#2016 Fix a crash in function call when the **kwargs dictionary is mutated

during the function call setup.

This even gives a slight speedup, probably because tuple allocation
is faster than PyMem_NEW.

3 files changed, 32 insertions, 10 deletions

diff --git a/Lib/test/test_extcall.py b/Lib/test/test_extcall.py
index f4ab204279..a10887e163 100644
--- a/Lib/test/test_extcall.py
+++ b/Lib/test/test_extcall.py
@@ -251,6 +251,24 @@ TypeError if te dictionary is not empty
       ...
     TypeError: id() takes no keyword arguments
 
+A corner case of keyword dictionary items being deleted during
+the function call setup. See <http://bugs.python.org/issue2016>.
+
+    >>> class Name(str):
+    ...     def __eq__(self, other):
+    ...         try:
+    ...              del x[self]
+    ...         except KeyError:
+    ...              pass
+    ...         return str.__eq__(self, other)
+    ...     def __hash__(self):
+    ...         return str.__hash__(self)
+
+    >>> x = {Name("a"):1, Name("b"):2}
+    >>> def f(a, b):
+    ...     print a,b
+    >>> f(**x)
+    1 2
 """
 
 import unittest
diff --git a/Misc/NEWS b/Misc/NEWS
index c9c9b55d95..571094ca88 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -12,6 +12,9 @@ What's New in Python 2.7 alpha 1
 Core and Builtins
 -----------------
 
+- Issue #2016: Fixed a crash in a corner case where the dictionary of keyword
+  arguments could be modified during the function call setup.
+
 - Removed the ipaddr module.
 
 - Issue #6329: Fixed iteration for memoryview objects (it was being blocked
diff --git a/Objects/funcobject.c b/Objects/funcobject.c
index 14484e5b3c..7774e6d1e5 100644
--- a/Objects/funcobject.c
+++ b/Objects/funcobject.c
@@ -489,13 +489,14 @@ function_call(PyObject *func, PyObject *arg, PyObject *kw)
 {
 	PyObject *result;
 	PyObject *argdefs;
+	PyObject *kwtuple = NULL;
 	PyObject **d, **k;
 	Py_ssize_t nk, nd;
 
 	argdefs = PyFunction_GET_DEFAULTS(func);
 	if (argdefs != NULL && PyTuple_Check(argdefs)) {
 		d = &PyTuple_GET_ITEM((PyTupleObject *)argdefs, 0);
-		nd = PyTuple_Size(argdefs);
+		nd = PyTuple_GET_SIZE(argdefs);
 	}
 	else {
 		d = NULL;
@@ -505,16 +506,17 @@ function_call(PyObject *func, PyObject *arg, PyObject *kw)
 	if (kw != NULL && PyDict_Check(kw)) {
 		Py_ssize_t pos, i;
 		nk = PyDict_Size(kw);
-		k = PyMem_NEW(PyObject *, 2*nk);
-		if (k == NULL) {
-			PyErr_NoMemory();
+		kwtuple = PyTuple_New(2*nk);
+		if (kwtuple == NULL)
 			return NULL;
-		}
+		k = &PyTuple_GET_ITEM(kwtuple, 0);
 		pos = i = 0;
-		while (PyDict_Next(kw, &pos, &k[i], &k[i+1]))
+		while (PyDict_Next(kw, &pos, &k[i], &k[i+1])) {
+			Py_INCREF(k[i]);
+			Py_INCREF(k[i+1]);
 			i += 2;
+		}
 		nk = i/2;
-		/* XXX This is broken if the caller deletes dict items! */
 	}
 	else {
 		k = NULL;
@@ -524,12 +526,11 @@ function_call(PyObject *func, PyObject *arg, PyObject *kw)
 	result = PyEval_EvalCodeEx(
 		(PyCodeObject *)PyFunction_GET_CODE(func),
 		PyFunction_GET_GLOBALS(func), (PyObject *)NULL,
-		&PyTuple_GET_ITEM(arg, 0), PyTuple_Size(arg),
+		&PyTuple_GET_ITEM(arg, 0), PyTuple_GET_SIZE(arg),
 		k, nk, d, nd,
 		PyFunction_GET_CLOSURE(func));
 
-	if (k != NULL)
-		PyMem_DEL(k);
+	Py_XDECREF(kwtuple);
 
 	return result;
 }