I really feel I should apologise for this one:

[mwh@pc150 build-debug]$ cat t.py
class SortKiller(object):
    def __init__(self, i):
        pass
    def __del__(self):
        del l[:]
 
l = range(10)
l.sort(key=SortKiller)
[mwh@pc150 build-debug]$ ./python t.py
Segmentation fault

This can be fixed by moving the "restoring the objects
of the list from the wrappers" code *before* the "put
saved_ob_item back in the list" code.

The second is less serious but probably more annoying
to fix:

[mwh@pc150 build-debug]$ cat u.py
def k(x): return 1/x
 
l = range(-2,2)
try:
   l.sort(key=k)
except ZeroDivisionError:
   pass
print l
[mwh@pc150 build-debug]$ ./python u.py
[<sortwrapper object at 0x40130410>, <sortwrapper
object at 0x401303c0>, 0, 1]
[6571 refs]

Logged In: YES 
user_id=80475

The second was easy to fix.  

The first is defying my attempts to fix it.  You're welcome
to take a crack at it.

Logged In: YES 
user_id=6656

I have a feeling that your fix for problem #2 has made
problem #1 harder to fix...

will have a look later, no time right now.

Logged In: YES 
user_id=6656

Here's a much less devious test case:

$ cat w.py
def k(x):
    del l[:]
    return x
 
l = range(10)
l.sort(key=k)
$ ./python w.py
Segmentation fault

i think doing the "hide ob_item" swizzle should be just
about the first thing list_sort does and undoing it should
be about the last.  Patch soon (I hope).

Logged In: YES 
user_id=6656

Boy is this stuff hard to get right!

See what you think of the attached patch.

Logged In: YES 
user_id=80475

On the code path leading to a dsu_fail, does PyMem_FREE()
ever get called?

Would there be some added protection value to INCREFing self
at the beginning and DECREFing it at the end?

Logged In: YES 
user_id=6656

> On the code path leading to a dsu_fail, does 
> PyMem_FREE() ever get called?

Good catch.  New patch attached.

> Would there be some added protection value to INCREFing self
> at the beginning and DECREFing it at the end?

Um, I don't think so, as the calling machinery holds a
reference to self (and all the other arguments) during the
call.  Or did you mean something else?

Logged In: YES 
user_id=80475

Looks good.
Please add your crashers to the test suite and check it all in.

Logged In: YES 
user_id=6656

OK, checked in as:

Objects/listobject.c revision 2.167
Lib/test/test_sort.py revision 1.9