[issue3299] invalid object destruction in re.finditer()

Nick Coghlan added the comment: It certainly looks like all direct calls to PyObject_DEL/PyObject_Del from outside tp_dealloc implementations are going to be broken in pydebug builds. Replacing those calls with either Py_DECREF operations (as Victor's patch does) or direct calls to _Py_Dealloc

[issue3299] invalid object destruction in re.finditer()

Changes by Jeffrey C. Jacobs <[EMAIL PROTECTED]>: -- versions: +Python 2.7 -Python 2.6 ___ Python tracker <[EMAIL PROTECTED]> ___ ___ Py

[issue3299] invalid object destruction in re.finditer()

Changes by Jeffrey C. Jacobs <[EMAIL PROTECTED]>: -- nosy: +timehorse ___ Python tracker <[EMAIL PROTECTED]> ___ ___ Python-bugs-list ma

[issue3299] invalid object destruction in re.finditer()

Changes by Jesús Cea Avión <[EMAIL PROTECTED]>: -- nosy: +jcea ___ Python tracker <[EMAIL PROTECTED]> ___ ___ Python-bugs-list mailing l

[issue3299] invalid object destruction in re.finditer()

Fredrik Lundh <[EMAIL PROTECTED]> added the comment: Reducing priority to normal; this bug has been around since Python 2.2, and only affects code that doesn't work anyway when running on debug builds. -- priority: critical -> normal ___ Python tracke

[issue3299] invalid object destruction in re.finditer()

Changes by Adam Olsen <[EMAIL PROTECTED]>: -- nosy: +Rhamphoryncus ___ Python tracker <[EMAIL PROTECTED]> ___ ___ Python-bugs-list maili

[issue3299] invalid object destruction in re.finditer()

STINNER Victor <[EMAIL PROTECTED]> added the comment: About _curses_panel.patch: same as pyobject_del.patch, i didn't tested the code, and is looks like PyCursesPanel_Dealloc() expects that the object is properly initialized. It looks like this bug (invalid use of PyObject_Del/PyObject_DEL) is

[issue3299] invalid object destruction in re.finditer()

STINNER Victor <[EMAIL PROTECTED]> added the comment: Other examples of invalid use of PyObject_Del(). Don't apply the patch, i didn't check it. Eg. element_dealloc() should crash if self->tag is NULL... and at line 331, self->tag is NULL whereas I called element_dealloc() using Py_DECREF()!

[issue3299] invalid object destruction in re.finditer()

Changes by STINNER Victor <[EMAIL PROTECTED]>: Added file: http://bugs.python.org/file10892/_curses_panel.patch ___ Python tracker <[EMAIL PROTECTED]> ___ _

[issue3299] invalid object destruction in re.finditer()

Changes by STINNER Victor <[EMAIL PROTECTED]>: Removed file: http://bugs.python.org/file10828/re_finditer.patch ___ Python tracker <[EMAIL PROTECTED]> ___ _

[issue3299] invalid object destruction in re.finditer()

STINNER Victor <[EMAIL PROTECTED]> added the comment: F*ck, Firefox just crashed! I have to rewrite my long comment... First, to explain why the problem only occurs in pydebug mode: a PyObject has only _ob_next and _ob_prev attributes if Py_TRACE_REFS is set (eg. by pydebug). PyObject_NEW() an

[issue3299] invalid object destruction in re.finditer()

STINNER Victor <[EMAIL PROTECTED]> added the comment: Valgrind output for Python trunk compiled with pydebug option: ==29848== Invalid read of size 4 ==29848==at 0x809AF61: _Py_ForgetReference (object.c:2044) ==29848==by 0x809AFCF: _Py_Dealloc (object.c:2065) ==29848==by 0x80FE635: ca

[issue3299] invalid object destruction in re.finditer()

STINNER Victor <[EMAIL PROTECTED]> added the comment: Hum, the bug is maybe specific to Python build with --with-pydebug. I don't know exactly the behaviour changes of the PYDEBUG option. @effbot: in my patch, I replaced PyObject_DEL (PyObject_FREE) and not PyObject_Del (PyMem_Free).

[issue3299] invalid object destruction in re.finditer()

Georg Brandl <[EMAIL PROTECTED]> added the comment: > It can also be used in constructors, to destroy an object that was just > created if something goes wrong. It appears that this is not true in debug builds: PyObject_NEW adds the object to the global linked list of all objects, which PyObject

[issue3299] invalid object destruction in re.finditer()

Fredrik Lundh <[EMAIL PROTECTED]> added the comment: This report makes no sense to me; at least in Python 2.X, PyObject_Del removes a chunk of memory from the object heap. It's designed to be used from dealloc implementations, to release the actual memory (either directly, or as the default impl

[issue3299] invalid object destruction in re.finditer()

STINNER Victor <[EMAIL PROTECTED]> added the comment: @georg.brandl: The error is an Heisenbug. Yes, sometimes it doesn't crash, but recheck in Valgrind ;-) ___ Python tracker <[EMAIL PROTECTED]>

[issue3299] invalid object destruction in re.finditer()

Changes by Georg Brandl <[EMAIL PROTECTED]>: -- priority: -> critical ___ Python tracker <[EMAIL PROTECTED]> ___ ___ Python-bugs-list m

[issue3299] invalid object destruction in re.finditer()

Changes by Georg Brandl <[EMAIL PROTECTED]>: -- assignee: -> effbot nosy: +effbot ___ Python tracker <[EMAIL PROTECTED]> ___ ___ Python

[issue3299] invalid object destruction in re.finditer()

Georg Brandl <[EMAIL PROTECTED]> added the comment: This seems to be new in trunk; 2.5.2 raises a TypeError. -- nosy: +georg.brandl ___ Python tracker <[EMAIL PROTECTED]> ___ _

[issue3299] invalid object destruction in re.finditer()

New submission from STINNER Victor <[EMAIL PROTECTED]>: "import re: re.finditer("a", {})" crash on Python 2.x (tested with svn trunk) because of an invalid use of PyObject_NEW/PyObject_DEL. The error is in pattern_scanner(), in block "if (!string) { ... }". - scanner_dealloc() calls Py_DECREF(