diff --git a/Lib/test/test_io.py b/Lib/test/test_io.py index 0ffb4a15ef0..419921f8cdc 100644 --- a/Lib/test/test_io.py +++ b/Lib/test/test_io.py @@ -611,7 +611,24 @@ class IOTest(unittest.TestCase): self.assertEqual(rawio.read(2), b"") class CIOTest(IOTest): - pass + + def test_IOBase_finalize(self): + # Issue #12149: segmentation fault on _PyIOBase_finalize when both a + # class which inherits IOBase and an object of this class are caught + # in a reference cycle and close() is already in the method cache. + class MyIO(self.IOBase): + def close(self): + pass + + # create an instance to populate the method cache + MyIO() + obj = MyIO() + obj.obj = obj + wr = weakref.ref(obj) + del MyIO + del obj + support.gc_collect() + self.assertTrue(wr() is None, wr) class PyIOTest(IOTest): pass diff --git a/Misc/ACKS b/Misc/ACKS index 6879c98a193..5ad6ead858a 100644 --- a/Misc/ACKS +++ b/Misc/ACKS @@ -785,6 +785,7 @@ Armin Rigo Nicholas Riley Jean-Claude Rimbault Juan M. Bello Rivas +Davide Rizzo Anthony Roach Mark Roberts Jim Robinson diff --git a/Misc/NEWS b/Misc/NEWS index c4c8430d4fb..8a848916c1e 100644 --- a/Misc/NEWS +++ b/Misc/NEWS @@ -10,6 +10,12 @@ What's New in Python 3.3 Alpha 1? Core and Builtins ----------------- +- Issue #12149: Update the method cache after a type's dictionnary gets + cleared by the garbage collector. This fixes a segfault when an instance + and its type get caught in a reference cycle, and the instance's + deallocator calls one of the methods on the type (e.g. when subclassing + IOBase). Diagnosis and patch by Davide Rizzo. + - Issue #9611, #9015: FileIO.read() clamps the length to INT_MAX on Windows. - Issue #9642: Uniformize the tests on the availability of the mbcs codec, add diff --git a/Objects/typeobject.c b/Objects/typeobject.c index 5b7ab1edfed..1642dade540 100644 --- a/Objects/typeobject.c +++ b/Objects/typeobject.c @@ -967,6 +967,8 @@ subtype_dealloc(PyObject *self) assert(basedealloc); basedealloc(self); + PyType_Modified(type); + /* Can't reference self beyond this point */ Py_DECREF(type);