Issue #28871: Fixed a crash when deallocate deep ElementTree.

serhiy-storchaka · serhiy-storchaka · commit 18f018ca12fc · 2016-12-21T12:32:56.000+02:00
diff --git a/Lib/test/test_xml_etree_c.py b/Lib/test/test_xml_etree_c.py
@@ -11,6 +11,7 @@
                                 fresh=['_elementtree', 'xml.etree'])
 
 
+@unittest.skipUnless(cET, 'requires _elementtree')
 class MiscTests(unittest.TestCase):
     # Issue #8651.
     @support.bigmemtest(size=support._2G + 100, memuse=1, dry_run=False)
@@ -54,6 +55,15 @@ def test_del_attribute(self):
             del element.attrib
         self.assertEqual(element.attrib, {'A': 'B', 'C': 'D'})
 
+    def test_trashcan(self):
+        # If this test fails, it will most likely die via segfault.
+        e = root = cET.Element('root')
+        for i in range(200000):
+            e = cET.SubElement(e, 'x')
+        del e
+        del root
+        support.gc_collect()
+
 
 @unittest.skipUnless(cET, 'requires _elementtree')
 class TestAliasWorking(unittest.TestCase):
diff --git a/Misc/NEWS b/Misc/NEWS
@@ -138,6 +138,8 @@ Core and Builtins
 Library
 -------
 
+- Issue #28871: Fixed a crash when deallocate deep ElementTree.
+
 - Issue #19542: Fix bugs in WeakValueDictionary.setdefault() and
   WeakValueDictionary.pop() when a GC collection happens in another
   thread.
diff --git a/Modules/_elementtree.c b/Modules/_elementtree.c
@@ -652,6 +652,7 @@ static void
 element_dealloc(ElementObject* self)
 {
     PyObject_GC_UnTrack(self);
+    Py_TRASHCAN_SAFE_BEGIN(self)
 
     if (self->weakreflist != NULL)
         PyObject_ClearWeakRefs((PyObject *) self);
@@ -662,6 +663,7 @@ element_dealloc(ElementObject* self)
 
     RELEASE(sizeof(ElementObject), "destroy element");
     Py_TYPE(self)->tp_free((PyObject *)self);
+    Py_TRASHCAN_SAFE_END(self)
 }
 
 /* -------------------------------------------------------------------- */

Original file line number	Diff line number	Diff line change
`@@ -652,6 +652,7 @@ static void`
`652`	`652`	`element_dealloc(ElementObject* self)`
`653`	`653`	`{`
`654`	`654`	`PyObject_GC_UnTrack(self);`
	`655`	`+ Py_TRASHCAN_SAFE_BEGIN(self)`
`655`	`656`
`656`	`657`	`if (self->weakreflist != NULL)`
`657`	`658`	`PyObject_ClearWeakRefs((PyObject *) self);`
`@@ -662,6 +663,7 @@ element_dealloc(ElementObject* self)`
`662`	`663`
`663`	`664`	`RELEASE(sizeof(ElementObject), "destroy element");`
`664`	`665`	`Py_TYPE(self)->tp_free((PyObject *)self);`
	`666`	`+ Py_TRASHCAN_SAFE_END(self)`
`665`	`667`	`}`
`666`	`668`
`667`	`669`	`/* -------------------------------------------------------------------- */`