_PyObject_GetDictPtr(): when the offset is negative, always align --
we can't trust that tp_basicsize is aligned. Fixes SF bug #462848.
diff --git a/Objects/object.c b/Objects/object.c
index 668bd4f..6d7a5e9 100644
--- a/Objects/object.c
+++ b/Objects/object.c
@@ -1150,18 +1150,13 @@
return NULL;
if (dictoffset < 0) {
dictoffset += tp->tp_basicsize;
+ dictoffset += tp->tp_itemsize * ((PyVarObject *)obj)->ob_size;
assert(dictoffset > 0); /* Sanity check */
- if (tp->tp_itemsize > 0) {
- int n = ((PyVarObject *)obj)->ob_size;
- if (n > 0) {
- dictoffset += tp->tp_itemsize * n;
- /* Round up, if necessary */
- if (tp->tp_itemsize % PTRSIZE != 0) {
- dictoffset += PTRSIZE - 1;
- dictoffset /= PTRSIZE;
- dictoffset *= PTRSIZE;
- }
- }
+ /* Round up, if necessary */
+ if (dictoffset % PTRSIZE != 0) {
+ dictoffset /= PTRSIZE;
+ dictoffset += 1;
+ dictoffset *= PTRSIZE;
}
}
return (PyObject **) ((char *)obj + dictoffset);