1 /* List object implementation */
2 
3 #include "Python.h"
4 #include "pycore_abstract.h"      // _PyIndex_Check()
5 #include "pycore_interp.h"        // PyInterpreterState.list
6 #include "pycore_list.h"          // struct _Py_list_state
7 #include "pycore_object.h"        // _PyObject_GC_TRACK()
8 #include "pycore_tuple.h"         // _PyTuple_FromArray()
9 #include <stddef.h>
10 
11 /*[clinic input]
12 class list "PyListObject *" "&PyList_Type"
13 [clinic start generated code]*/
14 /*[clinic end generated code: output=da39a3ee5e6b4b0d input=f9b222678f9f71e0]*/
15 
16 #include "clinic/listobject.c.h"
17 
18 _Py_DECLARE_STR(list_err, "list index out of range");
19 
20 #if PyList_MAXFREELIST > 0
21 static struct _Py_list_state *
get_list_state(void)22 get_list_state(void)
23 {
24     PyInterpreterState *interp = _PyInterpreterState_GET();
25     return &interp->list;
26 }
27 #endif
28 
29 
30 /* Ensure ob_item has room for at least newsize elements, and set
31  * ob_size to newsize.  If newsize > ob_size on entry, the content
32  * of the new slots at exit is undefined heap trash; it's the caller's
33  * responsibility to overwrite them with sane values.
34  * The number of allocated elements may grow, shrink, or stay the same.
35  * Failure is impossible if newsize <= self.allocated on entry, although
36  * that partly relies on an assumption that the system realloc() never
37  * fails when passed a number of bytes <= the number of bytes last
38  * allocated (the C standard doesn't guarantee this, but it's hard to
39  * imagine a realloc implementation where it wouldn't be true).
40  * Note that self->ob_item may change, and even if newsize is less
41  * than ob_size on entry.
42  */
43 static int
list_resize(PyListObject * self,Py_ssize_t newsize)44 list_resize(PyListObject *self, Py_ssize_t newsize)
45 {
46     PyObject **items;
47     size_t new_allocated, num_allocated_bytes;
48     Py_ssize_t allocated = self->allocated;
49 
50     /* Bypass realloc() when a previous overallocation is large enough
51        to accommodate the newsize.  If the newsize falls lower than half
52        the allocated size, then proceed with the realloc() to shrink the list.
53     */
54     if (allocated >= newsize && newsize >= (allocated >> 1)) {
55         assert(self->ob_item != NULL || newsize == 0);
56         Py_SET_SIZE(self, newsize);
57         return 0;
58     }
59 
60     /* This over-allocates proportional to the list size, making room
61      * for additional growth.  The over-allocation is mild, but is
62      * enough to give linear-time amortized behavior over a long
63      * sequence of appends() in the presence of a poorly-performing
64      * system realloc().
65      * Add padding to make the allocated size multiple of 4.
66      * The growth pattern is:  0, 4, 8, 16, 24, 32, 40, 52, 64, 76, ...
67      * Note: new_allocated won't overflow because the largest possible value
68      *       is PY_SSIZE_T_MAX * (9 / 8) + 6 which always fits in a size_t.
69      */
70     new_allocated = ((size_t)newsize + (newsize >> 3) + 6) & ~(size_t)3;
71     /* Do not overallocate if the new size is closer to overallocated size
72      * than to the old size.
73      */
74     if (newsize - Py_SIZE(self) > (Py_ssize_t)(new_allocated - newsize))
75         new_allocated = ((size_t)newsize + 3) & ~(size_t)3;
76 
77     if (newsize == 0)
78         new_allocated = 0;
79     if (new_allocated <= (size_t)PY_SSIZE_T_MAX / sizeof(PyObject *)) {
80         num_allocated_bytes = new_allocated * sizeof(PyObject *);
81         items = (PyObject **)PyMem_Realloc(self->ob_item, num_allocated_bytes);
82     }
83     else {
84         // integer overflow
85         items = NULL;
86     }
87     if (items == NULL) {
88         PyErr_NoMemory();
89         return -1;
90     }
91     self->ob_item = items;
92     Py_SET_SIZE(self, newsize);
93     self->allocated = new_allocated;
94     return 0;
95 }
96 
97 static int
list_preallocate_exact(PyListObject * self,Py_ssize_t size)98 list_preallocate_exact(PyListObject *self, Py_ssize_t size)
99 {
100     assert(self->ob_item == NULL);
101     assert(size > 0);
102 
103     /* Since the Python memory allocator has granularity of 16 bytes on 64-bit
104      * platforms (8 on 32-bit), there is no benefit of allocating space for
105      * the odd number of items, and there is no drawback of rounding the
106      * allocated size up to the nearest even number.
107      */
108     size = (size + 1) & ~(size_t)1;
109     PyObject **items = PyMem_New(PyObject*, size);
110     if (items == NULL) {
111         PyErr_NoMemory();
112         return -1;
113     }
114     self->ob_item = items;
115     self->allocated = size;
116     return 0;
117 }
118 
119 void
_PyList_ClearFreeList(PyInterpreterState * interp)120 _PyList_ClearFreeList(PyInterpreterState *interp)
121 {
122 #if PyList_MAXFREELIST > 0
123     struct _Py_list_state *state = &interp->list;
124     while (state->numfree) {
125         PyListObject *op = state->free_list[--state->numfree];
126         assert(PyList_CheckExact(op));
127         PyObject_GC_Del(op);
128     }
129 #endif
130 }
131 
132 void
_PyList_Fini(PyInterpreterState * interp)133 _PyList_Fini(PyInterpreterState *interp)
134 {
135     _PyList_ClearFreeList(interp);
136 #if defined(Py_DEBUG) && PyList_MAXFREELIST > 0
137     struct _Py_list_state *state = &interp->list;
138     state->numfree = -1;
139 #endif
140 }
141 
142 /* Print summary info about the state of the optimized allocator */
143 void
_PyList_DebugMallocStats(FILE * out)144 _PyList_DebugMallocStats(FILE *out)
145 {
146 #if PyList_MAXFREELIST > 0
147     struct _Py_list_state *state = get_list_state();
148     _PyDebugAllocatorStats(out,
149                            "free PyListObject",
150                            state->numfree, sizeof(PyListObject));
151 #endif
152 }
153 
154 PyObject *
PyList_New(Py_ssize_t size)155 PyList_New(Py_ssize_t size)
156 {
157     PyListObject *op;
158 
159     if (size < 0) {
160         PyErr_BadInternalCall();
161         return NULL;
162     }
163 
164 #if PyList_MAXFREELIST > 0
165     struct _Py_list_state *state = get_list_state();
166 #ifdef Py_DEBUG
167     // PyList_New() must not be called after _PyList_Fini()
168     assert(state->numfree != -1);
169 #endif
170     if (PyList_MAXFREELIST && state->numfree) {
171         state->numfree--;
172         op = state->free_list[state->numfree];
173         OBJECT_STAT_INC(from_freelist);
174         _Py_NewReference((PyObject *)op);
175     }
176     else
177 #endif
178     {
179         op = PyObject_GC_New(PyListObject, &PyList_Type);
180         if (op == NULL) {
181             return NULL;
182         }
183     }
184     if (size <= 0) {
185         op->ob_item = NULL;
186     }
187     else {
188         op->ob_item = (PyObject **) PyMem_Calloc(size, sizeof(PyObject *));
189         if (op->ob_item == NULL) {
190             Py_DECREF(op);
191             return PyErr_NoMemory();
192         }
193     }
194     Py_SET_SIZE(op, size);
195     op->allocated = size;
196     _PyObject_GC_TRACK(op);
197     return (PyObject *) op;
198 }
199 
200 static PyObject *
list_new_prealloc(Py_ssize_t size)201 list_new_prealloc(Py_ssize_t size)
202 {
203     assert(size > 0);
204     PyListObject *op = (PyListObject *) PyList_New(0);
205     if (op == NULL) {
206         return NULL;
207     }
208     assert(op->ob_item == NULL);
209     op->ob_item = PyMem_New(PyObject *, size);
210     if (op->ob_item == NULL) {
211         Py_DECREF(op);
212         return PyErr_NoMemory();
213     }
214     op->allocated = size;
215     return (PyObject *) op;
216 }
217 
218 Py_ssize_t
PyList_Size(PyObject * op)219 PyList_Size(PyObject *op)
220 {
221     if (!PyList_Check(op)) {
222         PyErr_BadInternalCall();
223         return -1;
224     }
225     else
226         return Py_SIZE(op);
227 }
228 
229 static inline int
valid_index(Py_ssize_t i,Py_ssize_t limit)230 valid_index(Py_ssize_t i, Py_ssize_t limit)
231 {
232     /* The cast to size_t lets us use just a single comparison
233        to check whether i is in the range: 0 <= i < limit.
234 
235        See:  Section 14.2 "Bounds Checking" in the Agner Fog
236        optimization manual found at:
237        https://www.agner.org/optimize/optimizing_cpp.pdf
238     */
239     return (size_t) i < (size_t) limit;
240 }
241 
242 PyObject *
PyList_GetItem(PyObject * op,Py_ssize_t i)243 PyList_GetItem(PyObject *op, Py_ssize_t i)
244 {
245     if (!PyList_Check(op)) {
246         PyErr_BadInternalCall();
247         return NULL;
248     }
249     if (!valid_index(i, Py_SIZE(op))) {
250         _Py_DECLARE_STR(list_err, "list index out of range");
251         PyErr_SetObject(PyExc_IndexError, &_Py_STR(list_err));
252         return NULL;
253     }
254     return ((PyListObject *)op) -> ob_item[i];
255 }
256 
257 int
PyList_SetItem(PyObject * op,Py_ssize_t i,PyObject * newitem)258 PyList_SetItem(PyObject *op, Py_ssize_t i,
259                PyObject *newitem)
260 {
261     PyObject **p;
262     if (!PyList_Check(op)) {
263         Py_XDECREF(newitem);
264         PyErr_BadInternalCall();
265         return -1;
266     }
267     if (!valid_index(i, Py_SIZE(op))) {
268         Py_XDECREF(newitem);
269         PyErr_SetString(PyExc_IndexError,
270                         "list assignment index out of range");
271         return -1;
272     }
273     p = ((PyListObject *)op) -> ob_item + i;
274     Py_XSETREF(*p, newitem);
275     return 0;
276 }
277 
278 static int
ins1(PyListObject * self,Py_ssize_t where,PyObject * v)279 ins1(PyListObject *self, Py_ssize_t where, PyObject *v)
280 {
281     Py_ssize_t i, n = Py_SIZE(self);
282     PyObject **items;
283     if (v == NULL) {
284         PyErr_BadInternalCall();
285         return -1;
286     }
287 
288     assert((size_t)n + 1 < PY_SSIZE_T_MAX);
289     if (list_resize(self, n+1) < 0)
290         return -1;
291 
292     if (where < 0) {
293         where += n;
294         if (where < 0)
295             where = 0;
296     }
297     if (where > n)
298         where = n;
299     items = self->ob_item;
300     for (i = n; --i >= where; )
301         items[i+1] = items[i];
302     Py_INCREF(v);
303     items[where] = v;
304     return 0;
305 }
306 
307 int
PyList_Insert(PyObject * op,Py_ssize_t where,PyObject * newitem)308 PyList_Insert(PyObject *op, Py_ssize_t where, PyObject *newitem)
309 {
310     if (!PyList_Check(op)) {
311         PyErr_BadInternalCall();
312         return -1;
313     }
314     return ins1((PyListObject *)op, where, newitem);
315 }
316 
317 /* internal, used by _PyList_AppendTakeRef */
318 int
_PyList_AppendTakeRefListResize(PyListObject * self,PyObject * newitem)319 _PyList_AppendTakeRefListResize(PyListObject *self, PyObject *newitem)
320 {
321     Py_ssize_t len = PyList_GET_SIZE(self);
322     assert(self->allocated == -1 || self->allocated == len);
323     if (list_resize(self, len + 1) < 0) {
324         Py_DECREF(newitem);
325         return -1;
326     }
327     PyList_SET_ITEM(self, len, newitem);
328     return 0;
329 }
330 
331 int
PyList_Append(PyObject * op,PyObject * newitem)332 PyList_Append(PyObject *op, PyObject *newitem)
333 {
334     if (PyList_Check(op) && (newitem != NULL)) {
335         Py_INCREF(newitem);
336         return _PyList_AppendTakeRef((PyListObject *)op, newitem);
337     }
338     PyErr_BadInternalCall();
339     return -1;
340 }
341 
342 /* Methods */
343 
344 static void
list_dealloc(PyListObject * op)345 list_dealloc(PyListObject *op)
346 {
347     Py_ssize_t i;
348     PyObject_GC_UnTrack(op);
349     Py_TRASHCAN_BEGIN(op, list_dealloc)
350     if (op->ob_item != NULL) {
351         /* Do it backwards, for Christian Tismer.
