Merged revisions 66677,66700 via svnmerge from

svn+ssh://pythondev@svn.python.org/python/trunk

........
  r66677 | brett.cannon | 2008-09-28 22:41:21 -0500 (Sun, 28 Sep 2008) | 7 lines

  The _lsprof module could crash the interpreter if it was given an external
  timer that did not return a float and a timer was still running when the
  Profiler object was garbage collected.

  Fixes issue 3895.
  Code review by Benjamin Peterson.
........
  r66700 | brett.cannon | 2008-09-30 12:46:03 -0500 (Tue, 30 Sep 2008) | 5 lines

  Fix a refleak introduced by r66677.

  Fix suggested by Amaury Forgeot d'Arc.
  Closes issue #4003.
........

2 files changed, 16 insertions, 2 deletions

diff --git a/Lib/test/test_cprofile.py b/Lib/test/test_cprofile.py
index 4c194dc..349d342 100644
--- a/Lib/test/test_cprofile.py
+++ b/Lib/test/test_cprofile.py
@@ -1,7 +1,7 @@
 """Test suite for the cProfile module."""
 
 import sys
-from test.support import run_unittest
+from test.support import run_unittest, TESTFN, unlink
 
 # rip off all interesting stuff from test_profile
 import cProfile
@@ -13,6 +13,20 @@ class CProfileTest(ProfileTest):
     def get_expected_output(self):
         return _ProfileOutput
 
+    # Issue 3895.
+    def test_bad_counter_during_dealloc(self):
+        import _lsprof
+        # Must use a file as StringIO doesn't trigger the bug.
+        sys.stderr = open(TESTFN, 'w')
+        try:
+            obj = _lsprof.Profiler(lambda: int)
+            obj.enable()
+            obj = _lsprof.Profiler(1)
+            obj.disable()
+        finally:
+            sys.stderr = sys.__stderr__
+            unlink(TESTFN)
+
 
 def test_main():
     run_unittest(CProfileTest)
diff --git a/Modules/_lsprof.c b/Modules/_lsprof.c
index a6fd1f8..8457de1 100644
--- a/Modules/_lsprof.c
+++ b/Modules/_lsprof.c
@@ -150,7 +150,7 @@ static PY_LONG_LONG CallExternalTimer(ProfilerObject *pObj)
 	}
 	Py_DECREF(o);
 	if (PyErr_Occurred()) {
-		PyErr_WriteUnraisable((PyObject *) pObj);
+		PyErr_WriteUnraisable(pObj->externalTimer);
 		return 0;
 	}
 	return result;