#3720: Interpreter crashes when an evil iterator removes its own next function.
Now the slot is filled with a function that always raises.
Will not backport: extensions compiled with 2.6.x would not run on 2.6.0.
diff --git a/Objects/typeobject.c b/Objects/typeobject.c
index 3f790e8..8242242 100644
--- a/Objects/typeobject.c
+++ b/Objects/typeobject.c
@@ -6090,8 +6090,12 @@
}
do {
descr = _PyType_Lookup(type, p->name_strobj);
- if (descr == NULL)
+ if (descr == NULL) {
+ if (ptr == (void**)&type->tp_iternext) {
+ specific = _PyObject_NextNotImplemented;
+ }
continue;
+ }
if (Py_TYPE(descr) == &PyWrapperDescr_Type) {
void **tptr = resolve_slotdups(type, p->name_strobj);
if (tptr == NULL || tptr == ptr)