From 1616645a0032b45c935ec6bdbb1d46b3febf0827 Mon Sep 17 00:00:00 2001
From: Antoine Pitrou <solipsis@pitrou.net>
Date: Tue, 12 Jul 2011 22:04:20 +0200
Subject: Issue #12149: Update the method cache after a type's dictionnary gets
 cleared by the garbage collector.  This fixes a segfault when an instance and
 its type get caught in a reference cycle, and the instance's deallocator
 calls one of the methods on the type (e.g. when subclassing IOBase).

Diagnosis and patch by Davide Rizzo.
---
 Lib/test/test_io.py  | 19 ++++++++++++++++++-
 Misc/ACKS            |  1 +
 Misc/NEWS            |  6 ++++++
 Objects/typeobject.c |  2 ++
 4 files changed, 27 insertions(+), 1 deletion(-)

diff --git a/Lib/test/test_io.py b/Lib/test/test_io.py
index 0bc5800..c423dd6 100644
--- a/Lib/test/test_io.py
+++ b/Lib/test/test_io.py
@@ -585,7 +585,24 @@ class IOTest(unittest.TestCase):
         self.assertEqual(rawio.read(2), b"")
 
 class CIOTest(IOTest):
-    pass
+
+    def test_IOBase_finalize(self):
+        # Issue #12149: segmentation fault on _PyIOBase_finalize when both a
+        # class which inherits IOBase and an object of this class are caught
+        # in a reference cycle and close() is already in the method cache.
+        class MyIO(self.IOBase):
+            def close(self):
+                pass
+
+        # create an instance to populate the method cache
+        MyIO()
+        obj = MyIO()
+        obj.obj = obj
+        wr = weakref.ref(obj)
+        del MyIO
+        del obj
+        support.gc_collect()
+        self.assertTrue(wr() is None, wr)
 
 class PyIOTest(IOTest):
     test_array_writes = unittest.skip(
diff --git a/Misc/ACKS b/Misc/ACKS
index 709ded3..665f71f 100644
--- a/Misc/ACKS
+++ b/Misc/ACKS
@@ -686,6 +686,7 @@ Armin Rigo
 Nicholas Riley
 Jean-Claude Rimbault
 Juan M. Bello Rivas
+Davide Rizzo
 Anthony Roach
 Mark Roberts
 Jim Robinson
diff --git a/Misc/NEWS b/Misc/NEWS
index 97a4acb..4aa48ae 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -9,6 +9,12 @@ What's New in Python 2.7.3?
 Core and Builtins
 -----------------
 
+- Issue #12149: Update the method cache after a type's dictionnary gets
+  cleared by the garbage collector.  This fixes a segfault when an instance
+  and its type get caught in a reference cycle, and the instance's
+  deallocator calls one of the methods on the type (e.g. when subclassing
+  IOBase).  Diagnosis and patch by Davide Rizzo.
+
 - Issue #12501: Adjust callable() warning: callable() is only not supported in
   Python 3.1. callable() is again supported in Python 3.2.
 
diff --git a/Objects/typeobject.c b/Objects/typeobject.c
index 49c7e07..8326d07 100644
--- a/Objects/typeobject.c
+++ b/Objects/typeobject.c
@@ -1013,6 +1013,8 @@ subtype_dealloc(PyObject *self)
     assert(basedealloc);
     basedealloc(self);
 
+    PyType_Modified(type);
+
     /* Can't reference self beyond this point */
     Py_DECREF(type);
 
-- 
cgit v0.12