Issue #18408: _PyUnicodeWriter_Finish() now clears its buffer attribute in all

cases, so _PyUnicodeWriter_Dealloc() can be called after finish.

1 files changed, 6 insertions, 3 deletions

diff --git a/Objects/unicodeobject.c b/Objects/unicodeobject.c
index 96c7c58..1a44882 100644
--- a/Objects/unicodeobject.c
+++ b/Objects/unicodeobject.c
@@ -13159,18 +13159,21 @@ _PyUnicodeWriter_Finish(_PyUnicodeWriter *writer)
 {
     PyObject *str;
     if (writer->pos == 0) {
-        Py_XDECREF(writer->buffer);
+        Py_CLEAR(writer->buffer);
         _Py_RETURN_UNICODE_EMPTY();
     }
     if (writer->readonly) {
-        assert(PyUnicode_GET_LENGTH(writer->buffer) == writer->pos);
-        return writer->buffer;
+        str = writer->buffer;
+        writer->buffer = NULL;
+        assert(PyUnicode_GET_LENGTH(str) == writer->pos);
+        return str;
     }
     if (PyUnicode_GET_LENGTH(writer->buffer) != writer->pos) {
         PyObject *newbuffer;
         newbuffer = resize_compact(writer->buffer, writer->pos);
         if (newbuffer == NULL) {
             Py_DECREF(writer->buffer);
+            writer->buffer = NULL;
             return NULL;
         }
         writer->buffer = newbuffer;