Commits

Fred Drake  committed 6a37762

cleanup_helper(): Make sure we invalidate all reference objects
before calling any callbacks. This is important
since the callback objects only look at themselves
to determine that they are invalide. This change
avoids a segfault when callbacks use a different
reference to an object in the process of being
deallocated.

This fixes SF bug #415660.

  • Participants
  • Parent commits 0b060cf
  • Branches legacy-trunk

Comments (0)

Files changed (1)

File Modules/_weakref.c

         return;
     }
     list = GET_WEAKREFS_LISTPTR(object);
-    while (*list != NULL) {
-        PyWeakReference *current = *list;
-        PyObject *callback = current->wr_callback;
+    /* Remove the callback-less basic and proxy references */
+    if (*list != NULL && (*list)->wr_callback == NULL) {
+        clear_weakref(*list);
+        if (*list != NULL && (*list)->wr_callback == NULL)
+            clear_weakref(*list);
+    }
+    if (*list != NULL) {
+        int count = getweakrefcount(*list);
 
-        Py_XINCREF(callback);
-        clear_weakref(current);
-        if (callback != NULL) {
+        if (count == 1) {
+            PyWeakReference *current = *list;
+            PyObject *callback = current->wr_callback;
             PyObject *cbresult;
 
+            Py_INCREF(callback);
+            clear_weakref(current);
             cbresult = PyObject_CallFunction(callback, "O", current);
             if (cbresult == NULL)
                 PyErr_WriteUnraisable(callback);
                 Py_DECREF(cbresult);
             Py_DECREF(callback);
         }
+        else {
+            PyObject *tuple = PyTuple_New(count * 2);
+            PyWeakReference *current = *list;
+            int i = 0;
+
+            for (i = 0; i < count; ++i) {
+                PyWeakReference *next = current->wr_next;
+
+                Py_INCREF(current);
+                PyTuple_SET_ITEM(tuple, i * 2, (PyObject *) current);
+                PyTuple_SET_ITEM(tuple, i * 2 + 1, current->wr_callback);
+                current->wr_callback = NULL;
+                next = current->wr_next;
+                clear_weakref(current);
+                current = next;
+            }
+            for (i = 0; i < count; ++i) {
+                PyObject *current = PyTuple_GET_ITEM(tuple, i * 2);
+                PyObject *callback = PyTuple_GET_ITEM(tuple, i * 2 + 1);
+                PyObject *cbresult = PyObject_CallFunction(callback, "O",
+                                                           current);
+                if (cbresult == NULL)
+                    PyErr_WriteUnraisable(callback);
+                else
+                    Py_DECREF(cbresult);
+            }
+            Py_DECREF(tuple);
+        }
     }
     return;
 }