.communicated, subprocess.call, subprocess.check_call, and
   subprocess.check_output.  If the blocking operation takes more than `timeout`
diff --git a/Objects/rangeobject.c b/Objects/rangeobject.c
index cff2ce4..58d373c 100644
--- a/Objects/rangeobject.c
+++ b/Objects/rangeobject.c
@@ -472,7 +472,7 @@ compute_slice_indices(rangeobject *r, PySliceObject *slice,
                     if (tmp_stop == NULL) goto Fail;
                 } else {
                     tmp_stop = r->length;
-                    Py_INCREF(tmp_start);
+                    Py_INCREF(tmp_stop);
                 }
             }
         }