Merged revisions 77821 via svnmerge from

svn+ssh://pythondev@svn.python.org/python/trunk

........
  r77821 | mark.dickinson | 2010-01-29 17:11:39 +0000 (Fri, 29 Jan 2010) | 3 lines

  Issue #7788: Fix a crash produced by deleting a list slice with huge
  step value.  Patch by Marcin Bachry.
........

Lib/test/list_tests.py

@@ -519,6 +519,9 @@ class CommonTest(seq_tests.CommonTest):
         a = self.type2test(range(10))
         a[::2] = tuple(range(5))
         self.assertEqual(a, self.type2test([0, 1, 1, 3, 2, 5, 3, 7, 4, 9]))
+        # test issue7788
+        a = self.type2test(range(10))
+        del a[9::1<<333]
 
     def test_constructor_exception_handling(self):
         # Bug #1242657

Lib/test/test_array.py

@@ -850,6 +850,9 @@ class NumberTest(BaseTest):
         a = array.array(self.typecode, range(10))
         del a[::1000]
         self.assertEqual(a, array.array(self.typecode, [1,2,3,4,5,6,7,8,9]))
+        # test issue7788
+        a = array.array(self.typecode, range(10))
+        del a[9::1<<333]
 
     def test_assignment(self):
         a = array.array(self.typecode, range(10))

Lib/test/test_bytes.py

@@ -569,7 +569,7 @@ class ByteArrayTest(BaseBytesTest):
         self.assertEqual(b, bytearray([0, 1, 2, 42, 42, 42, 3, 4, 5, 6, 7, 8, 9]))
 
     def test_extended_set_del_slice(self):
-        indices = (0, None, 1, 3, 19, 300, -1, -2, -31, -300)
+        indices = (0, None, 1, 3, 19, 300, 1<<333, -1, -2, -31, -300)
         for start in indices:
             for stop in indices:
                 # Skip invalid step 0

Misc/NEWS

@@ -12,6 +12,9 @@ What's New in Python 2.6.5
 Core and Builtins
 -----------------
 
+- Issue #7788: Fix an interpreter crash produced by deleting a list
+  slice with very large step value.
+
 - Issue #7561: Operations on empty bytearrays (such as `int(bytearray())`)
   could crash in many places because of the PyByteArray_AS_STRING() macro
   returning NULL.  The macro now returns a statically allocated empty

Modules/arraymodule.c

@@ -1794,7 +1794,8 @@ array_ass_subscr(arrayobject* self, PyObject* item, PyObject* value)
 	}
 	else if (needed == 0) {
 		/* Delete slice */
-		Py_ssize_t cur, i;
+		size_t cur;
+		Py_ssize_t i;
 
 		if (step < 0) {
 			stop = start + 1;

Objects/bytearrayobject.c

@@ -699,7 +699,8 @@ bytes_ass_subscript(PyByteArrayObject *self, PyObject *index, PyObject *values)
     else {
         if (needed == 0) {
             /* Delete slice */
-            Py_ssize_t cur, i;
+            size_t cur;
+            Py_ssize_t i;
 
             if (!_canresize(self))
                 return -1;

Objects/listobject.c

@@ -2604,7 +2604,8 @@ list_ass_subscript(PyListObject* self, PyObject* item, PyObject* value)
 		if (value == NULL) {
 			/* delete slice */
 			PyObject **garbage;
-			Py_ssize_t cur, i;
+			size_t cur;
+			Py_ssize_t i;
 
 			if (slicelength <= 0)
 				return 0;