Fix crasher for when an object's __del__ creates a new weakref to itself.

Patch only fixes new-style classes; classic classes still buggy.

Closes bug #1377858.  Already backported.

2 files changed, 14 insertions, 0 deletions

diff --git a/Objects/typeobject.c b/Objects/typeobject.c
index 0cf830a..6ea489a 100644
--- a/Objects/typeobject.c
+++ b/Objects/typeobject.c
@@ -666,6 +666,17 @@ subtype_dealloc(PyObject *self)
 			goto endlabel;	/* resurrected */
 		else
 			_PyObject_GC_UNTRACK(self);
+		/* New weakrefs could be created during the finalizer call.
+		    If this occurs, clear them out without calling their
+		    finalizers since they might rely on part of the object
+		    being finalized that has already been destroyed. */
+		if (type->tp_weaklistoffset && !base->tp_weaklistoffset) {
+			/* Modeled after GET_WEAKREFS_LISTPTR() */
+			PyWeakReference **list = (PyWeakReference **) \
+				PyObject_GET_WEAKREFS_LISTPTR(self);
+			while (*list)
+				_PyWeakref_ClearRef(*list);
+		}
 	}
 
 	/*  Clear slots up to the nearest base with a different tp_dealloc */
diff --git a/Objects/weakrefobject.c b/Objects/weakrefobject.c
index 826f571..a404f29 100644
--- a/Objects/weakrefobject.c
+++ b/Objects/weakrefobject.c
@@ -57,6 +57,9 @@ clear_weakref(PyWeakReference *self)
             PyWeakref_GET_OBJECT(self));
 
         if (*list == self)
+	    /* If 'self' is the end of the list (and thus self->wr_next == NULL)
+	       then the weakref list itself (and thus the value of *list) will
+	       end up being set to NULL. */
             *list = self->wr_next;
         self->wr_object = Py_None;
         if (self->wr_prev != NULL)