diff options
| -rw-r--r-- | Lib/test/test_descr.py | 17 | ||||
| -rw-r--r-- | Misc/NEWS | 3 | ||||
| -rw-r--r-- | Objects/typeobject.c | 3 |
3 files changed, 23 insertions, 0 deletions
diff --git a/Lib/test/test_descr.py b/Lib/test/test_descr.py index d096390..f5e4b02 100644 --- a/Lib/test/test_descr.py +++ b/Lib/test/test_descr.py @@ -5092,6 +5092,23 @@ class PicklingTests(unittest.TestCase): objcopy2 = deepcopy(objcopy) self._assert_is_copy(obj, objcopy2) + def test_issue24097(self): + # Slot name is freed inside __getattr__ and is later used. + class S(str): # Not interned + pass + class A: + __slotnames__ = [S('spam')] + def __getattr__(self, attr): + if attr == 'spam': + A.__slotnames__[:] = [S('spam')] + return 42 + else: + raise AttributeError + + import copyreg + expected = (copyreg.__newobj__, (A,), (None, {'spam': 42}), None, None) + self.assertEqual(A().__reduce__(2), expected) # Shouldn't crash + class SharedKeyTests(unittest.TestCase): @@ -10,6 +10,9 @@ Release date: XXXX-XX-XX Core and Builtins ----------------- +- Issue #24097: Fixed crash in object.__reduce__() if slot name is freed inside + __getattr__. + - Issue #24731: Fixed crash on converting objects with special methods __bytes__, __trunc__, and __float__ returning instances of subclasses of bytes, int, and float to subclasses of bytes, int, and float correspondingly. diff --git a/Objects/typeobject.c b/Objects/typeobject.c index f87d58f..0b94fc5 100644 --- a/Objects/typeobject.c +++ b/Objects/typeobject.c @@ -3889,8 +3889,10 @@ _PyObject_GetState(PyObject *obj) PyObject *name, *value; name = PyList_GET_ITEM(slotnames, i); + Py_INCREF(name); value = PyObject_GetAttr(obj, name); if (value == NULL) { + Py_DECREF(name); if (!PyErr_ExceptionMatches(PyExc_AttributeError)) { goto error; } @@ -3899,6 +3901,7 @@ _PyObject_GetState(PyObject *obj) } else { int err = PyDict_SetItem(slots, name, value); + Py_DECREF(name); Py_DECREF(value); if (err) { goto error; |