352            There's a simple test case where somehow this reduces
353            thrashing when a *very* large list is created and
354            immediately deleted. */
355         i = Py_SIZE(op);
356         while (--i >= 0) {
357             Py_XDECREF(op->ob_item[i]);
358         }
359         PyMem_Free(op->ob_item);
360     }
361 #if PyList_MAXFREELIST > 0
362     struct _Py_list_state *state = get_list_state();
363 #ifdef Py_DEBUG
364     // list_dealloc() must not be called after _PyList_Fini()
365     assert(state->numfree != -1);
366 #endif
367     if (state->numfree < PyList_MAXFREELIST && PyList_CheckExact(op)) {
368         state->free_list[state->numfree++] = op;
369         OBJECT_STAT_INC(to_freelist);
370     }
371     else
372 #endif
373     {
374         Py_TYPE(op)->tp_free((PyObject *)op);
375     }
376     Py_TRASHCAN_END
377 }
378 
379 static PyObject *
list_repr(PyListObject * v)380 list_repr(PyListObject *v)
381 {
382     Py_ssize_t i;
383     PyObject *s;
384     _PyUnicodeWriter writer;
385 
386     if (Py_SIZE(v) == 0) {
387         return PyUnicode_FromString("[]");
388     }
389 
390     i = Py_ReprEnter((PyObject*)v);
391     if (i != 0) {
392         return i > 0 ? PyUnicode_FromString("[...]") : NULL;
393     }
394 
395     _PyUnicodeWriter_Init(&writer);
396     writer.overallocate = 1;
397     /* "[" + "1" + ", 2" * (len - 1) + "]" */
398     writer.min_length = 1 + 1 + (2 + 1) * (Py_SIZE(v) - 1) + 1;
399 
400     if (_PyUnicodeWriter_WriteChar(&writer, '[') < 0)
401         goto error;
402 
403     /* Do repr() on each element.  Note that this may mutate the list,
404        so must refetch the list size on each iteration. */
405     for (i = 0; i < Py_SIZE(v); ++i) {
406         if (i > 0) {
407             if (_PyUnicodeWriter_WriteASCIIString(&writer, ", ", 2) < 0)
408                 goto error;
409         }
410 
411         s = PyObject_Repr(v->ob_item[i]);
412         if (s == NULL)
413             goto error;
414 
415         if (_PyUnicodeWriter_WriteStr(&writer, s) < 0) {
416             Py_DECREF(s);
417             goto error;
418         }
419         Py_DECREF(s);
420     }
421 
422     writer.overallocate = 0;
423     if (_PyUnicodeWriter_WriteChar(&writer, ']') < 0)
424         goto error;
425 
426     Py_ReprLeave((PyObject *)v);
427     return _PyUnicodeWriter_Finish(&writer);
428 
429 error:
430     _PyUnicodeWriter_Dealloc(&writer);
431     Py_ReprLeave((PyObject *)v);
432     return NULL;
433 }
434 
435 static Py_ssize_t
list_length(PyListObject * a)436 list_length(PyListObject *a)
437 {
438     return Py_SIZE(a);
439 }
440 
441 static int
list_contains(PyListObject * a,PyObject * el)442 list_contains(PyListObject *a, PyObject *el)
443 {
444     PyObject *item;
445     Py_ssize_t i;
446     int cmp;
447 
448     for (i = 0, cmp = 0 ; cmp == 0 && i < Py_SIZE(a); ++i) {
449         item = PyList_GET_ITEM(a, i);
450         Py_INCREF(item);
451         cmp = PyObject_RichCompareBool(item, el, Py_EQ);
452         Py_DECREF(item);
453     }
454     return cmp;
455 }
456 
457 static PyObject *
list_item(PyListObject * a,Py_ssize_t i)458 list_item(PyListObject *a, Py_ssize_t i)
459 {
460     if (!valid_index(i, Py_SIZE(a))) {
461         PyErr_SetObject(PyExc_IndexError, &_Py_STR(list_err));
462         return NULL;
463     }
464     Py_INCREF(a->ob_item[i]);
465     return a->ob_item[i];
466 }
467 
468 static PyObject *
list_slice(PyListObject * a,Py_ssize_t ilow,Py_ssize_t ihigh)469 list_slice(PyListObject *a, Py_ssize_t ilow, Py_ssize_t ihigh)
470 {
471     PyListObject *np;
472     PyObject **src, **dest;
473     Py_ssize_t i, len;
474     len = ihigh - ilow;
475     if (len <= 0) {
476         return PyList_New(0);
477     }
478     np = (PyListObject *) list_new_prealloc(len);
479     if (np == NULL)
480         return NULL;
481 
482     src = a->ob_item + ilow;
483     dest = np->ob_item;
484     for (i = 0; i < len; i++) {
485         PyObject *v = src[i];
486         Py_INCREF(v);
487         dest[i] = v;
488     }
489     Py_SET_SIZE(np, len);
490     return (PyObject *)np;
491 }
492 
493 PyObject *
PyList_GetSlice(PyObject * a,Py_ssize_t ilow,Py_ssize_t ihigh)494 PyList_GetSlice(PyObject *a, Py_ssize_t ilow, Py_ssize_t ihigh)
495 {
496     if (!PyList_Check(a)) {
497         PyErr_BadInternalCall();
498         return NULL;
499     }
500     if (ilow < 0) {
501         ilow = 0;
502     }
503     else if (ilow > Py_SIZE(a)) {
504         ilow = Py_SIZE(a);
505     }
506     if (ihigh < ilow) {
507         ihigh = ilow;
508     }
509     else if (ihigh > Py_SIZE(a)) {
510         ihigh = Py_SIZE(a);
511     }
512     return list_slice((PyListObject *)a, ilow, ihigh);
513 }
514 
515 static PyObject *
list_concat(PyListObject * a,PyObject * bb)516 list_concat(PyListObject *a, PyObject *bb)
517 {
518     Py_ssize_t size;
519     Py_ssize_t i;
520     PyObject **src, **dest;
521     PyListObject *np;
522     if (!PyList_Check(bb)) {
523         PyErr_Format(PyExc_TypeError,
524                   "can only concatenate list (not \"%.200s\") to list",
525                   Py_TYPE(bb)->tp_name);
526         return NULL;
527     }
528 #define b ((PyListObject *)bb)
529     assert((size_t)Py_SIZE(a) + (size_t)Py_SIZE(b) < PY_SSIZE_T_MAX);
530     size = Py_SIZE(a) + Py_SIZE(b);
531     if (size == 0) {
532         return PyList_New(0);
533     }
534     np = (PyListObject *) list_new_prealloc(size);
535     if (np == NULL) {
536         return NULL;
537     }
538     src = a->ob_item;
539     dest = np->ob_item;
540     for (i = 0; i < Py_SIZE(a); i++) {
541         PyObject *v = src[i];
542         Py_INCREF(v);
543         dest[i] = v;
544     }
545     src = b->ob_item;
546     dest = np->ob_item + Py_SIZE(a);
547     for (i = 0; i < Py_SIZE(b); i++) {
548         PyObject *v = src[i];
549         Py_INCREF(v);
550         dest[i] = v;
551     }
552     Py_SET_SIZE(np, size);
553     return (PyObject *)np;
554 #undef b
555 }
556 
557 static PyObject *
list_repeat(PyListObject * a,Py_ssize_t n)558 list_repeat(PyListObject *a, Py_ssize_t n)
559 {
560     Py_ssize_t size;
561     PyListObject *np;
562     if (n < 0)
563         n = 0;
564     if (n > 0 && Py_SIZE(a) > PY_SSIZE_T_MAX / n)
565         return PyErr_NoMemory();
566     size = Py_SIZE(a) * n;
567     if (size == 0)
568         return PyList_New(0);
569     np = (PyListObject *) list_new_prealloc(size);
570     if (np == NULL)
571         return NULL;
572     PyObject **dest = np->ob_item;
573     PyObject **dest_end = dest + size;
574     if (Py_SIZE(a) == 1) {
575         PyObject *elem = a->ob_item[0];
576         Py_SET_REFCNT(elem, Py_REFCNT(elem) + n);
577 #ifdef Py_REF_DEBUG
578         _Py_RefTotal += n;
579 #endif
580         while (dest < dest_end) {
581             *dest++ = elem;
582         }
583     }
584     else {
585         PyObject **src = a->ob_item;
586         PyObject **src_end = src + Py_SIZE(a);
587         while (src < src_end) {
588             Py_SET_REFCNT(*src, Py_REFCNT(*src) + n);
589 #ifdef Py_REF_DEBUG
590             _Py_RefTotal += n;
591 #endif
592             *dest++ = *src++;
593         }
594         // Now src chases after dest in the same buffer
595         src = np->ob_item;
596         while (dest < dest_end) {
597             *dest++ = *src++;
598         }
599     }
600     Py_SET_SIZE(np, size);
601     return (PyObject *) np;
602 }
603 
604 static int
_list_clear(PyListObject * a)605 _list_clear(PyListObject *a)
606 {
607     Py_ssize_t i;
608     PyObject **item = a->ob_item;
609     if (item != NULL) {
610         /* Because XDECREF can recursively invoke operations on
611            this list, we make it empty first. */
612         i = Py_SIZE(a);
613         Py_SET_SIZE(a, 0);
614         a->ob_item = NULL;
615         a->allocated = 0;
616         while (--i >= 0) {
617             Py_XDECREF(item[i]);
618         }
619         PyMem_Free(item);
620     }
621     /* Never fails; the return value can be ignored.
622        Note that there is no guarantee that the list is actually empty
623        at this point, because XDECREF may have populated it again! */
624     return 0;
625 }
626 
627 /* a[ilow:ihigh] = v if v != NULL.
628  * del a[ilow:ihigh] if v == NULL.
629  *
630  * Special speed gimmick:  when v is NULL and ihigh - ilow <= 8, it's
631  * guaranteed the call cannot fail.
632  */
633 static int
list_ass_slice(PyListObject * a,Py_ssize_t ilow,Py_ssize_t ihigh,PyObject * v)634 list_ass_slice(PyListObject *a, Py_ssize_t ilow, Py_ssize_t ihigh, PyObject *v)
635 {
636     /* Because [X]DECREF can recursively invoke list operations on
637        this list, we must postpone all [X]DECREF activity until
638        after the list is back in its canonical shape.  Therefore
639        we must allocate an additional array, 'recycle', into which
640        we temporarily copy the items that are deleted from the
641        list. :-( */
642     PyObject *recycle_on_stack[8];
643     PyObject **recycle = recycle_on_stack; /* will allocate more if needed */
644     PyObject **item;
645     PyObject **vitem = NULL;
646     PyObject *v_as_SF = NULL; /* PySequence_Fast(v) */
647     Py_ssize_t n; /* # of elements in replacement list */
648     Py_ssize_t norig; /* # of elements in list getting replaced */
649     Py_ssize_t d; /* Change in size */
650     Py_ssize_t k;
651     size_t s;
652     int result = -1;            /* guilty until proved innocent */
653 #define b ((PyListObject *)v)
654     if (v == NULL)
655         n = 0;
656     else {
657         if (a == b) {
658             /* Special case "a[i:j] = a" -- copy b first */
659             v = list_slice(b, 0, Py_SIZE(b));
660             if (v == NULL)
661                 return result;
662             result = list_ass_slice(a, ilow, ihigh, v);
663             Py_DECREF(v);
664             return result;
665         }
666         v_as_SF = PySequence_Fast(v, "can only assign an iterable");
667         if(v_as_SF == NULL)
668             goto Error;
669         n = PySequence_Fast_GET_SIZE(v_as_SF);
670         vitem = PySequence_Fast_ITEMS(v_as_SF);
671     }
672     if (ilow < 0)
673         ilow = 0;
674     else if (ilow > Py_SIZE(a))
675         ilow = Py_SIZE(a);
676 
677     if (ihigh < ilow)
678         ihigh = ilow;
679     else if (ihigh > Py_SIZE(a))
680         ihigh = Py_SIZE(a);
681 
682     norig = ihigh - ilow;
683     assert(norig >= 0);
684     d = n - norig;
685     if (Py_SIZE(a) + d == 0) {
686         Py_XDECREF(v_as_SF);
687         return _list_clear(a);
688     }
689     item = a->ob_item;
690     /* recycle the items that we are about to remove */
691     s = norig * sizeof(PyObject *);
692     /* If norig == 0, item might be NULL, in which case we may not memcpy from it. */
693     if (s) {
694         if (s > sizeof(recycle_on_stack)) {
695             recycle = (PyObject **)PyMem_Malloc(s);
696             if (recycle == NULL) {
697                 PyErr_NoMemory();
698                 goto Error;
699             }
700         }
701         memcpy(recycle, &item[ilow], s);
702     }
703 
704     if (d < 0) { /* Delete -d items */
705         Py_ssize_t tail;
706         tail = (Py_SIZE(a) - ihigh) * sizeof(PyObject *);
707         memmove(&item[ihigh+d], &item[ihigh], tail);
708         if (list_resize(a, Py_SIZE(a) + d) < 0) {
709             memmove(&item[ihigh], &item[ihigh+d], tail);
710             memcpy(&item[ilow], recycle, s);
711             goto Error;
712         }
713         item = a->ob_item;
714     }
715     else if (d > 0) { /* Insert d items */
716         k = Py_SIZE(a);
717         if (list_resize(a, k+d) < 0)
718             goto Error;
719         item = a->ob_item;
720         memmove(&item[ihigh+d], &item[ihigh],
721             (k - ihigh)*sizeof(PyObject *));
722     }
723     for (k = 0; k < n; k++, ilow++) {
724         PyObject *w = vitem[k];
725         Py_XINCREF(w);
726         item[ilow] = w;
727     }
728     for (k = norig - 1; k >= 0; --k)
729         Py_XDECREF(recycle[k]);
730     result = 0;
731  Error:
732     if (recycle != recycle_on_stack)
733         PyMem_Free(recycle);
734     Py_XDECREF(v_as_SF);
735     return result;
736 #undef b
737 }
738 
739 int
PyList_SetSlice(PyObject * a,Py_ssize_t ilow,Py_ssize_t ihigh,PyObject * v)740 PyList_SetSlice(PyObject *a, Py_ssize_t ilow, Py_ssize_t ihigh, PyObject *v)
741 {
742     if (!PyList_Check(a)) {
743         PyErr_BadInternalCall();
744         return -1;
745     }
746     return list_ass_slice((PyListObject *)a, ilow, ihigh, v);
747 }
748 
749 static PyObject *
list_inplace_repeat(PyListObject * self,Py_ssize_t n)750 list_inplace_repeat(PyListObject *self, Py_ssize_t n)
751 {
752     PyObject **items;
753     Py_ssize_t size, i, j, p;
754 
755 
756     size = PyList_GET_SIZE(self);
757     if (size == 0 || n == 1) {
758         Py_INCREF(self);
759         return (PyObject *)self;
760     }
761 
762     if (n < 1) {
763         (void)_list_clear(self);
764         Py_INCREF(self);
765         return (PyObject *)self;
766     }
767 
768     if (size > PY_SSIZE_T_MAX / n) {
769         return PyErr_NoMemory();
770     }
771 
772     if (list_resize(self, size*n) < 0)
773         return NULL;
774 
775     p = size;
776     items = self->ob_item;
777     for (i = 1; i < n; i++) { /* Start counting at 1, not 0 */
778         for (j = 0; j < size; j++) {
779             PyObject *o = items[j];
780             Py_INCREF(o);
781             items[p++] = o;
782         }
783     }
784     Py_INCREF(self);
785     return (PyObject *)self;
786 }
787 
788 static int
list_ass_item(PyListObject * a,Py_ssize_t i,PyObject * v)789 list_ass_item(PyListObject *a, Py_ssize_t i, PyObject *v)
790 {
791     if (!valid_index(i, Py_SIZE(a))) {
792         PyErr_SetString(PyExc_IndexError,
793                         "list assignment index out of range");
794         return -1;
795     }
796     if (v == NULL)
797         return list_ass_slice(a, i, i+1, v);
798     Py_INCREF(v);
799     Py_SETREF(a->ob_item[i], v);
800     return 0;
801 }
802 
803 /*[clinic input]
804 list.insert
805 
806     index: Py_ssize_t
807     object: object
808     /
809 
810 Insert object before index.
811 [clinic start generated code]*/
812 
813 static PyObject *
list_insert_impl(PyListObject * self,Py_ssize_t index,PyObject * object)814 list_insert_impl(PyListObject *self, Py_ssize_t index, PyObject *object)
815 /*[clinic end generated code: output=7f35e32f60c8cb78 input=858514cf894c7eab]*/
816 {
817     if (ins1(self, index, object) == 0)
818         Py_RETURN_NONE;
819     return NULL;
820 }
821 
822 /*[clinic input]
823 list.clear
824 
825 Remove all items from list.
826 [clinic start generated code]*/
827 
828 static PyObject *
list_clear_impl(PyListObject * self)829 list_clear_impl(PyListObject *self)
830 /*[clinic end generated code: output=67a1896c01f74362 input=ca3c1646856742f6]*/
831 {
832     _list_clear(self);
833     Py_RETURN_NONE;
834 }
835 
836 /*[clinic input]
837 list.copy
838 
839 Return a shallow copy of the list.
840 [clinic start generated code]*/
841 
842 static PyObject *
list_copy_impl(PyListObject * self)843 list_copy_impl(PyListObject *self)
844 /*[clinic end generated code: output=ec6b72d6209d418e input=6453ab159e84771f]*/
845 {
846     return list_slice(self, 0, Py_SIZE(self));
847 }
848 
849 /*[clinic input]
850 list.append
851 
852      object: object
853      /
854 
855 Append object to the end of the list.
856 [clinic start generated code]*/
857 
858 static PyObject *
list_append(PyListObject * self,PyObject * object)859 list_append(PyListObject *self, PyObject *object)
860 /*[clinic end generated code: output=7c096003a29c0eae input=43a3fe48a7066e91]*/
861 {
862     if (_PyList_AppendTakeRef(self, Py_NewRef(object)) < 0) {
863         return NULL;
864     }
865     Py_RETURN_NONE;
866 }
867 
868 /*[clinic input]
869 list.extend
870 
871      iterable: object
872      /
873 
874 Extend list by appending elements from the iterable.
875 [clinic start generated code]*/
876 
877 static PyObject *
list_extend(PyListObject * self,PyObject * iterable)878 list_extend(PyListObject *self, PyObject *iterable)
879 /*[clinic end generated code: output=630fb3bca0c8e789 input=9ec5ba3a81be3a4d]*/
880 {
881     PyObject *it;      /* iter(v) */
882     Py_ssize_t m;                  /* size of self */
883     Py_ssize_t n;                  /* guess for size of iterable */
884     Py_ssize_t i;
885     PyObject *(*iternext)(PyObject *);
886 
887     /* Special cases:
888        1) lists and tuples which can use PySequence_Fast ops
889        2) extending self to self requires making a copy first
890     */
891     if (PyList_CheckExact(iterable) || PyTuple_CheckExact(iterable) ||
892                 (PyObject *)self == iterable) {
893         PyObject **src, **dest;
894         iterable = PySequence_Fast(iterable, "argument must be iterable");
895         if (!iterable)
896             return NULL;
897         n = PySequence_Fast_GET_SIZE(iterable);
898         if (n == 0) {
899             /* short circuit when iterable is empty */
900             Py_DECREF(iterable);
901             Py_RETURN_NONE;
902         }
903         m = Py_SIZE(self);
904         /* It should not be possible to allocate a list large enough to cause
905         an overflow on any relevant platform */
906         assert(m < PY_SSIZE_T_MAX - n);
907         if (self->ob_item == NULL) {
908             if (list_preallocate_exact(self, n) < 0) {
909                 return NULL;
910             }
911             Py_SET_SIZE(self, n);
912         }
913         else if (list_resize(self, m + n) < 0) {
914             Py_DECREF(iterable);
915             return NULL;
916         }
917         /* note that we may still have self == iterable here for the
918          * situation a.extend(a), but the following code works
919          * in that case too.  Just make sure to resize self
920          * before calling PySequence_Fast_ITEMS.
