diff options
| author | Sam Gross <colesbury@gmail.com> | 2024-08-07 13:36:19 (GMT) |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2024-08-07 13:36:19 (GMT) |
| commit | 674a50ef2f8909c1c5d812e166bcc12ae6377908 (patch) | |
| tree | 3903df98dc42864af8fc51c11b1d0507280ce267 /Python | |
| parent | 013a0929750ed2b46ae990b59d02e3db84337474 (diff) | |
| download | cpython-674a50ef2f8909c1c5d812e166bcc12ae6377908.zip cpython-674a50ef2f8909c1c5d812e166bcc12ae6377908.tar.gz cpython-674a50ef2f8909c1c5d812e166bcc12ae6377908.tar.bz2 | |
gh-117139: Fix an incorrect borrow in bytecodes.c (#122318)
`_PyDict_SetItem_Take2` steals both the key (i.e., `sub`) and the value.
Diffstat (limited to 'Python')
| -rw-r--r-- | Python/bytecodes.c | 7 | ||||
| -rw-r--r-- | Python/executor_cases.c.h | 9 | ||||
| -rw-r--r-- | Python/generated_cases.c.h | 9 |
3 files changed, 14 insertions, 11 deletions
diff --git a/Python/bytecodes.c b/Python/bytecodes.c index 9a1af0e..e4c97de 100644 --- a/Python/bytecodes.c +++ b/Python/bytecodes.c @@ -862,13 +862,14 @@ dummy_func( PyStackRef_CLOSE(list_st); } - inst(STORE_SUBSCR_DICT, (unused/1, value, dict_st, sub_st -- )) { - PyObject *sub = PyStackRef_AsPyObjectBorrow(sub_st); + inst(STORE_SUBSCR_DICT, (unused/1, value, dict_st, sub -- )) { PyObject *dict = PyStackRef_AsPyObjectBorrow(dict_st); DEOPT_IF(!PyDict_CheckExact(dict)); STAT_INC(STORE_SUBSCR, hit); - int err = _PyDict_SetItem_Take2((PyDictObject *)dict, sub, PyStackRef_AsPyObjectSteal(value)); + int err = _PyDict_SetItem_Take2((PyDictObject *)dict, + PyStackRef_AsPyObjectSteal(sub), + PyStackRef_AsPyObjectSteal(value)); PyStackRef_CLOSE(dict_st); ERROR_IF(err, error); } diff --git a/Python/executor_cases.c.h b/Python/executor_cases.c.h index afc7786..4def11c 100644 --- a/Python/executor_cases.c.h +++ b/Python/executor_cases.c.h @@ -1105,20 +1105,21 @@ } case _STORE_SUBSCR_DICT: { - _PyStackRef sub_st; + _PyStackRef sub; _PyStackRef dict_st; _PyStackRef value; - sub_st = stack_pointer[-1]; + sub = stack_pointer[-1]; dict_st = stack_pointer[-2]; value = stack_pointer[-3]; - PyObject *sub = PyStackRef_AsPyObjectBorrow(sub_st); PyObject *dict = PyStackRef_AsPyObjectBorrow(dict_st); if (!PyDict_CheckExact(dict)) { UOP_STAT_INC(uopcode, miss); JUMP_TO_JUMP_TARGET(); } STAT_INC(STORE_SUBSCR, hit); - int err = _PyDict_SetItem_Take2((PyDictObject *)dict, sub, PyStackRef_AsPyObjectSteal(value)); + int err = _PyDict_SetItem_Take2((PyDictObject *)dict, + PyStackRef_AsPyObjectSteal(sub), + PyStackRef_AsPyObjectSteal(value)); PyStackRef_CLOSE(dict_st); if (err) JUMP_TO_ERROR(); stack_pointer += -3; diff --git a/Python/generated_cases.c.h b/Python/generated_cases.c.h index f670353..e560372 100644 --- a/Python/generated_cases.c.h +++ b/Python/generated_cases.c.h @@ -6625,16 +6625,17 @@ static_assert(INLINE_CACHE_ENTRIES_STORE_SUBSCR == 1, "incorrect cache size"); _PyStackRef value; _PyStackRef dict_st; - _PyStackRef sub_st; + _PyStackRef sub; /* Skip 1 cache entry */ - sub_st = stack_pointer[-1]; + sub = stack_pointer[-1]; dict_st = stack_pointer[-2]; value = stack_pointer[-3]; - PyObject *sub = PyStackRef_AsPyObjectBorrow(sub_st); PyObject *dict = PyStackRef_AsPyObjectBorrow(dict_st); DEOPT_IF(!PyDict_CheckExact(dict), STORE_SUBSCR); STAT_INC(STORE_SUBSCR, hit); - int err = _PyDict_SetItem_Take2((PyDictObject *)dict, sub, PyStackRef_AsPyObjectSteal(value)); + int err = _PyDict_SetItem_Take2((PyDictObject *)dict, + PyStackRef_AsPyObjectSteal(sub), + PyStackRef_AsPyObjectSteal(value)); PyStackRef_CLOSE(dict_st); if (err) goto pop_3_error; stack_pointer += -3; |