SF bug 839548: Bug in type's GC handling causes segfaults.
Also SF patch 843455.
This is a critical bugfix.
I'll backport to 2.3 maint, but not beyond that. The bugs this fixes
have been there since weakrefs were introduced.
diff --git a/Misc/NEWS b/Misc/NEWS
index c19d417..30fe4be 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -12,9 +12,20 @@
Core and builtins
-----------------
-- Compiler flags set in PYTHONSTARTUP are now active in __main__.
-
-- Added two builtin types, set() and frozenset().
+- Critical bugfix, for SF bug 839548: if a weakref with a callback,
+ its callback, and its weakly referenced object, all became part of
+ cyclic garbage during a single run of garbage collection, the order
+ in which they were torn down was unpredictable. It was possible for
+ the callback to see partially-torn-down objects, leading to immediate
+ segfaults, or, if the callback resurrected garbage objects, to
+ resurrect insane objects that caused segfaults (or other surprises)
+ later. In one sense this wasn't surprising, because Python's cyclic gc
+ had no knowledge of Python's weakref objects. It does now. When
+ weakrefs with callbacks become part of cyclic garbage now, those
+ weakrefs are cleared first. The callbacks don't trigger then,
+ preventing the problems. If you need callbacks to trigger, then just
+ as when cyclic gc is not involved, you need to write your code so
+ that weakref objects outlive the objects they weakly reference.
- Critical bugfix, for SF bug 840829: if cyclic garbage collection
happened to occur during a weakref callback for a new-style class
@@ -22,6 +33,10 @@
in a debug build, a segfault occurred reliably very soon after).
This has been repaired.
+- Compiler flags set in PYTHONSTARTUP are now active in __main__.
+
+- Added two builtin types, set() and frozenset().
+
- Added a reversed() builtin function that returns a reverse iterator
over a sequence.