Fix SF bug #489581: __slots__ leak.

It was easier than I thought, assuming that no other things contribute
to the instance size besides slots -- a pretty good bet.  With a test
suite, no less!

1 files changed, 22 insertions, 2 deletions

diff --git a/Objects/typeobject.c b/Objects/typeobject.c
index 14a7e86..37ab4cb 100644
--- a/Objects/typeobject.c
+++ b/Objects/typeobject.c
@@ -304,7 +304,7 @@ call_finalizer(PyObject *self)
 static void
 subtype_dealloc(PyObject *self)
 {
-	PyTypeObject *type, *base;
+	PyTypeObject *type, *base, *temp;
 	destructor f;
 
 	/* This exists so we can DECREF self->ob_type */
@@ -314,10 +314,30 @@ subtype_dealloc(PyObject *self)
 
 	/* Find the nearest base with a different tp_dealloc */
 	type = self->ob_type;
-	base = type->tp_base;
+	base = type;
 	while ((f = base->tp_dealloc) == subtype_dealloc) {
+		temp = base;
 		base = base->tp_base;
 		assert(base);
+		/* While we're at it, clear __slots__ variables */
+		if (temp->tp_basicsize != base->tp_basicsize &&
+		    temp->tp_itemsize == 0)
+		{
+			char *addr = ((char *)self);
+			char *p = addr + base->tp_basicsize;
+			char *q = addr + temp->tp_basicsize;
+			for (; p < q; p += sizeof(PyObject *)) {
+				PyObject **pp;
+				if (p == addr + type->tp_dictoffset ||
+				    p == addr + type->tp_weaklistoffset)
+					continue;
+				pp = (PyObject **)p;
+				if (*pp != NULL) {
+					Py_DECREF(*pp);
+					*pp = NULL;
+				}
+			}
+		}
 	}
 
 	/* If we added a dict, DECREF it */