diff options
Diffstat (limited to 'Lib/test/crashers')
-rw-r--r-- | Lib/test/crashers/README | 4 | ||||
-rw-r--r-- | Lib/test/crashers/borrowed_ref_1.py | 29 | ||||
-rw-r--r-- | Lib/test/crashers/borrowed_ref_2.py | 38 | ||||
-rw-r--r-- | Lib/test/crashers/compiler_recursion.py | 5 | ||||
-rw-r--r-- | Lib/test/crashers/loosing_mro_ref.py | 35 | ||||
-rw-r--r-- | Lib/test/crashers/nasty_eq_vs_dict.py | 47 | ||||
-rw-r--r-- | Lib/test/crashers/recursion_limit_too_high.py | 16 |
7 files changed, 4 insertions, 170 deletions
diff --git a/Lib/test/crashers/README b/Lib/test/crashers/README index 2a73e1b..0259a06 100644 --- a/Lib/test/crashers/README +++ b/Lib/test/crashers/README @@ -14,3 +14,7 @@ note if the cause is system or environment dependent and what the variables are. Once the crash is fixed, the test case should be moved into an appropriate test (even if it was originally from the test suite). This ensures the regression doesn't happen again. And if it does, it should be easier to track down. + +Also see Lib/test_crashers.py which exercises the crashers in this directory. +In particular, make sure to add any new infinite loop crashers to the black +list so it doesn't try to run them. diff --git a/Lib/test/crashers/borrowed_ref_1.py b/Lib/test/crashers/borrowed_ref_1.py deleted file mode 100644 index b82f464..0000000 --- a/Lib/test/crashers/borrowed_ref_1.py +++ /dev/null @@ -1,29 +0,0 @@ -""" -_PyType_Lookup() returns a borrowed reference. -This attacks the call in dictobject.c. -""" - -class A(object): - pass - -class B(object): - def __del__(self): - print('hi') - del D.__missing__ - -class D(dict): - class __missing__: - def __init__(self, *args): - pass - - -d = D() -a = A() -a.cycle = a -a.other = B() -del a - -prev = None -while 1: - d[5] - prev = (prev,) diff --git a/Lib/test/crashers/borrowed_ref_2.py b/Lib/test/crashers/borrowed_ref_2.py deleted file mode 100644 index 6e403eb..0000000 --- a/Lib/test/crashers/borrowed_ref_2.py +++ /dev/null @@ -1,38 +0,0 @@ -""" -_PyType_Lookup() returns a borrowed reference. -This attacks PyObject_GenericSetAttr(). - -NB. on my machine this crashes in 2.5 debug but not release. -""" - -class A(object): - pass - -class B(object): - def __del__(self): - print("hi") - del C.d - -class D(object): - def __set__(self, obj, value): - self.hello = 42 - -class C(object): - d = D() - - def g(): - pass - - -c = C() -a = A() -a.cycle = a -a.other = B() - -lst = [None] * 1000000 -i = 0 -del a -while 1: - c.d = 42 # segfaults in PyMethod_New(__func__=D.__set__, __self__=d) - lst[i] = c.g # consume the free list of instancemethod objects - i += 1 diff --git a/Lib/test/crashers/compiler_recursion.py b/Lib/test/crashers/compiler_recursion.py deleted file mode 100644 index 4954bdd..0000000 --- a/Lib/test/crashers/compiler_recursion.py +++ /dev/null @@ -1,5 +0,0 @@ -""" -The compiler (>= 2.5) recurses happily. -""" - -compile('()'*9**5, '?', 'exec') diff --git a/Lib/test/crashers/loosing_mro_ref.py b/Lib/test/crashers/loosing_mro_ref.py deleted file mode 100644 index b3bcd32..0000000 --- a/Lib/test/crashers/loosing_mro_ref.py +++ /dev/null @@ -1,35 +0,0 @@ -""" -There is a way to put keys of any type in a type's dictionary. -I think this allows various kinds of crashes, but so far I have only -found a convoluted attack of _PyType_Lookup(), which uses the mro of the -type without holding a strong reference to it. Probably works with -super.__getattribute__() too, which uses the same kind of code. -""" - -class MyKey(object): - def __hash__(self): - return hash('mykey') - - def __eq__(self, other): - # the following line decrefs the previous X.__mro__ - X.__bases__ = (Base2,) - # trash all tuples of length 3, to make sure that the items of - # the previous X.__mro__ are really garbage - z = [] - for i in range(1000): - z.append((i, None, None)) - return 0 - - -class Base(object): - mykey = 'from Base' - -class Base2(object): - mykey = 'from Base2' - -# you can't add a non-string key to X.__dict__, but it can be -# there from the beginning :-) -X = type('X', (Base,), {MyKey(): 5}) - -print(X.mykey) -# I get a segfault, or a slightly wrong assertion error in a debug build. diff --git a/Lib/test/crashers/nasty_eq_vs_dict.py b/Lib/test/crashers/nasty_eq_vs_dict.py deleted file mode 100644 index 85f7caf..0000000 --- a/Lib/test/crashers/nasty_eq_vs_dict.py +++ /dev/null @@ -1,47 +0,0 @@ -# from http://mail.python.org/pipermail/python-dev/2001-June/015239.html - -# if you keep changing a dictionary while looking up a key, you can -# provoke an infinite recursion in C - -# At the time neither Tim nor Michael could be bothered to think of a -# way to fix it. - -class Yuck: - def __init__(self): - self.i = 0 - - def make_dangerous(self): - self.i = 1 - - def __hash__(self): - # direct to slot 4 in table of size 8; slot 12 when size 16 - return 4 + 8 - - def __eq__(self, other): - if self.i == 0: - # leave dict alone - pass - elif self.i == 1: - # fiddle to 16 slots - self.__fill_dict(6) - self.i = 2 - else: - # fiddle to 8 slots - self.__fill_dict(4) - self.i = 1 - - return 1 - - def __fill_dict(self, n): - self.i = 0 - dict.clear() - for i in range(n): - dict[i] = i - dict[self] = "OK!" - -y = Yuck() -dict = {y: "OK!"} - -z = Yuck() -y.make_dangerous() -print(dict[z]) diff --git a/Lib/test/crashers/recursion_limit_too_high.py b/Lib/test/crashers/recursion_limit_too_high.py deleted file mode 100644 index ec64936..0000000 --- a/Lib/test/crashers/recursion_limit_too_high.py +++ /dev/null @@ -1,16 +0,0 @@ -# The following example may crash or not depending on the platform. -# E.g. on 32-bit Intel Linux in a "standard" configuration it seems to -# crash on Python 2.5 (but not 2.4 nor 2.3). On Windows the import -# eventually fails to find the module, possibly because we run out of -# file handles. - -# The point of this example is to show that sys.setrecursionlimit() is a -# hack, and not a robust solution. This example simply exercises a path -# where it takes many C-level recursions, consuming a lot of stack -# space, for each Python-level recursion. So 1000 times this amount of -# stack space may be too much for standard platforms already. - -import sys -if 'recursion_limit_too_high' in sys.modules: - del sys.modules['recursion_limit_too_high'] -import recursion_limit_too_high |