If you created a weakref in an object's __del__ method to itself it would
segfault the interpreter during weakref clean up. Now any new weakrefs created
after __del__ is run are removed silently.
Fixes bug #1377858 and the weakref_in_del crasher for new-style classes.
Classic classes are still affected.
diff --git a/Objects/typeobject.c b/Objects/typeobject.c
index d4a46c3..a8395ef 100644
--- a/Objects/typeobject.c
+++ b/Objects/typeobject.c
@@ -666,6 +666,17 @@
goto endlabel; /* resurrected */
else
_PyObject_GC_UNTRACK(self);
+ /* New weakrefs could be created during the finalizer call.
+ If this occurs, clear them out without calling their
+ finalizers since they might rely on part of the object
+ being finalized that has already been destroyed. */
+ if (type->tp_weaklistoffset && !base->tp_weaklistoffset) {
+ /* Modeled after GET_WEAKREFS_LISTPTR() */
+ PyWeakReference **list = (PyWeakReference **) \
+ PyObject_GET_WEAKREFS_LISTPTR(self);
+ while (*list)
+ _PyWeakref_ClearRef(*list);
+ }
}
/* Clear slots up to the nearest base with a different tp_dealloc */
diff --git a/Objects/weakrefobject.c b/Objects/weakrefobject.c
index 826f571..a404f29 100644
--- a/Objects/weakrefobject.c
+++ b/Objects/weakrefobject.c
@@ -57,6 +57,9 @@
PyWeakref_GET_OBJECT(self));
if (*list == self)
+ /* If 'self' is the end of the list (and thus self->wr_next == NULL)
+ then the weakref list itself (and thus the value of *list) will
+ end up being set to NULL. */
*list = self->wr_next;
self->wr_object = Py_None;
if (self->wr_prev != NULL)