921          */
922         /* populate the end of self with iterable's items */
923         src = PySequence_Fast_ITEMS(iterable);
924         dest = self->ob_item + m;
925         for (i = 0; i < n; i++) {
926             PyObject *o = src[i];
927             Py_INCREF(o);
928             dest[i] = o;
929         }
930         Py_DECREF(iterable);
931         Py_RETURN_NONE;
932     }
933 
934     it = PyObject_GetIter(iterable);
935     if (it == NULL)
936         return NULL;
937     iternext = *Py_TYPE(it)->tp_iternext;
938 
939     /* Guess a result list size. */
940     n = PyObject_LengthHint(iterable, 8);
941     if (n < 0) {
942         Py_DECREF(it);
943         return NULL;
944     }
945     m = Py_SIZE(self);
946     if (m > PY_SSIZE_T_MAX - n) {
947         /* m + n overflowed; on the chance that n lied, and there really
948          * is enough room, ignore it.  If n was telling the truth, we'll
949          * eventually run out of memory during the loop.
950          */
951     }
952     else if (self->ob_item == NULL) {
953         if (n && list_preallocate_exact(self, n) < 0)
954             goto error;
955     }
956     else {
957         /* Make room. */
958         if (list_resize(self, m + n) < 0)
959             goto error;
960         /* Make the list sane again. */
961         Py_SET_SIZE(self, m);
962     }
963 
964     /* Run iterator to exhaustion. */
965     for (;;) {
966         PyObject *item = iternext(it);
967         if (item == NULL) {
968             if (PyErr_Occurred()) {
969                 if (PyErr_ExceptionMatches(PyExc_StopIteration))
970                     PyErr_Clear();
971                 else
972                     goto error;
973             }
974             break;
975         }
976         if (Py_SIZE(self) < self->allocated) {
977             /* steals ref */
978             PyList_SET_ITEM(self, Py_SIZE(self), item);
979             Py_SET_SIZE(self, Py_SIZE(self) + 1);
980         }
981         else {
982             if (_PyList_AppendTakeRef(self, item) < 0)
983                 goto error;
984         }
985     }
986 
987     /* Cut back result list if initial guess was too large. */
988     if (Py_SIZE(self) < self->allocated) {
989         if (list_resize(self, Py_SIZE(self)) < 0)
990             goto error;
991     }
992 
993     Py_DECREF(it);
994     Py_RETURN_NONE;
995 
996   error:
997     Py_DECREF(it);
998     return NULL;
999 }
1000 
1001 PyObject *
_PyList_Extend(PyListObject * self,PyObject * iterable)1002 _PyList_Extend(PyListObject *self, PyObject *iterable)
1003 {
1004     return list_extend(self, iterable);
1005 }
1006 
1007 static PyObject *
list_inplace_concat(PyListObject * self,PyObject * other)1008 list_inplace_concat(PyListObject *self, PyObject *other)
1009 {
1010     PyObject *result;
1011 
1012     result = list_extend(self, other);
1013     if (result == NULL)
1014         return result;
1015     Py_DECREF(result);
1016     Py_INCREF(self);
1017     return (PyObject *)self;
1018 }
1019 
1020 /*[clinic input]
1021 list.pop
1022 
1023     index: Py_ssize_t = -1
1024     /
1025 
1026 Remove and return item at index (default last).
1027 
1028 Raises IndexError if list is empty or index is out of range.
1029 [clinic start generated code]*/
1030 
1031 static PyObject *
list_pop_impl(PyListObject * self,Py_ssize_t index)1032 list_pop_impl(PyListObject *self, Py_ssize_t index)
1033 /*[clinic end generated code: output=6bd69dcb3f17eca8 input=b83675976f329e6f]*/
1034 {
1035     PyObject *v;
1036     int status;
1037 
1038     if (Py_SIZE(self) == 0) {
1039         /* Special-case most common failure cause */
1040         PyErr_SetString(PyExc_IndexError, "pop from empty list");
1041         return NULL;
1042     }
1043     if (index < 0)
1044         index += Py_SIZE(self);
1045     if (!valid_index(index, Py_SIZE(self))) {
1046         PyErr_SetString(PyExc_IndexError, "pop index out of range");
1047         return NULL;
1048     }
1049     v = self->ob_item[index];
1050     if (index == Py_SIZE(self) - 1) {
1051         status = list_resize(self, Py_SIZE(self) - 1);
1052         if (status >= 0)
1053             return v; /* and v now owns the reference the list had */
1054         else
1055             return NULL;
1056     }
1057     Py_INCREF(v);
1058     status = list_ass_slice(self, index, index+1, (PyObject *)NULL);
1059     if (status < 0) {
1060         Py_DECREF(v);
1061         return NULL;
1062     }
1063     return v;
1064 }
1065 
1066 /* Reverse a slice of a list in place, from lo up to (exclusive) hi. */
1067 static void
reverse_slice(PyObject ** lo,PyObject ** hi)1068 reverse_slice(PyObject **lo, PyObject **hi)
1069 {
1070     assert(lo && hi);
1071 
1072     --hi;
1073     while (lo < hi) {
1074         PyObject *t = *lo;
1075         *lo = *hi;
1076         *hi = t;
1077         ++lo;
1078         --hi;
1079     }
1080 }
1081 
1082 /* Lots of code for an adaptive, stable, natural mergesort.  There are many
1083  * pieces to this algorithm; read listsort.txt for overviews and details.
1084  */
1085 
1086 /* A sortslice contains a pointer to an array of keys and a pointer to
1087  * an array of corresponding values.  In other words, keys[i]
1088  * corresponds with values[i].  If values == NULL, then the keys are
1089  * also the values.
1090  *
1091  * Several convenience routines are provided here, so that keys and
1092  * values are always moved in sync.
1093  */
1094 
1095 typedef struct {
1096     PyObject **keys;
1097     PyObject **values;
1098 } sortslice;
1099 
1100 Py_LOCAL_INLINE(void)
sortslice_copy(sortslice * s1,Py_ssize_t i,sortslice * s2,Py_ssize_t j)1101 sortslice_copy(sortslice *s1, Py_ssize_t i, sortslice *s2, Py_ssize_t j)
1102 {
1103     s1->keys[i] = s2->keys[j];
1104     if (s1->values != NULL)
1105         s1->values[i] = s2->values[j];
1106 }
1107 
1108 Py_LOCAL_INLINE(void)
sortslice_copy_incr(sortslice * dst,sortslice * src)1109 sortslice_copy_incr(sortslice *dst, sortslice *src)
1110 {
1111     *dst->keys++ = *src->keys++;
1112     if (dst->values != NULL)
1113         *dst->values++ = *src->values++;
1114 }
1115 
1116 Py_LOCAL_INLINE(void)
sortslice_copy_decr(sortslice * dst,sortslice * src)1117 sortslice_copy_decr(sortslice *dst, sortslice *src)
1118 {
1119     *dst->keys-- = *src->keys--;
1120     if (dst->values != NULL)
1121         *dst->values-- = *src->values--;
1122 }
1123 
1124 
1125 Py_LOCAL_INLINE(void)
sortslice_memcpy(sortslice * s1,Py_ssize_t i,sortslice * s2,Py_ssize_t j,Py_ssize_t n)1126 sortslice_memcpy(sortslice *s1, Py_ssize_t i, sortslice *s2, Py_ssize_t j,
1127                  Py_ssize_t n)
1128 {
1129     memcpy(&s1->keys[i], &s2->keys[j], sizeof(PyObject *) * n);
1130     if (s1->values != NULL)
1131         memcpy(&s1->values[i], &s2->values[j], sizeof(PyObject *) * n);
1132 }
1133 
1134 Py_LOCAL_INLINE(void)
sortslice_memmove(sortslice * s1,Py_ssize_t i,sortslice * s2,Py_ssize_t j,Py_ssize_t n)1135 sortslice_memmove(sortslice *s1, Py_ssize_t i, sortslice *s2, Py_ssize_t j,
1136                   Py_ssize_t n)
1137 {
1138     memmove(&s1->keys[i], &s2->keys[j], sizeof(PyObject *) * n);
1139     if (s1->values != NULL)
1140         memmove(&s1->values[i], &s2->values[j], sizeof(PyObject *) * n);
1141 }
1142 
1143 Py_LOCAL_INLINE(void)
sortslice_advance(sortslice * slice,Py_ssize_t n)1144 sortslice_advance(sortslice *slice, Py_ssize_t n)
1145 {
1146     slice->keys += n;
1147     if (slice->values != NULL)
1148         slice->values += n;
1149 }
1150 
1151 /* Comparison function: ms->key_compare, which is set at run-time in
1152  * listsort_impl to optimize for various special cases.
1153  * Returns -1 on error, 1 if x < y, 0 if x >= y.
1154  */
1155 
1156 #define ISLT(X, Y) (*(ms->key_compare))(X, Y, ms)
1157 
1158 /* Compare X to Y via "<".  Goto "fail" if the comparison raises an
1159    error.  Else "k" is set to true iff X<Y, and an "if (k)" block is
1160    started.  It makes more sense in context <wink>.  X and Y are PyObject*s.
1161 */
1162 #define IFLT(X, Y) if ((k = ISLT(X, Y)) < 0) goto fail;  \
1163            if (k)
1164 
1165 /* The maximum number of entries in a MergeState's pending-runs stack.
1166  * For a list with n elements, this needs at most floor(log2(n)) + 1 entries
1167  * even if we didn't force runs to a minimal length.  So the number of bits
1168  * in a Py_ssize_t is plenty large enough for all cases.
1169  */
1170 #define MAX_MERGE_PENDING (SIZEOF_SIZE_T * 8)
1171 
1172 /* When we get into galloping mode, we stay there until both runs win less
1173  * often than MIN_GALLOP consecutive times.  See listsort.txt for more info.
1174  */
1175 #define MIN_GALLOP 7
1176 
1177 /* Avoid malloc for small temp arrays. */
1178 #define MERGESTATE_TEMP_SIZE 256
1179 
1180 /* One MergeState exists on the stack per invocation of mergesort.  It's just
1181  * a convenient way to pass state around among the helper functions.
1182  */
1183 struct s_slice {
1184     sortslice base;
1185     Py_ssize_t len;   /* length of run */
1186     int power; /* node "level" for powersort merge strategy */
1187 };
1188 
1189 typedef struct s_MergeState MergeState;
1190 struct s_MergeState {
1191     /* This controls when we get *into* galloping mode.  It's initialized
1192      * to MIN_GALLOP.  merge_lo and merge_hi tend to nudge it higher for
1193      * random data, and lower for highly structured data.
1194      */
1195     Py_ssize_t min_gallop;
1196 
1197     Py_ssize_t listlen;     /* len(input_list) - read only */
1198     PyObject **basekeys;    /* base address of keys array - read only */
1199 
1200     /* 'a' is temp storage to help with merges.  It contains room for
1201      * alloced entries.
1202      */
1203     sortslice a;        /* may point to temparray below */
1204     Py_ssize_t alloced;
1205 
1206     /* A stack of n pending runs yet to be merged.  Run #i starts at
1207      * address base[i] and extends for len[i] elements.  It's always
1208      * true (so long as the indices are in bounds) that
1209      *
1210      *     pending[i].base + pending[i].len == pending[i+1].base
1211      *
1212      * so we could cut the storage for this, but it's a minor amount,
1213      * and keeping all the info explicit simplifies the code.
1214      */
1215     int n;
1216     struct s_slice pending[MAX_MERGE_PENDING];
1217 
1218     /* 'a' points to this when possible, rather than muck with malloc. */
1219     PyObject *temparray[MERGESTATE_TEMP_SIZE];
1220 
1221     /* This is the function we will use to compare two keys,
1222      * even when none of our special cases apply and we have to use
1223      * safe_object_compare. */
1224     int (*key_compare)(PyObject *, PyObject *, MergeState *);
1225 
1226     /* This function is used by unsafe_object_compare to optimize comparisons
1227      * when we know our list is type-homogeneous but we can't assume anything else.
1228      * In the pre-sort check it is set equal to Py_TYPE(key)->tp_richcompare */
1229     PyObject *(*key_richcompare)(PyObject *, PyObject *, int);
1230 
1231     /* This function is used by unsafe_tuple_compare to compare the first elements
1232      * of tuples. It may be set to safe_object_compare, but the idea is that hopefully
1233      * we can assume more, and use one of the special-case compares. */
1234     int (*tuple_elem_compare)(PyObject *, PyObject *, MergeState *);
1235 };
1236 
1237 /* binarysort is the best method for sorting small arrays: it does
1238    few compares, but can do data movement quadratic in the number of
1239    elements.
1240    [lo, hi) is a contiguous slice of a list, and is sorted via
1241    binary insertion.  This sort is stable.
1242    On entry, must have lo <= start <= hi, and that [lo, start) is already
1243    sorted (pass start == lo if you don't know!).
1244    If islt() complains return -1, else 0.
1245    Even in case of error, the output slice will be some permutation of
1246    the input (nothing is lost or duplicated).
1247 */
1248 static int
binarysort(MergeState * ms,sortslice lo,PyObject ** hi,PyObject ** start)1249 binarysort(MergeState *ms, sortslice lo, PyObject **hi, PyObject **start)
1250 {
1251     Py_ssize_t k;
1252     PyObject **l, **p, **r;
1253     PyObject *pivot;
1254 
1255     assert(lo.keys <= start && start <= hi);
1256     /* assert [lo, start) is sorted */
1257     if (lo.keys == start)
1258         ++start;
1259     for (; start < hi; ++start) {
1260         /* set l to where *start belongs */
1261         l = lo.keys;
1262         r = start;
1263         pivot = *r;
1264         /* Invariants:
1265          * pivot >= all in [lo, l).
1266          * pivot  < all in [r, start).
1267          * The second is vacuously true at the start.
1268          */
1269         assert(l < r);
1270         do {
1271             p = l + ((r - l) >> 1);
1272             IFLT(pivot, *p)
1273                 r = p;
1274             else
1275                 l = p+1;
1276         } while (l < r);
1277         assert(l == r);
1278         /* The invariants still hold, so pivot >= all in [lo, l) and
1279            pivot < all in [l, start), so pivot belongs at l.  Note
1280            that if there are elements equal to pivot, l points to the
1281            first slot after them -- that's why this sort is stable.
1282            Slide over to make room.
1283            Caution: using memmove is much slower under MSVC 5;
1284            we're not usually moving many slots. */
1285         for (p = start; p > l; --p)
1286             *p = *(p-1);
1287         *l = pivot;
1288         if (lo.values != NULL) {
1289             Py_ssize_t offset = lo.values - lo.keys;
1290             p = start + offset;
1291             pivot = *p;
1292             l += offset;
1293             for (p = start + offset; p > l; --p)
1294                 *p = *(p-1);
1295             *l = pivot;
1296         }
1297     }
1298     return 0;
1299 
1300  fail:
1301     return -1;
1302 }
1303 
1304 /*
1305 Return the length of the run beginning at lo, in the slice [lo, hi).  lo < hi
1306 is required on entry.  "A run" is the longest ascending sequence, with
1307 
1308     lo[0] <= lo[1] <= lo[2] <= ...
1309 
1310 or the longest descending sequence, with
1311 
1312     lo[0] > lo[1] > lo[2] > ...
1313 
1314 Boolean *descending is set to 0 in the former case, or to 1 in the latter.
1315 For its intended use in a stable mergesort, the strictness of the defn of
1316 "descending" is needed so that the caller can safely reverse a descending
1317 sequence without violating stability (strict > ensures there are no equal
1318 elements to get out of order).
