Fix SF bug #489581: __slots__ leak.

It was easier than I thought, assuming that no other things contribute
to the instance size besides slots -- a pretty good bet.  With a test
suite, no less!

3 files changed, 59 insertions, 2 deletions

diff --git a/Lib/test/test_descr.py b/Lib/test/test_descr.py
index b73025b..481ca0f 100644
--- a/Lib/test/test_descr.py
+++ b/Lib/test/test_descr.py
@@ -1000,6 +1000,40 @@ def slots():
     vereq(x.b, 2)
     vereq(x.c, 3)
 
+    # Test leaks
+    class Counted(object):
+        counter = 0    # counts the number of instances alive
+        def __init__(self):
+            Counted.counter += 1
+        def __del__(self):
+            Counted.counter -= 1
+    class C(object):
+        __slots__ = ['a', 'b', 'c']
+    x = C()
+    x.a = Counted()
+    x.b = Counted()
+    x.c = Counted()
+    vereq(Counted.counter, 3)
+    del x
+    vereq(Counted.counter, 0)
+    class D(C):
+        pass
+    x = D()
+    x.a = Counted()
+    x.z = Counted()
+    vereq(Counted.counter, 2)
+    del x
+    vereq(Counted.counter, 0)
+    class E(D):
+        __slots__ = ['e']
+    x = E()
+    x.a = Counted()
+    x.z = Counted()
+    x.e = Counted()
+    vereq(Counted.counter, 3)
+    del x
+    vereq(Counted.counter, 0)
+
 def dynamics():
     if verbose: print "Testing class attribute propagation..."
     class D(object):
diff --git a/Misc/NEWS b/Misc/NEWS
index 58119ea..eabe9b6 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -4,6 +4,9 @@ XXX Release date: ??-Dec-2001 XXX
 
 Type/class unification and new-style classes
 
+- Fixed a leak: instance variables declared with __slots__ were never
+  deleted!
+
 - The "delete attribute" method of descriptor objects is called
   __delete__, not __del__.  In previous releases, it was mistakenly
   called __del__, which created an unfortunate overloading condition
diff --git a/Objects/typeobject.c b/Objects/typeobject.c
index 14a7e86..37ab4cb 100644
--- a/Objects/typeobject.c
+++ b/Objects/typeobject.c
@@ -304,7 +304,7 @@ call_finalizer(PyObject *self)
 static void
 subtype_dealloc(PyObject *self)
 {
-	PyTypeObject *type, *base;
+	PyTypeObject *type, *base, *temp;
 	destructor f;
 
 	/* This exists so we can DECREF self->ob_type */
@@ -314,10 +314,30 @@ subtype_dealloc(PyObject *self)
 
 	/* Find the nearest base with a different tp_dealloc */
 	type = self->ob_type;
-	base = type->tp_base;
+	base = type;
 	while ((f = base->tp_dealloc) == subtype_dealloc) {
+		temp = base;
 		base = base->tp_base;
 		assert(base);
+		/* While we're at it, clear __slots__ variables */
+		if (temp->tp_basicsize != base->tp_basicsize &&
+		    temp->tp_itemsize == 0)
+		{
+			char *addr = ((char *)self);
+			char *p = addr + base->tp_basicsize;
+			char *q = addr + temp->tp_basicsize;
+			for (; p < q; p += sizeof(PyObject *)) {
+				PyObject **pp;
+				if (p == addr + type->tp_dictoffset ||
+				    p == addr + type->tp_weaklistoffset)
+					continue;
+				pp = (PyObject **)p;
+				if (*pp != NULL) {
+					Py_DECREF(*pp);
+					*pp = NULL;
+				}
+			}
+		}
 	}
 
 	/* If we added a dict, DECREF it */