#3720: Interpreter crashes when an evil iterator removes its own next function.
Now the slot is filled with a function that always raises.
Will not backport: extensions compiled with 2.6.x would not run on 2.6.0.
diff --git a/Objects/abstract.c b/Objects/abstract.c
index 956c4f4..80a1289 100644
--- a/Objects/abstract.c
+++ b/Objects/abstract.c
@@ -3067,7 +3067,6 @@
PyIter_Next(PyObject *iter)
{
PyObject *result;
- assert(PyIter_Check(iter));
result = (*iter->ob_type->tp_iternext)(iter);
if (result == NULL &&
PyErr_Occurred() &&
diff --git a/Objects/object.c b/Objects/object.c
index 1e0db4a..ba736a9 100644
--- a/Objects/object.c
+++ b/Objects/object.c
@@ -1305,6 +1305,20 @@
return obj;
}
+/* Helper used when the __next__ method is removed from a type:
+ tp_iternext is never NULL and can be safely called without checking
+ on every iteration.
+ */
+
+PyObject *
+_PyObject_NextNotImplemented(PyObject *self)
+{
+ PyErr_Format(PyExc_TypeError,
+ "'%.200s' object is not iterable",
+ Py_TYPE(self)->tp_name);
+ return NULL;
+}
+
/* Generic GetAttr functions - put these in your tp_[gs]etattro slot */
PyObject *
diff --git a/Objects/typeobject.c b/Objects/typeobject.c
index 3f790e8..8242242 100644
--- a/Objects/typeobject.c
+++ b/Objects/typeobject.c
@@ -6090,8 +6090,12 @@
}
do {
descr = _PyType_Lookup(type, p->name_strobj);
- if (descr == NULL)
+ if (descr == NULL) {
+ if (ptr == (void**)&type->tp_iternext) {
+ specific = _PyObject_NextNotImplemented;
+ }
continue;
+ }
if (Py_TYPE(descr) == &PyWrapperDescr_Type) {
void **tptr = resolve_slotdups(type, p->name_strobj);
if (tptr == NULL || tptr == ptr)