1319 
1320 Returns -1 in case of error.
1321 */
1322 static Py_ssize_t
count_run(MergeState * ms,PyObject ** lo,PyObject ** hi,int * descending)1323 count_run(MergeState *ms, PyObject **lo, PyObject **hi, int *descending)
1324 {
1325     Py_ssize_t k;
1326     Py_ssize_t n;
1327 
1328     assert(lo < hi);
1329     *descending = 0;
1330     ++lo;
1331     if (lo == hi)
1332         return 1;
1333 
1334     n = 2;
1335     IFLT(*lo, *(lo-1)) {
1336         *descending = 1;
1337         for (lo = lo+1; lo < hi; ++lo, ++n) {
1338             IFLT(*lo, *(lo-1))
1339                 ;
1340             else
1341                 break;
1342         }
1343     }
1344     else {
1345         for (lo = lo+1; lo < hi; ++lo, ++n) {
1346             IFLT(*lo, *(lo-1))
1347                 break;
1348         }
1349     }
1350 
1351     return n;
1352 fail:
1353     return -1;
1354 }
1355 
1356 /*
1357 Locate the proper position of key in a sorted vector; if the vector contains
1358 an element equal to key, return the position immediately to the left of
1359 the leftmost equal element.  [gallop_right() does the same except returns
1360 the position to the right of the rightmost equal element (if any).]
1361 
1362 "a" is a sorted vector with n elements, starting at a[0].  n must be > 0.
1363 
1364 "hint" is an index at which to begin the search, 0 <= hint < n.  The closer
1365 hint is to the final result, the faster this runs.
1366 
1367 The return value is the int k in 0..n such that
1368 
1369     a[k-1] < key <= a[k]
1370 
1371 pretending that *(a-1) is minus infinity and a[n] is plus infinity.  IOW,
1372 key belongs at index k; or, IOW, the first k elements of a should precede
1373 key, and the last n-k should follow key.
1374 
1375 Returns -1 on error.  See listsort.txt for info on the method.
1376 */
1377 static Py_ssize_t
gallop_left(MergeState * ms,PyObject * key,PyObject ** a,Py_ssize_t n,Py_ssize_t hint)1378 gallop_left(MergeState *ms, PyObject *key, PyObject **a, Py_ssize_t n, Py_ssize_t hint)
1379 {
1380     Py_ssize_t ofs;
1381     Py_ssize_t lastofs;
1382     Py_ssize_t k;
1383 
1384     assert(key && a && n > 0 && hint >= 0 && hint < n);
1385 
1386     a += hint;
1387     lastofs = 0;
1388     ofs = 1;
1389     IFLT(*a, key) {
1390         /* a[hint] < key -- gallop right, until
1391          * a[hint + lastofs] < key <= a[hint + ofs]
1392          */
1393         const Py_ssize_t maxofs = n - hint;             /* &a[n-1] is highest */
1394         while (ofs < maxofs) {
1395             IFLT(a[ofs], key) {
1396                 lastofs = ofs;
1397                 assert(ofs <= (PY_SSIZE_T_MAX - 1) / 2);
1398                 ofs = (ofs << 1) + 1;
1399             }
1400             else                /* key <= a[hint + ofs] */
1401                 break;
1402         }
1403         if (ofs > maxofs)
1404             ofs = maxofs;
1405         /* Translate back to offsets relative to &a[0]. */
1406         lastofs += hint;
1407         ofs += hint;
1408     }
1409     else {
1410         /* key <= a[hint] -- gallop left, until
1411          * a[hint - ofs] < key <= a[hint - lastofs]
1412          */
1413         const Py_ssize_t maxofs = hint + 1;             /* &a[0] is lowest */
1414         while (ofs < maxofs) {
1415             IFLT(*(a-ofs), key)
1416                 break;
1417             /* key <= a[hint - ofs] */
1418             lastofs = ofs;
1419             assert(ofs <= (PY_SSIZE_T_MAX - 1) / 2);
1420             ofs = (ofs << 1) + 1;
1421         }
1422         if (ofs > maxofs)
1423             ofs = maxofs;
1424         /* Translate back to positive offsets relative to &a[0]. */
1425         k = lastofs;
1426         lastofs = hint - ofs;
1427         ofs = hint - k;
1428     }
1429     a -= hint;
1430 
1431     assert(-1 <= lastofs && lastofs < ofs && ofs <= n);
1432     /* Now a[lastofs] < key <= a[ofs], so key belongs somewhere to the
1433      * right of lastofs but no farther right than ofs.  Do a binary
1434      * search, with invariant a[lastofs-1] < key <= a[ofs].
1435      */
1436     ++lastofs;
1437     while (lastofs < ofs) {
1438         Py_ssize_t m = lastofs + ((ofs - lastofs) >> 1);
1439 
1440         IFLT(a[m], key)
1441             lastofs = m+1;              /* a[m] < key */
1442         else
1443             ofs = m;                    /* key <= a[m] */
1444     }
1445     assert(lastofs == ofs);             /* so a[ofs-1] < key <= a[ofs] */
1446     return ofs;
1447 
1448 fail:
1449     return -1;
1450 }
1451 
1452 /*
1453 Exactly like gallop_left(), except that if key already exists in a[0:n],
1454 finds the position immediately to the right of the rightmost equal value.
1455 
1456 The return value is the int k in 0..n such that
1457 
1458     a[k-1] <= key < a[k]
1459 
1460 or -1 if error.
1461 
1462 The code duplication is massive, but this is enough different given that
1463 we're sticking to "<" comparisons that it's much harder to follow if
1464 written as one routine with yet another "left or right?" flag.
1465 */
1466 static Py_ssize_t
gallop_right(MergeState * ms,PyObject * key,PyObject ** a,Py_ssize_t n,Py_ssize_t hint)1467 gallop_right(MergeState *ms, PyObject *key, PyObject **a, Py_ssize_t n, Py_ssize_t hint)
1468 {
1469     Py_ssize_t ofs;
1470     Py_ssize_t lastofs;
1471     Py_ssize_t k;
1472 
1473     assert(key && a && n > 0 && hint >= 0 && hint < n);
1474 
1475     a += hint;
1476     lastofs = 0;
1477     ofs = 1;
1478     IFLT(key, *a) {
1479         /* key < a[hint] -- gallop left, until
1480          * a[hint - ofs] <= key < a[hint - lastofs]
1481          */
1482         const Py_ssize_t maxofs = hint + 1;             /* &a[0] is lowest */
1483         while (ofs < maxofs) {
1484             IFLT(key, *(a-ofs)) {
1485                 lastofs = ofs;
1486                 assert(ofs <= (PY_SSIZE_T_MAX - 1) / 2);
1487                 ofs = (ofs << 1) + 1;
1488             }
1489             else                /* a[hint - ofs] <= key */
1490                 break;
1491         }
1492         if (ofs > maxofs)
1493             ofs = maxofs;
1494         /* Translate back to positive offsets relative to &a[0]. */
1495         k = lastofs;
1496         lastofs = hint - ofs;
1497         ofs = hint - k;
1498     }
1499     else {
1500         /* a[hint] <= key -- gallop right, until
1501          * a[hint + lastofs] <= key < a[hint + ofs]
1502         */
1503         const Py_ssize_t maxofs = n - hint;             /* &a[n-1] is highest */
1504         while (ofs < maxofs) {
1505             IFLT(key, a[ofs])
1506                 break;
1507             /* a[hint + ofs] <= key */
1508             lastofs = ofs;
1509             assert(ofs <= (PY_SSIZE_T_MAX - 1) / 2);
1510             ofs = (ofs << 1) + 1;
1511         }
1512         if (ofs > maxofs)
1513             ofs = maxofs;
1514         /* Translate back to offsets relative to &a[0]. */
1515         lastofs += hint;
1516         ofs += hint;
1517     }
1518     a -= hint;
1519 
1520     assert(-1 <= lastofs && lastofs < ofs && ofs <= n);
1521     /* Now a[lastofs] <= key < a[ofs], so key belongs somewhere to the
1522      * right of lastofs but no farther right than ofs.  Do a binary
1523      * search, with invariant a[lastofs-1] <= key < a[ofs].
1524      */
1525     ++lastofs;
1526     while (lastofs < ofs) {
1527         Py_ssize_t m = lastofs + ((ofs - lastofs) >> 1);
1528 
1529         IFLT(key, a[m])
1530             ofs = m;                    /* key < a[m] */
1531         else
1532             lastofs = m+1;              /* a[m] <= key */
1533     }
1534     assert(lastofs == ofs);             /* so a[ofs-1] <= key < a[ofs] */
1535     return ofs;
1536 
1537 fail:
1538     return -1;
1539 }
1540 
1541 /* Conceptually a MergeState's constructor. */
1542 static void
merge_init(MergeState * ms,Py_ssize_t list_size,int has_keyfunc,sortslice * lo)1543 merge_init(MergeState *ms, Py_ssize_t list_size, int has_keyfunc,
1544            sortslice *lo)
1545 {
1546     assert(ms != NULL);
1547     if (has_keyfunc) {
1548         /* The temporary space for merging will need at most half the list
1549          * size rounded up.  Use the minimum possible space so we can use the
1550          * rest of temparray for other things.  In particular, if there is
1551          * enough extra space, listsort() will use it to store the keys.
1552          */
1553         ms->alloced = (list_size + 1) / 2;
1554 
1555         /* ms->alloced describes how many keys will be stored at
1556            ms->temparray, but we also need to store the values.  Hence,
1557            ms->alloced is capped at half of MERGESTATE_TEMP_SIZE. */
1558         if (MERGESTATE_TEMP_SIZE / 2 < ms->alloced)
1559             ms->alloced = MERGESTATE_TEMP_SIZE / 2;
1560         ms->a.values = &ms->temparray[ms->alloced];
1561     }
1562     else {
1563         ms->alloced = MERGESTATE_TEMP_SIZE;
1564         ms->a.values = NULL;
1565     }
1566     ms->a.keys = ms->temparray;
1567     ms->n = 0;
1568     ms->min_gallop = MIN_GALLOP;
1569     ms->listlen = list_size;
1570     ms->basekeys = lo->keys;
1571 }
1572 
1573 /* Free all the temp memory owned by the MergeState.  This must be called
1574  * when you're done with a MergeState, and may be called before then if
1575  * you want to free the temp memory early.
1576  */
1577 static void
merge_freemem(MergeState * ms)1578 merge_freemem(MergeState *ms)
1579 {
1580     assert(ms != NULL);
1581     if (ms->a.keys != ms->temparray) {
1582         PyMem_Free(ms->a.keys);
1583         ms->a.keys = NULL;
1584     }
1585 }
1586 
1587 /* Ensure enough temp memory for 'need' array slots is available.
1588  * Returns 0 on success and -1 if the memory can't be gotten.
1589  */
1590 static int
merge_getmem(MergeState * ms,Py_ssize_t need)1591 merge_getmem(MergeState *ms, Py_ssize_t need)
1592 {
1593     int multiplier;
1594 
1595     assert(ms != NULL);
1596     if (need <= ms->alloced)
1597         return 0;
1598 
1599     multiplier = ms->a.values != NULL ? 2 : 1;
1600 
1601     /* Don't realloc!  That can cost cycles to copy the old data, but
1602      * we don't care what's in the block.
1603      */
1604     merge_freemem(ms);
1605     if ((size_t)need > PY_SSIZE_T_MAX / sizeof(PyObject *) / multiplier) {
1606         PyErr_NoMemory();
1607         return -1;
1608     }
1609     ms->a.keys = (PyObject **)PyMem_Malloc(multiplier * need
1610                                           * sizeof(PyObject *));
1611     if (ms->a.keys != NULL) {
1612         ms->alloced = need;
1613         if (ms->a.values != NULL)
1614             ms->a.values = &ms->a.keys[need];
1615         return 0;
1616     }
1617     PyErr_NoMemory();
1618     return -1;
1619 }
1620 #define MERGE_GETMEM(MS, NEED) ((NEED) <= (MS)->alloced ? 0 :   \
1621                                 merge_getmem(MS, NEED))
1622 
1623 /* Merge the na elements starting at ssa with the nb elements starting at
1624  * ssb.keys = ssa.keys + na in a stable way, in-place.  na and nb must be > 0.
1625  * Must also have that ssa.keys[na-1] belongs at the end of the merge, and
1626  * should have na <= nb.  See listsort.txt for more info.  Return 0 if
1627  * successful, -1 if error.
1628  */
1629 static Py_ssize_t
merge_lo(MergeState * ms,sortslice ssa,Py_ssize_t na,sortslice ssb,Py_ssize_t nb)1630 merge_lo(MergeState *ms, sortslice ssa, Py_ssize_t na,
1631          sortslice ssb, Py_ssize_t nb)
1632 {
1633     Py_ssize_t k;
1634     sortslice dest;
1635     int result = -1;            /* guilty until proved innocent */
1636     Py_ssize_t min_gallop;
1637 
1638     assert(ms && ssa.keys && ssb.keys && na > 0 && nb > 0);
1639     assert(ssa.keys + na == ssb.keys);
1640     if (MERGE_GETMEM(ms, na) < 0)
1641         return -1;
1642     sortslice_memcpy(&ms->a, 0, &ssa, 0, na);
1643     dest = ssa;
1644     ssa = ms->a;
1645 
1646     sortslice_copy_incr(&dest, &ssb);
1647     --nb;
1648     if (nb == 0)
1649         goto Succeed;
1650     if (na == 1)
1651         goto CopyB;
1652 
1653     min_gallop = ms->min_gallop;
1654     for (;;) {
1655         Py_ssize_t acount = 0;          /* # of times A won in a row */
1656         Py_ssize_t bcount = 0;          /* # of times B won in a row */
1657 
1658         /* Do the straightforward thing until (if ever) one run
1659          * appears to win consistently.
1660          */
1661         for (;;) {
1662             assert(na > 1 && nb > 0);
1663             k = ISLT(ssb.keys[0], ssa.keys[0]);
1664             if (k) {
1665                 if (k < 0)
1666                     goto Fail;
1667                 sortslice_copy_incr(&dest, &ssb);
1668                 ++bcount;
1669                 acount = 0;
1670                 --nb;
1671                 if (nb == 0)
1672                     goto Succeed;
1673                 if (bcount >= min_gallop)
1674                     break;
1675             }
1676             else {
1677                 sortslice_copy_incr(&dest, &ssa);
1678                 ++acount;
1679                 bcount = 0;
1680                 --na;
1681                 if (na == 1)
1682                     goto CopyB;
1683                 if (acount >= min_gallop)
1684                     break;
1685             }
1686         }
1687 
1688         /* One run is winning so consistently that galloping may
1689          * be a huge win.  So try that, and continue galloping until
1690          * (if ever) neither run appears to be winning consistently
1691          * anymore.
1692          */
1693         ++min_gallop;
1694         do {
1695             assert(na > 1 && nb > 0);
1696             min_gallop -= min_gallop > 1;
1697             ms->min_gallop = min_gallop;
1698             k = gallop_right(ms, ssb.keys[0], ssa.keys, na, 0);
1699             acount = k;
1700             if (k) {
1701                 if (k < 0)
1702                     goto Fail;
1703                 sortslice_memcpy(&dest, 0, &ssa, 0, k);
1704                 sortslice_advance(&dest, k);
1705                 sortslice_advance(&ssa, k);
1706                 na -= k;
1707                 if (na == 1)
1708                     goto CopyB;
1709                 /* na==0 is impossible now if the comparison
1710                  * function is consistent, but we can't assume
1711                  * that it is.
1712                  */
1713                 if (na == 0)
1714                     goto Succeed;
1715             }
1716             sortslice_copy_incr(&dest, &ssb);
1717             --nb;
1718             if (nb == 0)
1719                 goto Succeed;
1720 
1721             k = gallop_left(ms, ssa.keys[0], ssb.keys, nb, 0);
1722             bcount = k;
1723             if (k) {
1724                 if (k < 0)
1725                     goto Fail;
1726                 sortslice_memmove(&dest, 0, &ssb, 0, k);
1727                 sortslice_advance(&dest, k);
1728                 sortslice_advance(&ssb, k);
1729                 nb -= k;
1730                 if (nb == 0)
1731                     goto Succeed;
1732             }
1733             sortslice_copy_incr(&dest, &ssa);
1734             --na;
1735             if (na == 1)
1736                 goto CopyB;
1737         } while (acount >= MIN_GALLOP || bcount >= MIN_GALLOP);
1738         ++min_gallop;           /* penalize it for leaving galloping mode */
1739         ms->min_gallop = min_gallop;
1740     }
1741 Succeed:
1742     result = 0;
1743 Fail:
1744     if (na)
1745         sortslice_memcpy(&dest, 0, &ssa, 0, na);
1746     return result;
1747 CopyB:
1748     assert(na == 1 && nb > 0);
1749     /* The last element of ssa belongs at the end of the merge. */
1750     sortslice_memmove(&dest, 0, &ssb, 0, nb);
1751     sortslice_copy(&dest, nb, &ssa, 0);
1752     return 0;
1753 }
1754 
1755 /* Merge the na elements starting at pa with the nb elements starting at
1756  * ssb.keys = ssa.keys + na in a stable way, in-place.  na and nb must be > 0.
