diff --git a/Lib/test/test_deque.py b/Lib/test/test_deque.py index 51b66b76aca91d..c0f7138254f3f6 100644 --- a/Lib/test/test_deque.py +++ b/Lib/test/test_deque.py @@ -183,6 +183,18 @@ def test_contains(self): with self.assertRaises(RuntimeError): n in d + def test_contains_count_stop_crashes(self): + class A: + def __eq__(self, other): + d.clear() + return NotImplemented + d = deque([A(), A()]) + with self.assertRaises(RuntimeError): + _ = 3 in d + d = deque([A(), A()]) + with self.assertRaises(RuntimeError): + _ = d.count(3) + def test_extend(self): d = deque('a') self.assertRaises(TypeError, d.extend, 1) diff --git a/Misc/NEWS.d/next/Library/2020-02-09-05-51-05.bpo-39590.rf98GU.rst b/Misc/NEWS.d/next/Library/2020-02-09-05-51-05.bpo-39590.rf98GU.rst new file mode 100644 index 00000000000000..68625028fb7afc --- /dev/null +++ b/Misc/NEWS.d/next/Library/2020-02-09-05-51-05.bpo-39590.rf98GU.rst @@ -0,0 +1 @@ +Collections.deque now holds strong references during deque.__contains__ and deque.count, fixing crashes. \ No newline at end of file diff --git a/Modules/_collectionsmodule.c b/Modules/_collectionsmodule.c index 10030606711e01..25e4c96943e464 100644 --- a/Modules/_collectionsmodule.c +++ b/Modules/_collectionsmodule.c @@ -965,7 +965,9 @@ deque_count(dequeobject *deque, PyObject *v) while (--n >= 0) { CHECK_NOT_END(b); item = b->data[index]; + Py_INCREF(item); cmp = PyObject_RichCompareBool(item, v, Py_EQ); + Py_DECREF(item); if (cmp < 0) return NULL; count += cmp; @@ -1002,7 +1004,9 @@ deque_contains(dequeobject *deque, PyObject *v) while (--n >= 0) { CHECK_NOT_END(b); item = b->data[index]; + Py_INCREF(item); cmp = PyObject_RichCompareBool(item, v, Py_EQ); + Py_DECREF(item); if (cmp) { return cmp; }