Fix SF bug #1546288, crash in dict_equal

Lib/test/test_mutants.py

@@ -91,12 +91,17 @@ class Horrid:
         self.hashcode = random.randrange(1000000000)
 
     def __hash__(self):
+        return 42
         return self.hashcode
 
     def __cmp__(self, other):
         maybe_mutate()   # The point of the test.
         return cmp(self.i, other.i)
 
+    def __eq__(self, other):
+        maybe_mutate()   # The point of the test.
+        return self.i == other.i
+
     def __repr__(self):
         return "Horrid(%d)" % self.i
 
@@ -132,7 +137,10 @@ def test_one(n):
     while dict1 and len(dict1) == len(dict2):
         if verbose:
             print ".",
-        c = cmp(dict1, dict2)
+        if random.random() < 0.5:
+            c = cmp(dict1, dict2)
+        else:
+            c = dict1 == dict2
     if verbose:
         print
 

Misc/NEWS

@@ -9,6 +9,13 @@ What's New in Python 2.5?
 
 *Release date: XX-SEP-2006*
 
+(Hopefully nothing.)
+
+What's New in Python 2.5 release candidate 2?
+=============================================
+
+*Release date: XX-SEP-2006*
+
 Core and builtins
 -----------------
 
@@ -18,12 +25,14 @@ Core and builtins
 - Patch #1541585: fix buffer overrun when performing repr() on
   a unicode string in a build with wide unicode (UCS-4) support.
 
+- Patch #1546288: fix seg fault in dict_equal due to ref counting bug.
+
 
 Library
 -------
 
 - Patch #1550886: Fix decimal module context management implementation
-  to match the localcontext() example from PEP 343
+  to match the localcontext() example from PEP 343.
 
 - Bug #1541863: uuid.uuid1 failed to generate unique identifiers
   on systems with low clock resolution.

Objects/dictobject.c

@@ -1585,7 +1585,10 @@ dict_equal(dictobject *a, dictobject *b)
 			/* temporarily bump aval's refcount to ensure it stays
 			   alive until we're done with it */
 			Py_INCREF(aval);
+			/* ditto for key */
+			Py_INCREF(key);
 			bval = PyDict_GetItem((PyObject *)b, key);
+			Py_DECREF(key);
 			if (bval == NULL) {
 				Py_DECREF(aval);
 				return 0;