1757  * Must also have that ssa.keys[na-1] belongs at the end of the merge, and
1758  * should have na >= nb.  See listsort.txt for more info.  Return 0 if
1759  * successful, -1 if error.
1760  */
1761 static Py_ssize_t
merge_hi(MergeState * ms,sortslice ssa,Py_ssize_t na,sortslice ssb,Py_ssize_t nb)1762 merge_hi(MergeState *ms, sortslice ssa, Py_ssize_t na,
1763          sortslice ssb, Py_ssize_t nb)
1764 {
1765     Py_ssize_t k;
1766     sortslice dest, basea, baseb;
1767     int result = -1;            /* guilty until proved innocent */
1768     Py_ssize_t min_gallop;
1769 
1770     assert(ms && ssa.keys && ssb.keys && na > 0 && nb > 0);
1771     assert(ssa.keys + na == ssb.keys);
1772     if (MERGE_GETMEM(ms, nb) < 0)
1773         return -1;
1774     dest = ssb;
1775     sortslice_advance(&dest, nb-1);
1776     sortslice_memcpy(&ms->a, 0, &ssb, 0, nb);
1777     basea = ssa;
1778     baseb = ms->a;
1779     ssb.keys = ms->a.keys + nb - 1;
1780     if (ssb.values != NULL)
1781         ssb.values = ms->a.values + nb - 1;
1782     sortslice_advance(&ssa, na - 1);
1783 
1784     sortslice_copy_decr(&dest, &ssa);
1785     --na;
1786     if (na == 0)
1787         goto Succeed;
1788     if (nb == 1)
1789         goto CopyA;
1790 
1791     min_gallop = ms->min_gallop;
1792     for (;;) {
1793         Py_ssize_t acount = 0;          /* # of times A won in a row */
1794         Py_ssize_t bcount = 0;          /* # of times B won in a row */
1795 
1796         /* Do the straightforward thing until (if ever) one run
1797          * appears to win consistently.
1798          */
1799         for (;;) {
1800             assert(na > 0 && nb > 1);
1801             k = ISLT(ssb.keys[0], ssa.keys[0]);
1802             if (k) {
1803                 if (k < 0)
1804                     goto Fail;
1805                 sortslice_copy_decr(&dest, &ssa);
1806                 ++acount;
1807                 bcount = 0;
1808                 --na;
1809                 if (na == 0)
1810                     goto Succeed;
1811                 if (acount >= min_gallop)
1812                     break;
1813             }
1814             else {
1815                 sortslice_copy_decr(&dest, &ssb);
1816                 ++bcount;
1817                 acount = 0;
1818                 --nb;
1819                 if (nb == 1)
1820                     goto CopyA;
1821                 if (bcount >= min_gallop)
1822                     break;
1823             }
1824         }
1825 
1826         /* One run is winning so consistently that galloping may
1827          * be a huge win.  So try that, and continue galloping until
1828          * (if ever) neither run appears to be winning consistently
1829          * anymore.
1830          */
1831         ++min_gallop;
1832         do {
1833             assert(na > 0 && nb > 1);
1834             min_gallop -= min_gallop > 1;
1835             ms->min_gallop = min_gallop;
1836             k = gallop_right(ms, ssb.keys[0], basea.keys, na, na-1);
1837             if (k < 0)
1838                 goto Fail;
1839             k = na - k;
1840             acount = k;
1841             if (k) {
1842                 sortslice_advance(&dest, -k);
1843                 sortslice_advance(&ssa, -k);
1844                 sortslice_memmove(&dest, 1, &ssa, 1, k);
1845                 na -= k;
1846                 if (na == 0)
1847                     goto Succeed;
1848             }
1849             sortslice_copy_decr(&dest, &ssb);
1850             --nb;
1851             if (nb == 1)
1852                 goto CopyA;
1853 
1854             k = gallop_left(ms, ssa.keys[0], baseb.keys, nb, nb-1);
1855             if (k < 0)
1856                 goto Fail;
1857             k = nb - k;
1858             bcount = k;
1859             if (k) {
1860                 sortslice_advance(&dest, -k);
1861                 sortslice_advance(&ssb, -k);
1862                 sortslice_memcpy(&dest, 1, &ssb, 1, k);
1863                 nb -= k;
1864                 if (nb == 1)
1865                     goto CopyA;
1866                 /* nb==0 is impossible now if the comparison
1867                  * function is consistent, but we can't assume
1868                  * that it is.
1869                  */
1870                 if (nb == 0)
1871                     goto Succeed;
1872             }
1873             sortslice_copy_decr(&dest, &ssa);
1874             --na;
1875             if (na == 0)
1876                 goto Succeed;
1877         } while (acount >= MIN_GALLOP || bcount >= MIN_GALLOP);
1878         ++min_gallop;           /* penalize it for leaving galloping mode */
1879         ms->min_gallop = min_gallop;
1880     }
1881 Succeed:
1882     result = 0;
1883 Fail:
1884     if (nb)
1885         sortslice_memcpy(&dest, -(nb-1), &baseb, 0, nb);
1886     return result;
1887 CopyA:
1888     assert(nb == 1 && na > 0);
1889     /* The first element of ssb belongs at the front of the merge. */
1890     sortslice_memmove(&dest, 1-na, &ssa, 1-na, na);
1891     sortslice_advance(&dest, -na);
1892     sortslice_advance(&ssa, -na);
1893     sortslice_copy(&dest, 0, &ssb, 0);
1894     return 0;
1895 }
1896 
1897 /* Merge the two runs at stack indices i and i+1.
1898  * Returns 0 on success, -1 on error.
1899  */
1900 static Py_ssize_t
merge_at(MergeState * ms,Py_ssize_t i)1901 merge_at(MergeState *ms, Py_ssize_t i)
1902 {
1903     sortslice ssa, ssb;
1904     Py_ssize_t na, nb;
1905     Py_ssize_t k;
1906 
1907     assert(ms != NULL);
1908     assert(ms->n >= 2);
1909     assert(i >= 0);
1910     assert(i == ms->n - 2 || i == ms->n - 3);
1911 
1912     ssa = ms->pending[i].base;
1913     na = ms->pending[i].len;
1914     ssb = ms->pending[i+1].base;
1915     nb = ms->pending[i+1].len;
1916     assert(na > 0 && nb > 0);
1917     assert(ssa.keys + na == ssb.keys);
1918 
1919     /* Record the length of the combined runs; if i is the 3rd-last
1920      * run now, also slide over the last run (which isn't involved
1921      * in this merge).  The current run i+1 goes away in any case.
1922      */
1923     ms->pending[i].len = na + nb;
1924     if (i == ms->n - 3)
1925         ms->pending[i+1] = ms->pending[i+2];
1926     --ms->n;
1927 
1928     /* Where does b start in a?  Elements in a before that can be
1929      * ignored (already in place).
1930      */
1931     k = gallop_right(ms, *ssb.keys, ssa.keys, na, 0);
1932     if (k < 0)
1933         return -1;
1934     sortslice_advance(&ssa, k);
1935     na -= k;
1936     if (na == 0)
1937         return 0;
1938 
1939     /* Where does a end in b?  Elements in b after that can be
1940      * ignored (already in place).
1941      */
1942     nb = gallop_left(ms, ssa.keys[na-1], ssb.keys, nb, nb-1);
1943     if (nb <= 0)
1944         return nb;
1945 
1946     /* Merge what remains of the runs, using a temp array with
1947      * min(na, nb) elements.
1948      */
1949     if (na <= nb)
1950         return merge_lo(ms, ssa, na, ssb, nb);
1951     else
1952         return merge_hi(ms, ssa, na, ssb, nb);
1953 }
1954 
1955 /* Two adjacent runs begin at index s1. The first run has length n1, and
1956  * the second run (starting at index s1+n1) has length n2. The list has total
1957  * length n.
1958  * Compute the "power" of the first run. See listsort.txt for details.
1959  */
1960 static int
powerloop(Py_ssize_t s1,Py_ssize_t n1,Py_ssize_t n2,Py_ssize_t n)1961 powerloop(Py_ssize_t s1, Py_ssize_t n1, Py_ssize_t n2, Py_ssize_t n)
1962 {
1963     int result = 0;
1964     assert(s1 >= 0);
1965     assert(n1 > 0 && n2 > 0);
1966     assert(s1 + n1 + n2 <= n);
1967     /* midpoints a and b:
1968      * a = s1 + n1/2
1969      * b = s1 + n1 + n2/2 = a + (n1 + n2)/2
1970      *
1971      * Those may not be integers, though, because of the "/2". So we work with
1972      * 2*a and 2*b instead, which are necessarily integers. It makes no
1973      * difference to the outcome, since the bits in the expansion of (2*i)/n
1974      * are merely shifted one position from those of i/n.
1975      */
1976     Py_ssize_t a = 2 * s1 + n1;  /* 2*a */
1977     Py_ssize_t b = a + n1 + n2;  /* 2*b */
1978     /* Emulate a/n and b/n one bit a time, until bits differ. */
1979     for (;;) {
1980         ++result;
1981         if (a >= n) {  /* both quotient bits are 1 */
1982             assert(b >= a);
1983             a -= n;
1984             b -= n;
1985         }
1986         else if (b >= n) {  /* a/n bit is 0, b/n bit is 1 */
1987             break;
1988         } /* else both quotient bits are 0 */
1989         assert(a < b && b < n);
1990         a <<= 1;
1991         b <<= 1;
1992     }
1993     return result;
1994 }
1995 
1996 /* The next run has been identified, of length n2.
1997  * If there's already a run on the stack, apply the "powersort" merge strategy:
1998  * compute the topmost run's "power" (depth in a conceptual binary merge tree)
1999  * and merge adjacent runs on the stack with greater power. See listsort.txt
2000  * for more info.
2001  *
2002  * It's the caller's responsibility to push the new run on the stack when this
2003  * returns.
2004  *
2005  * Returns 0 on success, -1 on error.
2006  */
2007 static int
found_new_run(MergeState * ms,Py_ssize_t n2)2008 found_new_run(MergeState *ms, Py_ssize_t n2)
2009 {
2010     assert(ms);
2011     if (ms->n) {
2012         assert(ms->n > 0);
2013         struct s_slice *p = ms->pending;
2014         Py_ssize_t s1 = p[ms->n - 1].base.keys - ms->basekeys; /* start index */
2015         Py_ssize_t n1 = p[ms->n - 1].len;
2016         int power = powerloop(s1, n1, n2, ms->listlen);
2017         while (ms->n > 1 && p[ms->n - 2].power > power) {
2018             if (merge_at(ms, ms->n - 2) < 0)
2019                 return -1;
2020         }
2021         assert(ms->n < 2 || p[ms->n - 2].power < power);
2022         p[ms->n - 1].power = power;
2023     }
2024     return 0;
2025 }
2026 
2027 /* Regardless of invariants, merge all runs on the stack until only one
2028  * remains.  This is used at the end of the mergesort.
2029  *
2030  * Returns 0 on success, -1 on error.
2031  */
2032 static int
merge_force_collapse(MergeState * ms)2033 merge_force_collapse(MergeState *ms)
2034 {
2035     struct s_slice *p = ms->pending;
2036 
2037     assert(ms);
2038     while (ms->n > 1) {
2039         Py_ssize_t n = ms->n - 2;
2040         if (n > 0 && p[n-1].len < p[n+1].len)
2041             --n;
2042         if (merge_at(ms, n) < 0)
2043             return -1;
2044     }
2045     return 0;
2046 }
2047 
2048 /* Compute a good value for the minimum run length; natural runs shorter
2049  * than this are boosted artificially via binary insertion.
2050  *
2051  * If n < 64, return n (it's too small to bother with fancy stuff).
2052  * Else if n is an exact power of 2, return 32.
2053  * Else return an int k, 32 <= k <= 64, such that n/k is close to, but
2054  * strictly less than, an exact power of 2.
2055  *
2056  * See listsort.txt for more info.
2057  */
2058 static Py_ssize_t
merge_compute_minrun(Py_ssize_t n)2059 merge_compute_minrun(Py_ssize_t n)
2060 {
2061     Py_ssize_t r = 0;           /* becomes 1 if any 1 bits are shifted off */
2062 
2063     assert(n >= 0);
2064     while (n >= 64) {
2065         r |= n & 1;
2066         n >>= 1;
2067     }
2068     return n + r;
2069 }
2070 
2071 static void
reverse_sortslice(sortslice * s,Py_ssize_t n)2072 reverse_sortslice(sortslice *s, Py_ssize_t n)
2073 {
2074     reverse_slice(s->keys, &s->keys[n]);
2075     if (s->values != NULL)
2076         reverse_slice(s->values, &s->values[n]);
2077 }
2078 
2079 /* Here we define custom comparison functions to optimize for the cases one commonly
2080  * encounters in practice: homogeneous lists, often of one of the basic types. */
2081 
2082 /* This struct holds the comparison function and helper functions
2083  * selected in the pre-sort check. */
2084 
2085 /* These are the special case compare functions.
2086  * ms->key_compare will always point to one of these: */
2087 
2088 /* Heterogeneous compare: default, always safe to fall back on. */
2089 static int
safe_object_compare(PyObject * v,PyObject * w,MergeState * ms)2090 safe_object_compare(PyObject *v, PyObject *w, MergeState *ms)
2091 {
2092     /* No assumptions necessary! */
2093     return PyObject_RichCompareBool(v, w, Py_LT);
2094 }
2095 
2096 /* Homogeneous compare: safe for any two comparable objects of the same type.
2097  * (ms->key_richcompare is set to ob_type->tp_richcompare in the
2098  *  pre-sort check.)
2099  */
2100 static int
unsafe_object_compare(PyObject * v,PyObject * w,MergeState * ms)2101 unsafe_object_compare(PyObject *v, PyObject *w, MergeState *ms)
2102 {
2103     PyObject *res_obj; int res;
2104 
2105     /* No assumptions, because we check first: */
2106     if (Py_TYPE(v)->tp_richcompare != ms->key_richcompare)
2107         return PyObject_RichCompareBool(v, w, Py_LT);
2108 
2109     assert(ms->key_richcompare != NULL);
2110     res_obj = (*(ms->key_richcompare))(v, w, Py_LT);
2111 
2112     if (res_obj == Py_NotImplemented) {
2113         Py_DECREF(res_obj);
2114         return PyObject_RichCompareBool(v, w, Py_LT);
2115     }
2116     if (res_obj == NULL)
2117         return -1;
2118 
2119     if (PyBool_Check(res_obj)) {
2120         res = (res_obj == Py_True);
2121     }
2122     else {
2123         res = PyObject_IsTrue(res_obj);
2124     }
2125     Py_DECREF(res_obj);
2126 
2127     /* Note that we can't assert
2128      *     res == PyObject_RichCompareBool(v, w, Py_LT);
2129      * because of evil compare functions like this:
2130      *     lambda a, b:  int(random.random() * 3) - 1)
2131      * (which is actually in test_sort.py) */
2132     return res;
2133 }
2134 
2135 /* Latin string compare: safe for any two latin (one byte per char) strings. */
2136 static int
unsafe_latin_compare(PyObject * v,PyObject * w,MergeState * ms)2137 unsafe_latin_compare(PyObject *v, PyObject *w, MergeState *ms)
2138 {
2139     Py_ssize_t len;
2140     int res;
2141 
2142     /* Modified from Objects/unicodeobject.c:unicode_compare, assuming: */
2143     assert(Py_IS_TYPE(v, &PyUnicode_Type));
2144     assert(Py_IS_TYPE(w, &PyUnicode_Type));
2145     assert(PyUnicode_KIND(v) == PyUnicode_KIND(w));
2146     assert(PyUnicode_KIND(v) == PyUnicode_1BYTE_KIND);
2147 
2148     len = Py_MIN(PyUnicode_GET_LENGTH(v), PyUnicode_GET_LENGTH(w));
2149     res = memcmp(PyUnicode_DATA(v), PyUnicode_DATA(w), len);
2150 
2151     res = (res != 0 ?
