Fix for

[ 587875 ] crash on deleting extended slice

The array code got simpler, always a good thing!

4 files changed, 21 insertions, 9 deletions

diff --git a/Lib/test/test_array.py b/Lib/test/test_array.py
index 023af9a..b650033 100755
--- a/Lib/test/test_array.py
+++ b/Lib/test/test_array.py
@@ -336,6 +336,9 @@ def testtype(type, example):
         a = array.array(type, range(5))
         del a[1::-2]
         vereq(a, array.array(type, [0,2,3,4]))
+        a = array.array(type, range(10))
+        del a[::1000]
+        vereq(a, array.array(type, [1,2,3,4,5,6,7,8,9]))
         #  assignment
         a = array.array(type, range(10))
         a[::2] = array.array(type, [-1]*5)
diff --git a/Lib/test/test_types.py b/Lib/test/test_types.py
index 7efca21..a38eb7f 100644
--- a/Lib/test/test_types.py
+++ b/Lib/test/test_types.py
@@ -405,6 +405,9 @@ vereq(a, [0,2,4])
 a = range(5)
 del a[1::-2]
 vereq(a, [0,2,3,4])
+a = range(10)
+del a[::1000]
+vereq(a, [1, 2, 3, 4, 5, 6, 7, 8, 9])
 #  assignment
 a = range(10)
 a[::2] = [-1]*5
diff --git a/Modules/arraymodule.c b/Modules/arraymodule.c
index 8a79027..e757d9f 100644
--- a/Modules/arraymodule.c
+++ b/Modules/arraymodule.c
@@ -1564,7 +1564,7 @@ array_ass_subscr(arrayobject* self, PyObject* item, PyObject* value)
 
 		if (value == NULL) {
 			/* delete slice */
-			int cur, i;
+			int cur, i, extra;
 			
 			if (slicelength <= 0)
 				return 0;
@@ -1575,16 +1575,17 @@ array_ass_subscr(arrayobject* self, PyObject* item, PyObject* value)
 				step = -step;
 			}
 
-			for (cur = start, i = 0; cur < stop; 
+			for (cur = start, i = 0; i < slicelength - 1;
 			     cur += step, i++) {
 				memmove(self->ob_item + (cur - i)*itemsize,
 					self->ob_item + (cur + 1)*itemsize,
 					(step - 1) * itemsize);
 			}
-			if (self->ob_size > (start + slicelength*step)) {
-				memmove(self->ob_item + (start + slicelength*(step - 1))*itemsize,
-					self->ob_item + (start + slicelength*step)*itemsize,
-					(self->ob_size - (start + slicelength*step))*itemsize);
+			extra = self->ob_size - (cur + 1);
+			if (extra > 0) {
+				memmove(self->ob_item + (cur - i)*itemsize,
+					self->ob_item + (cur + 1)*itemsize,
+					extra*itemsize);
 			}
 
 			self->ob_size -= slicelength;
diff --git a/Objects/listobject.c b/Objects/listobject.c
index 1aa68ed..9a1a6b4 100644
--- a/Objects/listobject.c
+++ b/Objects/listobject.c
@@ -1780,11 +1780,16 @@ list_ass_subscript(PyListObject* self, PyObject* item, PyObject* value)
 			   understand these for loops */
 			for (cur = start, i = 0;
 			     cur < stop;
-			     cur += step, i++)
-			{
+			     cur += step, i++) {
+				int lim = step;
+
 				garbage[i] = PyList_GET_ITEM(self, cur);
 
-				for (j = 0; j < step; j++) {
+				if (cur + step >= self->ob_size) {
+					lim = self->ob_size - cur - 1;
+				}
+
+				for (j = 0; j < lim; j++) {
 					PyList_SET_ITEM(self, cur + j - i,
 						PyList_GET_ITEM(self,
 								cur + j + 1));