2152            res < 0 :
2153            PyUnicode_GET_LENGTH(v) < PyUnicode_GET_LENGTH(w));
2154 
2155     assert(res == PyObject_RichCompareBool(v, w, Py_LT));;
2156     return res;
2157 }
2158 
2159 /* Bounded int compare: compare any two longs that fit in a single machine word. */
2160 static int
unsafe_long_compare(PyObject * v,PyObject * w,MergeState * ms)2161 unsafe_long_compare(PyObject *v, PyObject *w, MergeState *ms)
2162 {
2163     PyLongObject *vl, *wl; sdigit v0, w0; int res;
2164 
2165     /* Modified from Objects/longobject.c:long_compare, assuming: */
2166     assert(Py_IS_TYPE(v, &PyLong_Type));
2167     assert(Py_IS_TYPE(w, &PyLong_Type));
2168     assert(Py_ABS(Py_SIZE(v)) <= 1);
2169     assert(Py_ABS(Py_SIZE(w)) <= 1);
2170 
2171     vl = (PyLongObject*)v;
2172     wl = (PyLongObject*)w;
2173 
2174     v0 = Py_SIZE(vl) == 0 ? 0 : (sdigit)vl->ob_digit[0];
2175     w0 = Py_SIZE(wl) == 0 ? 0 : (sdigit)wl->ob_digit[0];
2176 
2177     if (Py_SIZE(vl) < 0)
2178         v0 = -v0;
2179     if (Py_SIZE(wl) < 0)
2180         w0 = -w0;
2181 
2182     res = v0 < w0;
2183     assert(res == PyObject_RichCompareBool(v, w, Py_LT));
2184     return res;
2185 }
2186 
2187 /* Float compare: compare any two floats. */
2188 static int
unsafe_float_compare(PyObject * v,PyObject * w,MergeState * ms)2189 unsafe_float_compare(PyObject *v, PyObject *w, MergeState *ms)
2190 {
2191     int res;
2192 
2193     /* Modified from Objects/floatobject.c:float_richcompare, assuming: */
2194     assert(Py_IS_TYPE(v, &PyFloat_Type));
2195     assert(Py_IS_TYPE(w, &PyFloat_Type));
2196 
2197     res = PyFloat_AS_DOUBLE(v) < PyFloat_AS_DOUBLE(w);
2198     assert(res == PyObject_RichCompareBool(v, w, Py_LT));
2199     return res;
2200 }
2201 
2202 /* Tuple compare: compare *any* two tuples, using
2203  * ms->tuple_elem_compare to compare the first elements, which is set
2204  * using the same pre-sort check as we use for ms->key_compare,
2205  * but run on the list [x[0] for x in L]. This allows us to optimize compares
2206  * on two levels (as long as [x[0] for x in L] is type-homogeneous.) The idea is
2207  * that most tuple compares don't involve x[1:]. */
2208 static int
unsafe_tuple_compare(PyObject * v,PyObject * w,MergeState * ms)2209 unsafe_tuple_compare(PyObject *v, PyObject *w, MergeState *ms)
2210 {
2211     PyTupleObject *vt, *wt;
2212     Py_ssize_t i, vlen, wlen;
2213     int k;
2214 
2215     /* Modified from Objects/tupleobject.c:tuplerichcompare, assuming: */
2216     assert(Py_IS_TYPE(v, &PyTuple_Type));
2217     assert(Py_IS_TYPE(w, &PyTuple_Type));
2218     assert(Py_SIZE(v) > 0);
2219     assert(Py_SIZE(w) > 0);
2220 
2221     vt = (PyTupleObject *)v;
2222     wt = (PyTupleObject *)w;
2223 
2224     vlen = Py_SIZE(vt);
2225     wlen = Py_SIZE(wt);
2226 
2227     for (i = 0; i < vlen && i < wlen; i++) {
2228         k = PyObject_RichCompareBool(vt->ob_item[i], wt->ob_item[i], Py_EQ);
2229         if (k < 0)
2230             return -1;
2231         if (!k)
2232             break;
2233     }
2234 
2235     if (i >= vlen || i >= wlen)
2236         return vlen < wlen;
2237 
2238     if (i == 0)
2239         return ms->tuple_elem_compare(vt->ob_item[i], wt->ob_item[i], ms);
2240     else
2241         return PyObject_RichCompareBool(vt->ob_item[i], wt->ob_item[i], Py_LT);
2242 }
2243 
2244 /* An adaptive, stable, natural mergesort.  See listsort.txt.
2245  * Returns Py_None on success, NULL on error.  Even in case of error, the
2246  * list will be some permutation of its input state (nothing is lost or
2247  * duplicated).
2248  */
2249 /*[clinic input]
2250 list.sort
2251 
2252     *
2253     key as keyfunc: object = None
2254     reverse: bool(accept={int}) = False
2255 
2256 Sort the list in ascending order and return None.
2257 
2258 The sort is in-place (i.e. the list itself is modified) and stable (i.e. the
2259 order of two equal elements is maintained).
2260 
2261 If a key function is given, apply it once to each list item and sort them,
2262 ascending or descending, according to their function values.
2263 
2264 The reverse flag can be set to sort in descending order.
2265 [clinic start generated code]*/
2266 
2267 static PyObject *
list_sort_impl(PyListObject * self,PyObject * keyfunc,int reverse)2268 list_sort_impl(PyListObject *self, PyObject *keyfunc, int reverse)
2269 /*[clinic end generated code: output=57b9f9c5e23fbe42 input=cb56cd179a713060]*/
2270 {
2271     MergeState ms;
2272     Py_ssize_t nremaining;
2273     Py_ssize_t minrun;
2274     sortslice lo;
2275     Py_ssize_t saved_ob_size, saved_allocated;
2276     PyObject **saved_ob_item;
2277     PyObject **final_ob_item;
2278     PyObject *result = NULL;            /* guilty until proved innocent */
2279     Py_ssize_t i;
2280     PyObject **keys;
2281 
2282     assert(self != NULL);
2283     assert(PyList_Check(self));
2284     if (keyfunc == Py_None)
2285         keyfunc = NULL;
2286 
2287     /* The list is temporarily made empty, so that mutations performed
2288      * by comparison functions can't affect the slice of memory we're
2289      * sorting (allowing mutations during sorting is a core-dump
2290      * factory, since ob_item may change).
2291      */
2292     saved_ob_size = Py_SIZE(self);
2293     saved_ob_item = self->ob_item;
2294     saved_allocated = self->allocated;
2295     Py_SET_SIZE(self, 0);
2296     self->ob_item = NULL;
2297     self->allocated = -1; /* any operation will reset it to >= 0 */
2298 
2299     if (keyfunc == NULL) {
2300         keys = NULL;
2301         lo.keys = saved_ob_item;
2302         lo.values = NULL;
2303     }
2304     else {
2305         if (saved_ob_size < MERGESTATE_TEMP_SIZE/2)
2306             /* Leverage stack space we allocated but won't otherwise use */
2307             keys = &ms.temparray[saved_ob_size+1];
2308         else {
2309             keys = PyMem_Malloc(sizeof(PyObject *) * saved_ob_size);
2310             if (keys == NULL) {
2311                 PyErr_NoMemory();
2312                 goto keyfunc_fail;
2313             }
2314         }
2315 
2316         for (i = 0; i < saved_ob_size ; i++) {
2317             keys[i] = PyObject_CallOneArg(keyfunc, saved_ob_item[i]);
2318             if (keys[i] == NULL) {
2319                 for (i=i-1 ; i>=0 ; i--)
2320                     Py_DECREF(keys[i]);
2321                 if (saved_ob_size >= MERGESTATE_TEMP_SIZE/2)
2322                     PyMem_Free(keys);
2323                 goto keyfunc_fail;
2324             }
2325         }
2326 
2327         lo.keys = keys;
2328         lo.values = saved_ob_item;
2329     }
2330 
2331 
2332     /* The pre-sort check: here's where we decide which compare function to use.
2333      * How much optimization is safe? We test for homogeneity with respect to
2334      * several properties that are expensive to check at compare-time, and
2335      * set ms appropriately. */
2336     if (saved_ob_size > 1) {
2337         /* Assume the first element is representative of the whole list. */
2338         int keys_are_in_tuples = (Py_IS_TYPE(lo.keys[0], &PyTuple_Type) &&
2339                                   Py_SIZE(lo.keys[0]) > 0);
2340 
2341         PyTypeObject* key_type = (keys_are_in_tuples ?
2342                                   Py_TYPE(PyTuple_GET_ITEM(lo.keys[0], 0)) :
2343                                   Py_TYPE(lo.keys[0]));
2344 
2345         int keys_are_all_same_type = 1;
2346         int strings_are_latin = 1;
2347         int ints_are_bounded = 1;
2348 
2349         /* Prove that assumption by checking every key. */
2350         for (i=0; i < saved_ob_size; i++) {
2351 
2352             if (keys_are_in_tuples &&
2353                 !(Py_IS_TYPE(lo.keys[i], &PyTuple_Type) && Py_SIZE(lo.keys[i]) != 0)) {
2354                 keys_are_in_tuples = 0;
2355                 keys_are_all_same_type = 0;
2356                 break;
2357             }
2358 
2359             /* Note: for lists of tuples, key is the first element of the tuple
2360              * lo.keys[i], not lo.keys[i] itself! We verify type-homogeneity
2361              * for lists of tuples in the if-statement directly above. */
2362             PyObject *key = (keys_are_in_tuples ?
2363                              PyTuple_GET_ITEM(lo.keys[i], 0) :
2364                              lo.keys[i]);
2365 
2366             if (!Py_IS_TYPE(key, key_type)) {
2367                 keys_are_all_same_type = 0;
2368                 /* If keys are in tuple we must loop over the whole list to make
2369                    sure all items are tuples */
2370                 if (!keys_are_in_tuples) {
2371                     break;
2372                 }
2373             }
2374 
2375             if (keys_are_all_same_type) {
2376                 if (key_type == &PyLong_Type &&
2377                     ints_are_bounded &&
2378                     Py_ABS(Py_SIZE(key)) > 1) {
2379 
2380                     ints_are_bounded = 0;
2381                 }
2382                 else if (key_type == &PyUnicode_Type &&
2383                          strings_are_latin &&
2384                          PyUnicode_KIND(key) != PyUnicode_1BYTE_KIND) {
2385 
2386                         strings_are_latin = 0;
2387                     }
2388                 }
2389             }
2390 
2391         /* Choose the best compare, given what we now know about the keys. */
2392         if (keys_are_all_same_type) {
2393 
2394             if (key_type == &PyUnicode_Type && strings_are_latin) {
2395                 ms.key_compare = unsafe_latin_compare;
2396             }
2397             else if (key_type == &PyLong_Type && ints_are_bounded) {
2398                 ms.key_compare = unsafe_long_compare;
2399             }
2400             else if (key_type == &PyFloat_Type) {
2401                 ms.key_compare = unsafe_float_compare;
2402             }
2403             else if ((ms.key_richcompare = key_type->tp_richcompare) != NULL) {
2404                 ms.key_compare = unsafe_object_compare;
2405             }
2406             else {
2407                 ms.key_compare = safe_object_compare;
2408             }
2409         }
2410         else {
2411             ms.key_compare = safe_object_compare;
2412         }
2413 
2414         if (keys_are_in_tuples) {
2415             /* Make sure we're not dealing with tuples of tuples
2416              * (remember: here, key_type refers list [key[0] for key in keys]) */
2417             if (key_type == &PyTuple_Type) {
2418                 ms.tuple_elem_compare = safe_object_compare;
2419             }
2420             else {
2421                 ms.tuple_elem_compare = ms.key_compare;
2422             }
2423 
2424             ms.key_compare = unsafe_tuple_compare;
2425         }
2426     }
2427     /* End of pre-sort check: ms is now set properly! */
2428 
2429     merge_init(&ms, saved_ob_size, keys != NULL, &lo);
2430 
2431     nremaining = saved_ob_size;
2432     if (nremaining < 2)
2433         goto succeed;
2434 
2435     /* Reverse sort stability achieved by initially reversing the list,
2436     applying a stable forward sort, then reversing the final result. */
2437     if (reverse) {
2438         if (keys != NULL)
2439             reverse_slice(&keys[0], &keys[saved_ob_size]);
2440         reverse_slice(&saved_ob_item[0], &saved_ob_item[saved_ob_size]);
2441     }
2442 
2443     /* March over the array once, left to right, finding natural runs,
2444      * and extending short natural runs to minrun elements.
2445      */
2446     minrun = merge_compute_minrun(nremaining);
2447     do {
2448         int descending;
2449         Py_ssize_t n;
2450 
2451         /* Identify next run. */
2452         n = count_run(&ms, lo.keys, lo.keys + nremaining, &descending);
2453         if (n < 0)
2454             goto fail;
2455         if (descending)
2456             reverse_sortslice(&lo, n);
2457         /* If short, extend to min(minrun, nremaining). */
2458         if (n < minrun) {
2459             const Py_ssize_t force = nremaining <= minrun ?
2460                               nremaining : minrun;
2461             if (binarysort(&ms, lo, lo.keys + force, lo.keys + n) < 0)
2462                 goto fail;
2463             n = force;
2464         }
2465         /* Maybe merge pending runs. */
2466         assert(ms.n == 0 || ms.pending[ms.n -1].base.keys +
2467                             ms.pending[ms.n-1].len == lo.keys);
2468         if (found_new_run(&ms, n) < 0)
2469             goto fail;
2470         /* Push new run on stack. */
2471         assert(ms.n < MAX_MERGE_PENDING);
2472         ms.pending[ms.n].base = lo;
2473         ms.pending[ms.n].len = n;
2474         ++ms.n;
2475         /* Advance to find next run. */
2476         sortslice_advance(&lo, n);
2477         nremaining -= n;
2478     } while (nremaining);
2479 
2480     if (merge_force_collapse(&ms) < 0)
2481         goto fail;
2482     assert(ms.n == 1);
2483     assert(keys == NULL
2484            ? ms.pending[0].base.keys == saved_ob_item
2485            : ms.pending[0].base.keys == &keys[0]);
2486     assert(ms.pending[0].len == saved_ob_size);
2487     lo = ms.pending[0].base;
2488 
2489 succeed:
2490     result = Py_None;
2491 fail:
2492     if (keys != NULL) {
2493         for (i = 0; i < saved_ob_size; i++)
2494             Py_DECREF(keys[i]);
2495         if (saved_ob_size >= MERGESTATE_TEMP_SIZE/2)
2496             PyMem_Free(keys);
2497     }
2498 
2499     if (self->allocated != -1 && result != NULL) {
2500         /* The user mucked with the list during the sort,
2501          * and we don't already have another error to report.
2502          */
2503         PyErr_SetString(PyExc_ValueError, "list modified during sort");
2504         result = NULL;
2505     }
2506 
2507     if (reverse && saved_ob_size > 1)
2508         reverse_slice(saved_ob_item, saved_ob_item + saved_ob_size);
2509 
2510     merge_freemem(&ms);
2511 
2512 keyfunc_fail:
2513     final_ob_item = self->ob_item;
2514     i = Py_SIZE(self);
2515     Py_SET_SIZE(self, saved_ob_size);
2516     self->ob_item = saved_ob_item;
2517     self->allocated = saved_allocated;
2518     if (final_ob_item != NULL) {
2519         /* we cannot use _list_clear() for this because it does not
2520            guarantee that the list is really empty when it returns */
2521         while (--i >= 0) {
2522             Py_XDECREF(final_ob_item[i]);
2523         }
2524         PyMem_Free(final_ob_item);
2525     }
2526     Py_XINCREF(result);
2527     return result;
2528 }
2529 #undef IFLT
2530 #undef ISLT
2531 
2532 int
PyList_Sort(PyObject * v)2533 PyList_Sort(PyObject *v)
2534 {
2535     if (v == NULL || !PyList_Check(v)) {
2536         PyErr_BadInternalCall();
2537         return -1;
2538     }
2539     v = list_sort_impl((PyListObject *)v, NULL, 0);
2540     if (v == NULL)
2541         return -1;
2542     Py_DECREF(v);
2543     return 0;
2544 }
2545 
2546 /*[clinic input]
2547 list.reverse
2548 
2549 Reverse *IN PLACE*.
2550 [clinic start generated code]*/
2551 
2552 static PyObject *
list_reverse_impl(PyListObject * self)2553 list_reverse_impl(PyListObject *self)
2554 /*[clinic end generated code: output=482544fc451abea9 input=eefd4c3ae1bc9887]*/
2555 {
2556     if (Py_SIZE(self) > 1)
2557         reverse_slice(self->ob_item, self->ob_item + Py_SIZE(self));
2558     Py_RETURN_NONE;
2559 }
2560 
2561 int
PyList_Reverse(PyObject * v)2562 PyList_Reverse(PyObject *v)
2563 {
2564     PyListObject *self = (PyListObject *)v;
2565 
2566     if (v == NULL || !PyList_Check(v)) {
2567         PyErr_BadInternalCall();
2568         return -1;
2569     }
2570     if (Py_SIZE(self) > 1)
2571         reverse_slice(self->ob_item, self->ob_item + Py_SIZE(self));
2572     return 0;
2573 }
2574 
2575 PyObject *
PyList_AsTuple(PyObject * v)2576 PyList_AsTuple(PyObject *v)
2577 {
2578     if (v == NULL || !PyList_Check(v)) {
2579         PyErr_BadInternalCall();
2580         return NULL;
2581     }
2582     return _PyTuple_FromArray(((PyListObject *)v)->ob_item, Py_SIZE(v));
2583 }
2584 
2585 /*[clinic input]
2586 list.index
2587 
2588     value: object
2589     start: slice_index(accept={int}) = 0
2590     stop: slice_index(accept={int}, c_default="PY_SSIZE_T_MAX") = sys.maxsize
2591     /
2592 
2593 Return first index of value.
2594 
2595 Raises ValueError if the value is not present.
2596 [clinic start generated code]*/
2597 
2598 static PyObject *
list_index_impl(PyListObject * self,PyObject * value,Py_ssize_t start,Py_ssize_t stop)2599 list_index_impl(PyListObject *self, PyObject *value, Py_ssize_t start,
2600                 Py_ssize_t stop)
2601 /*[clinic end generated code: output=ec51b88787e4e481 input=40ec5826303a0eb1]*/
2602 {
2603     Py_ssize_t i;
2604 
2605     if (start < 0) {
2606         start += Py_SIZE(self);
2607         if (start < 0)
2608             start = 0;
2609     }
2610     if (stop < 0) {
2611         stop += Py_SIZE(self);
2612         if (stop < 0)
2613             stop = 0;
2614     }
2615     for (i = start; i < stop && i < Py_SIZE(self); i++) {
2616         PyObject *obj = self->ob_item[i];
2617         Py_INCREF(obj);
2618         int cmp = PyObject_RichCompareBool(obj, value, Py_EQ);
2619         Py_DECREF(obj);
2620         if (cmp > 0)
2621             return PyLong_FromSsize_t(i);
2622         else if (cmp < 0)
2623             return NULL;
2624     }
2625     PyErr_Format(PyExc_ValueError, "%R is not in list", value);
2626     return NULL;
2627 }
2628 
2629 /*[clinic input]
2630 list.count
2631 
2632      value: object
2633      /
2634 
2635 Return number of occurrences of value.
2636 [clinic start generated code]*/
2637 
2638 static PyObject *
list_count(PyListObject * self,PyObject * value)2639 list_count(PyListObject *self, PyObject *value)
2640 /*[clinic end generated code: output=b1f5d284205ae714 input=3bdc3a5e6f749565]*/
2641 {
2642     Py_ssize_t count = 0;
2643     Py_ssize_t i;
2644 
2645     for (i = 0; i < Py_SIZE(self); i++) {
2646         PyObject *obj = self->ob_item[i];
2647         if (obj == value) {
2648            count++;
2649            continue;
2650         }
2651         Py_INCREF(obj);
2652         int cmp = PyObject_RichCompareBool(obj, value, Py_EQ);
2653         Py_DECREF(obj);
2654         if (cmp > 0)
2655             count++;
2656         else if (cmp < 0)
2657             return NULL;
2658     }
2659     return PyLong_FromSsize_t(count);
2660 }
2661 
2662 /*[clinic input]
2663 list.remove
2664 
2665      value: object
2666      /
2667 
2668 Remove first occurrence of value.
2669 
2670 Raises ValueError if the value is not present.
2671 [clinic start generated code]*/
2672 
2673 static PyObject *
list_remove(PyListObject * self,PyObject * value)2674 list_remove(PyListObject *self, PyObject *value)
2675 /*[clinic end generated code: output=f087e1951a5e30d1 input=2dc2ba5bb2fb1f82]*/
2676 {
2677     Py_ssize_t i;
2678 
2679     for (i = 0; i < Py_SIZE(self); i++) {
2680         PyObject *obj = self->ob_item[i];
2681         Py_INCREF(obj);
2682         int cmp = PyObject_RichCompareBool(obj, value, Py_EQ);
2683         Py_DECREF(obj);
2684         if (cmp > 0) {
2685             if (list_ass_slice(self, i, i+1,
2686                                (PyObject *)NULL) == 0)
2687                 Py_RETURN_NONE;
2688             return NULL;
2689         }
2690         else if (cmp < 0)
2691             return NULL;
2692     }
2693     PyErr_SetString(PyExc_ValueError, "list.remove(x): x not in list");
2694     return NULL;
2695 }
2696 
2697 static int
list_traverse(PyListObject * o,visitproc visit,void * arg)2698 list_traverse(PyListObject *o, visitproc visit, void *arg)
2699 {
2700     Py_ssize_t i;
2701 
2702     for (i = Py_SIZE(o); --i >= 0; )
2703         Py_VISIT(o->ob_item[i]);
2704     return 0;
2705 }
2706 
2707 static PyObject *
list_richcompare(PyObject * v,PyObject * w,int op)2708 list_richcompare(PyObject *v, PyObject *w, int op)
2709 {
2710     PyListObject *vl, *wl;
2711     Py_ssize_t i;
2712 
2713     if (!PyList_Check(v) || !PyList_Check(w))
2714         Py_RETURN_NOTIMPLEMENTED;
2715 
2716     vl = (PyListObject *)v;
2717     wl = (PyListObject *)w;
2718 
2719     if (Py_SIZE(vl) != Py_SIZE(wl) && (op == Py_EQ || op == Py_NE)) {
2720         /* Shortcut: if the lengths differ, the lists differ */
2721         if (op == Py_EQ)
2722             Py_RETURN_FALSE;
2723         else
2724             Py_RETURN_TRUE;
2725     }
2726 
2727     /* Search for the first index where items are different */
2728     for (i = 0; i < Py_SIZE(vl) && i < Py_SIZE(wl); i++) {
2729         PyObject *vitem = vl->ob_item[i];
2730         PyObject *witem = wl->ob_item[i];
2731         if (vitem == witem) {
2732             continue;
2733         }
2734 
2735         Py_INCREF(vitem);
2736         Py_INCREF(witem);
2737         int k = PyObject_RichCompareBool(vitem, witem, Py_EQ);
2738         Py_DECREF(vitem);
2739         Py_DECREF(witem);
2740         if (k < 0)
2741             return NULL;
2742         if (!k)
2743             break;
2744     }
2745 
2746     if (i >= Py_SIZE(vl) || i >= Py_SIZE(wl)) {
2747         /* No more items to compare -- compare sizes */
2748         Py_RETURN_RICHCOMPARE(Py_SIZE(vl), Py_SIZE(wl), op);
2749     }
2750 
2751     /* We have an item that differs -- shortcuts for EQ/NE */
2752     if (op == Py_EQ) {
2753         Py_RETURN_FALSE;
2754     }
2755     if (op == Py_NE) {
2756         Py_RETURN_TRUE;
2757     }
2758 
2759     /* Compare the final item again using the proper operator */
2760     return PyObject_RichCompare(vl->ob_item[i], wl->ob_item[i], op);
2761 }
2762 
2763 /*[clinic input]
2764 list.__init__
2765 
2766     iterable: object(c_default="NULL") = ()
2767     /
2768 
2769 Built-in mutable sequence.
2770 
2771 If no argument is given, the constructor creates a new empty list.
2772 The argument must be an iterable if specified.
2773 [clinic start generated code]*/
2774 
2775 static int
list___init___impl(PyListObject * self,PyObject * iterable)2776 list___init___impl(PyListObject *self, PyObject *iterable)
2777 /*[clinic end generated code: output=0f3c21379d01de48 input=b3f3fe7206af8f6b]*/
2778 {
2779     /* Verify list invariants established by PyType_GenericAlloc() */
2780     assert(0 <= Py_SIZE(self));
2781     assert(Py_SIZE(self) <= self->allocated || self->allocated == -1);
2782     assert(self->ob_item != NULL ||
2783            self->allocated == 0 || self->allocated == -1);
2784 
2785     /* Empty previous contents */
2786     if (self->ob_item != NULL) {
2787         (void)_list_clear(self);
2788     }
2789     if (iterable != NULL) {
2790         PyObject *rv = list_extend(self, iterable);
2791         if (rv == NULL)
2792             return -1;
2793         Py_DECREF(rv);
2794     }
2795     return 0;
2796 }
2797 
2798 static PyObject *
list_vectorcall(PyObject * type,PyObject * const * args,size_t nargsf,PyObject * kwnames)2799 list_vectorcall(PyObject *type, PyObject * const*args,
2800                 size_t nargsf, PyObject *kwnames)
2801 {
2802     if (!_PyArg_NoKwnames("list", kwnames)) {
2803         return NULL;
2804     }
2805     Py_ssize_t nargs = PyVectorcall_NARGS(nargsf);
2806     if (!_PyArg_CheckPositional("list", nargs, 0, 1)) {
2807         return NULL;
2808     }
2809 
2810     PyObject *list = PyType_GenericAlloc(_PyType_CAST(type), 0);
2811     if (list == NULL) {
2812         return NULL;
2813     }
2814     if (nargs) {
2815         if (list___init___impl((PyListObject *)list, args[0])) {
2816             Py_DECREF(list);
2817             return NULL;
2818         }
2819     }
2820     return list;
2821 }
2822 
2823 
2824 /*[clinic input]
2825 list.__sizeof__
2826 
2827 Return the size of the list in memory, in bytes.
2828 [clinic start generated code]*/
2829 
2830 static PyObject *
list___sizeof___impl(PyListObject * self)2831 list___sizeof___impl(PyListObject *self)
2832 /*[clinic end generated code: output=3417541f95f9a53e input=b8030a5d5ce8a187]*/
2833 {
2834     Py_ssize_t res;
2835 
2836     res = _PyObject_SIZE(Py_TYPE(self)) + self->allocated * sizeof(void*);
2837     return PyLong_FromSsize_t(res);
2838 }
2839 
2840 static PyObject *list_iter(PyObject *seq);
2841 static PyObject *list_subscript(PyListObject*, PyObject*);
2842 
2843 static PyMethodDef list_methods[] = {
2844     {"__getitem__", (PyCFunction)list_subscript, METH_O|METH_COEXIST, "x.__getitem__(y) <==> x[y]"},
2845     LIST___REVERSED___METHODDEF
2846     LIST___SIZEOF___METHODDEF
2847     LIST_CLEAR_METHODDEF
2848     LIST_COPY_METHODDEF
2849     LIST_APPEND_METHODDEF
2850     LIST_INSERT_METHODDEF
2851     LIST_EXTEND_METHODDEF
2852     LIST_POP_METHODDEF
2853     LIST_REMOVE_METHODDEF
2854     LIST_INDEX_METHODDEF
2855     LIST_COUNT_METHODDEF
2856     LIST_REVERSE_METHODDEF
2857     LIST_SORT_METHODDEF
2858     {"__class_getitem__", Py_GenericAlias, METH_O|METH_CLASS, PyDoc_STR("See PEP 585")},
2859     {NULL,              NULL}           /* sentinel */
2860 };
2861 
2862 static PySequenceMethods list_as_sequence = {
2863     (lenfunc)list_length,                       /* sq_length */
2864     (binaryfunc)list_concat,                    /* sq_concat */
2865     (ssizeargfunc)list_repeat,                  /* sq_repeat */
2866     (ssizeargfunc)list_item,                    /* sq_item */
2867     0,                                          /* sq_slice */
2868     (ssizeobjargproc)list_ass_item,             /* sq_ass_item */
2869     0,                                          /* sq_ass_slice */
2870     (objobjproc)list_contains,                  /* sq_contains */
2871     (binaryfunc)list_inplace_concat,            /* sq_inplace_concat */
2872     (ssizeargfunc)list_inplace_repeat,          /* sq_inplace_repeat */
2873 };
2874 
2875 static PyObject *
list_subscript(PyListObject * self,PyObject * item)2876 list_subscript(PyListObject* self, PyObject* item)
2877 {
2878     if (_PyIndex_Check(item)) {
2879         Py_ssize_t i;
2880         i = PyNumber_AsSsize_t(item, PyExc_IndexError);
2881         if (i == -1 && PyErr_Occurred())
2882             return NULL;
2883         if (i < 0)
2884             i += PyList_GET_SIZE(self);
2885         return list_item(self, i);
2886     }
2887     else if (PySlice_Check(item)) {
2888         Py_ssize_t start, stop, step, slicelength, i;
2889         size_t cur;
2890         PyObject* result;
2891         PyObject* it;
2892         PyObject **src, **dest;
2893 
2894         if (PySlice_Unpack(item, &start, &stop, &step) < 0) {
2895             return NULL;
2896         }
2897         slicelength = PySlice_AdjustIndices(Py_SIZE(self), &start, &stop,
2898                                             step);
2899 
2900         if (slicelength <= 0) {
2901             return PyList_New(0);
2902         }
2903         else if (step == 1) {
2904             return list_slice(self, start, stop);
2905         }
2906         else {
2907             result = list_new_prealloc(slicelength);
2908             if (!result) return NULL;
2909 
2910             src = self->ob_item;
2911             dest = ((PyListObject *)result)->ob_item;
2912             for (cur = start, i = 0; i < slicelength;
2913                  cur += (size_t)step, i++) {
2914                 it = src[cur];
2915                 Py_INCREF(it);
2916                 dest[i] = it;
2917             }
2918             Py_SET_SIZE(result, slicelength);
2919             return result;
2920         }
2921     }
2922     else {
2923         PyErr_Format(PyExc_TypeError,
2924                      "list indices must be integers or slices, not %.200s",
2925                      Py_TYPE(item)->tp_name);
2926         return NULL;
2927     }
2928 }
2929 
2930 static int
list_ass_subscript(PyListObject * self,PyObject * item,PyObject * value)2931 list_ass_subscript(PyListObject* self, PyObject* item, PyObject* value)
2932 {
2933     if (_PyIndex_Check(item)) {
2934         Py_ssize_t i = PyNumber_AsSsize_t(item, PyExc_IndexError);
2935         if (i == -1 && PyErr_Occurred())
2936             return -1;
2937         if (i < 0)
2938             i += PyList_GET_SIZE(self);
2939         return list_ass_item(self, i, value);
2940     }
2941     else if (PySlice_Check(item)) {
2942         Py_ssize_t start, stop, step, slicelength;
2943 
2944         if (PySlice_Unpack(item, &start, &stop, &step) < 0) {
2945             return -1;
2946         }
2947         slicelength = PySlice_AdjustIndices(Py_SIZE(self), &start, &stop,
2948                                             step);
2949 
2950         if (step == 1)
2951             return list_ass_slice(self, start, stop, value);
2952 
2953         /* Make sure s[5:2] = [..] inserts at the right place:
2954            before 5, not before 2. */
2955         if ((step < 0 && start < stop) ||
2956             (step > 0 && start > stop))
2957             stop = start;
2958 
2959         if (value == NULL) {
2960             /* delete slice */
2961             PyObject **garbage;
2962             size_t cur;
2963             Py_ssize_t i;
2964             int res;
2965 
2966             if (slicelength <= 0)
2967                 return 0;
2968 
2969             if (step < 0) {
2970                 stop = start + 1;
2971                 start = stop + step*(slicelength - 1) - 1;
2972                 step = -step;
2973             }
2974 
2975             garbage = (PyObject**)
2976                 PyMem_Malloc(slicelength*sizeof(PyObject*));
2977             if (!garbage) {
2978                 PyErr_NoMemory();
2979                 return -1;
2980             }
2981 
2982             /* drawing pictures might help understand these for
2983                loops. Basically, we memmove the parts of the
2984                list that are *not* part of the slice: step-1
2985                items for each item that is part of the slice,
2986                and then tail end of the list that was not
2987                covered by the slice */
2988             for (cur = start, i = 0;
2989                  cur < (size_t)stop;
2990                  cur += step, i++) {
2991                 Py_ssize_t lim = step - 1;
2992 
2993                 garbage[i] = PyList_GET_ITEM(self, cur);
2994 
2995                 if (cur + step >= (size_t)Py_SIZE(self)) {
2996                     lim = Py_SIZE(self) - cur - 1;
2997                 }
2998 
2999                 memmove(self->ob_item + cur - i,
3000                     self->ob_item + cur + 1,
3001                     lim * sizeof(PyObject *));
3002             }
3003             cur = start + (size_t)slicelength * step;
3004             if (cur < (size_t)Py_SIZE(self)) {
3005                 memmove(self->ob_item + cur - slicelength,
3006                     self->ob_item + cur,
3007                     (Py_SIZE(self) - cur) *
3008                      sizeof(PyObject *));
3009             }
3010 
3011             Py_SET_SIZE(self, Py_SIZE(self) - slicelength);
3012             res = list_resize(self, Py_SIZE(self));
3013 
3014             for (i = 0; i < slicelength; i++) {
3015                 Py_DECREF(garbage[i]);
3016             }
3017             PyMem_Free(garbage);
3018 
3019             return res;
3020         }
3021         else {
3022             /* assign slice */
3023             PyObject *ins, *seq;
3024             PyObject **garbage, **seqitems, **selfitems;
3025             Py_ssize_t i;
3026             size_t cur;
3027 
3028             /* protect against a[::-1] = a */
3029             if (self == (PyListObject*)value) {
3030                 seq = list_slice((PyListObject*)value, 0,
3031                                    PyList_GET_SIZE(value));
3032             }
3033             else {
3034                 seq = PySequence_Fast(value,
3035                                       "must assign iterable "
3036                                       "to extended slice");
3037             }
3038             if (!seq)
3039                 return -1;
3040 
3041             if (PySequence_Fast_GET_SIZE(seq) != slicelength) {
3042                 PyErr_Format(PyExc_ValueError,
3043                     "attempt to assign sequence of "
3044                     "size %zd to extended slice of "
3045                     "size %zd",
3046                          PySequence_Fast_GET_SIZE(seq),
3047                          slicelength);
3048                 Py_DECREF(seq);
3049                 return -1;
3050             }
3051 
3052             if (!slicelength) {
3053                 Py_DECREF(seq);
3054                 return 0;
3055             }
3056 
3057             garbage = (PyObject**)
3058                 PyMem_Malloc(slicelength*sizeof(PyObject*));
3059             if (!garbage) {
3060                 Py_DECREF(seq);
3061                 PyErr_NoMemory();
3062                 return -1;
3063             }
3064 
3065             selfitems = self->ob_item;
3066             seqitems = PySequence_Fast_ITEMS(seq);
3067             for (cur = start, i = 0; i < slicelength;
3068                  cur += (size_t)step, i++) {
3069                 garbage[i] = selfitems[cur];
3070                 ins = seqitems[i];
3071                 Py_INCREF(ins);
3072                 selfitems[cur] = ins;
3073             }
3074 
3075             for (i = 0; i < slicelength; i++) {
3076                 Py_DECREF(garbage[i]);
3077             }
3078 
3079             PyMem_Free(garbage);
3080             Py_DECREF(seq);
3081 
3082             return 0;
3083         }
3084     }
3085     else {
3086         PyErr_Format(PyExc_TypeError,
3087                      "list indices must be integers or slices, not %.200s",
3088                      Py_TYPE(item)->tp_name);
3089         return -1;
3090     }
3091 }
3092 
3093 static PyMappingMethods list_as_mapping = {
3094     (lenfunc)list_length,
3095     (binaryfunc)list_subscript,
3096     (objobjargproc)list_ass_subscript
3097 };
3098 
3099 PyTypeObject PyList_Type = {
3100     PyVarObject_HEAD_INIT(&PyType_Type, 0)
3101     "list",
3102     sizeof(PyListObject),
3103     0,
3104     (destructor)list_dealloc,                   /* tp_dealloc */
3105     0,                                          /* tp_vectorcall_offset */
3106     0,                                          /* tp_getattr */
3107     0,                                          /* tp_setattr */
3108     0,                                          /* tp_as_async */
3109     (reprfunc)list_repr,                        /* tp_repr */
3110     0,                                          /* tp_as_number */
3111     &list_as_sequence,                          /* tp_as_sequence */
3112     &list_as_mapping,                           /* tp_as_mapping */
3113     PyObject_HashNotImplemented,                /* tp_hash */
3114     0,                                          /* tp_call */
3115     0,                                          /* tp_str */
3116     PyObject_GenericGetAttr,                    /* tp_getattro */
3117     0,                                          /* tp_setattro */
3118     0,                                          /* tp_as_buffer */
3119     Py_TPFLAGS_DEFAULT | Py_TPFLAGS_HAVE_GC |
3120         Py_TPFLAGS_BASETYPE | Py_TPFLAGS_LIST_SUBCLASS |
3121         _Py_TPFLAGS_MATCH_SELF | Py_TPFLAGS_SEQUENCE,  /* tp_flags */
3122     list___init____doc__,                       /* tp_doc */
3123     (traverseproc)list_traverse,                /* tp_traverse */
3124     (inquiry)_list_clear,                       /* tp_clear */
3125     list_richcompare,                           /* tp_richcompare */
3126     0,                                          /* tp_weaklistoffset */
3127     list_iter,                                  /* tp_iter */
3128     0,                                          /* tp_iternext */
3129     list_methods,                               /* tp_methods */
3130     0,                                          /* tp_members */
3131     0,                                          /* tp_getset */
3132     0,                                          /* tp_base */
3133     0,                                          /* tp_dict */
3134     0,                                          /* tp_descr_get */
3135     0,                                          /* tp_descr_set */
3136     0,                                          /* tp_dictoffset */
3137     (initproc)list___init__,                    /* tp_init */
3138     PyType_GenericAlloc,                        /* tp_alloc */
3139     PyType_GenericNew,                          /* tp_new */
3140     PyObject_GC_Del,                            /* tp_free */
3141     .tp_vectorcall = list_vectorcall,
3142 };
3143 
3144 /*********************** List Iterator **************************/
3145 
3146 typedef struct {
3147     PyObject_HEAD
3148     Py_ssize_t it_index;
3149     PyListObject *it_seq; /* Set to NULL when iterator is exhausted */
3150 } listiterobject;
3151 
3152 static void listiter_dealloc(listiterobject *);
3153 static int listiter_traverse(listiterobject *, visitproc, void *);
3154 static PyObject *listiter_next(listiterobject *);
3155 static PyObject *listiter_len(listiterobject *, PyObject *);
3156 static PyObject *listiter_reduce_general(void *_it, int forward);
3157 static PyObject *listiter_reduce(listiterobject *, PyObject *);
3158 static PyObject *listiter_setstate(listiterobject *, PyObject *state);
3159 
3160 PyDoc_STRVAR(length_hint_doc, "Private method returning an estimate of len(list(it)).");
3161 PyDoc_STRVAR(reduce_doc, "Return state information for pickling.");
3162 PyDoc_STRVAR(setstate_doc, "Set state information for unpickling.");
3163 
3164 static PyMethodDef listiter_methods[] = {
3165     {"__length_hint__", (PyCFunction)listiter_len, METH_NOARGS, length_hint_doc},
3166     {"__reduce__", (PyCFunction)listiter_reduce, METH_NOARGS, reduce_doc},
3167     {"__setstate__", (PyCFunction)listiter_setstate, METH_O, setstate_doc},
3168     {NULL,              NULL}           /* sentinel */
3169 };
3170 
3171 PyTypeObject PyListIter_Type = {
3172     PyVarObject_HEAD_INIT(&PyType_Type, 0)
3173     "list_iterator",                            /* tp_name */
3174     sizeof(listiterobject),                     /* tp_basicsize */
3175     0,                                          /* tp_itemsize */
3176     /* methods */
3177     (destructor)listiter_dealloc,               /* tp_dealloc */
3178     0,                                          /* tp_vectorcall_offset */
3179     0,                                          /* tp_getattr */
3180     0,                                          /* tp_setattr */
3181     0,                                          /* tp_as_async */
3182     0,                                          /* tp_repr */
3183     0,                                          /* tp_as_number */
3184     0,                                          /* tp_as_sequence */
3185     0,                                          /* tp_as_mapping */
3186     0,                                          /* tp_hash */
3187     0,                                          /* tp_call */
3188     0,                                          /* tp_str */
3189     PyObject_GenericGetAttr,                    /* tp_getattro */
3190     0,                                          /* tp_setattro */
3191     0,                                          /* tp_as_buffer */
3192     Py_TPFLAGS_DEFAULT | Py_TPFLAGS_HAVE_GC,/* tp_flags */
3193     0,                                          /* tp_doc */
3194     (traverseproc)listiter_traverse,            /* tp_traverse */
3195     0,                                          /* tp_clear */
3196     0,                                          /* tp_richcompare */
3197     0,                                          /* tp_weaklistoffset */
3198     PyObject_SelfIter,                          /* tp_iter */
3199     (iternextfunc)listiter_next,                /* tp_iternext */
3200     listiter_methods,                           /* tp_methods */
3201     0,                                          /* tp_members */
3202 };
3203 
3204 
3205 static PyObject *
list_iter(PyObject * seq)3206 list_iter(PyObject *seq)
3207 {
3208     listiterobject *it;
3209 
3210     if (!PyList_Check(seq)) {
3211         PyErr_BadInternalCall();
3212         return NULL;
3213     }
3214     it = PyObject_GC_New(listiterobject, &PyListIter_Type);
3215     if (it == NULL)
3216         return NULL;
3217     it->it_index = 0;
3218     Py_INCREF(seq);
3219     it->it_seq = (PyListObject *)seq;
3220     _PyObject_GC_TRACK(it);
3221     return (PyObject *)it;
3222 }
3223 
3224 static void
listiter_dealloc(listiterobject * it)3225 listiter_dealloc(listiterobject *it)
3226 {
3227     _PyObject_GC_UNTRACK(it);
3228     Py_XDECREF(it->it_seq);
3229     PyObject_GC_Del(it);
3230 }
3231 
3232 static int
listiter_traverse(listiterobject * it,visitproc visit,void * arg)3233 listiter_traverse(listiterobject *it, visitproc visit, void *arg)
3234 {
3235     Py_VISIT(it->it_seq);
3236     return 0;
3237 }
3238 
3239 static PyObject *
listiter_next(listiterobject * it)3240 listiter_next(listiterobject *it)
3241 {
3242     PyListObject *seq;
3243     PyObject *item;
3244 
3245     assert(it != NULL);
3246     seq = it->it_seq;
3247     if (seq == NULL)
3248         return NULL;
3249     assert(PyList_Check(seq));
3250 
3251     if (it->it_index < PyList_GET_SIZE(seq)) {
3252         item = PyList_GET_ITEM(seq, it->it_index);
3253         ++it->it_index;
3254         Py_INCREF(item);
3255         return item;
3256     }
3257 
3258     it->it_seq = NULL;
3259     Py_DECREF(seq);
3260     return NULL;
3261 }
3262 
3263 static PyObject *
listiter_len(listiterobject * it,PyObject * Py_UNUSED (ignored))3264 listiter_len(listiterobject *it, PyObject *Py_UNUSED(ignored))
3265 {
3266     Py_ssize_t len;
3267     if (it->it_seq) {
3268         len = PyList_GET_SIZE(it->it_seq) - it->it_index;
3269         if (len >= 0)
3270             return PyLong_FromSsize_t(len);
3271     }
3272     return PyLong_FromLong(0);
3273 }
3274 
3275 static PyObject *
listiter_reduce(listiterobject * it,PyObject * Py_UNUSED (ignored))3276 listiter_reduce(listiterobject *it, PyObject *Py_UNUSED(ignored))
3277 {
3278     return listiter_reduce_general(it, 1);
3279 }
3280 
3281 static PyObject *
listiter_setstate(listiterobject * it,PyObject * state)3282 listiter_setstate(listiterobject *it, PyObject *state)
3283 {
3284     Py_ssize_t index = PyLong_AsSsize_t(state);
3285     if (index == -1 && PyErr_Occurred())
3286         return NULL;
3287     if (it->it_seq != NULL) {
3288         if (index < 0)
3289             index = 0;
3290         else if (index > PyList_GET_SIZE(it->it_seq))
3291             index = PyList_GET_SIZE(it->it_seq); /* iterator exhausted */
3292         it->it_index = index;
3293     }
3294     Py_RETURN_NONE;
3295 }
3296 
3297 /*********************** List Reverse Iterator **************************/
3298 
3299 typedef struct {
3300     PyObject_HEAD
3301     Py_ssize_t it_index;
3302     PyListObject *it_seq; /* Set to NULL when iterator is exhausted */
3303 } listreviterobject;
3304 
3305 static void listreviter_dealloc(listreviterobject *);
3306 static int listreviter_traverse(listreviterobject *, visitproc, void *);
3307 static PyObject *listreviter_next(listreviterobject *);
3308 static PyObject *listreviter_len(listreviterobject *, PyObject *);
3309 static PyObject *listreviter_reduce(listreviterobject *, PyObject *);
3310 static PyObject *listreviter_setstate(listreviterobject *, PyObject *);
3311 
3312 static PyMethodDef listreviter_methods[] = {
3313     {"__length_hint__", (PyCFunction)listreviter_len, METH_NOARGS, length_hint_doc},
3314     {"__reduce__", (PyCFunction)listreviter_reduce, METH_NOARGS, reduce_doc},
3315     {"__setstate__", (PyCFunction)listreviter_setstate, METH_O, setstate_doc},
3316     {NULL,              NULL}           /* sentinel */
3317 };
3318 
3319 PyTypeObject PyListRevIter_Type = {
3320     PyVarObject_HEAD_INIT(&PyType_Type, 0)
3321     "list_reverseiterator",                     /* tp_name */
3322     sizeof(listreviterobject),                  /* tp_basicsize */
3323     0,                                          /* tp_itemsize */
3324     /* methods */
3325     (destructor)listreviter_dealloc,            /* tp_dealloc */
3326     0,                                          /* tp_vectorcall_offset */
3327     0,                                          /* tp_getattr */
3328     0,                                          /* tp_setattr */
3329     0,                                          /* tp_as_async */
3330     0,                                          /* tp_repr */
3331     0,                                          /* tp_as_number */
3332     0,                                          /* tp_as_sequence */
3333     0,                                          /* tp_as_mapping */
3334     0,                                          /* tp_hash */
3335     0,                                          /* tp_call */
3336     0,                                          /* tp_str */
3337     PyObject_GenericGetAttr,                    /* tp_getattro */
3338     0,                                          /* tp_setattro */
3339     0,                                          /* tp_as_buffer */
3340     Py_TPFLAGS_DEFAULT | Py_TPFLAGS_HAVE_GC,/* tp_flags */
3341     0,                                          /* tp_doc */
3342     (traverseproc)listreviter_traverse,         /* tp_traverse */
3343     0,                                          /* tp_clear */
3344     0,                                          /* tp_richcompare */
3345     0,                                          /* tp_weaklistoffset */
3346     PyObject_SelfIter,                          /* tp_iter */
3347     (iternextfunc)listreviter_next,             /* tp_iternext */
3348     listreviter_methods,                /* tp_methods */
3349     0,
3350 };
3351 
3352 /*[clinic input]
3353 list.__reversed__
3354 
3355 Return a reverse iterator over the list.
3356 [clinic start generated code]*/
3357 
3358 static PyObject *
list___reversed___impl(PyListObject * self)3359 list___reversed___impl(PyListObject *self)
3360 /*[clinic end generated code: output=b166f073208c888c input=eadb6e17f8a6a280]*/
3361 {
3362     listreviterobject *it;
3363 
3364     it = PyObject_GC_New(listreviterobject, &PyListRevIter_Type);
3365     if (it == NULL)
3366         return NULL;
3367     assert(PyList_Check(self));
3368     it->it_index = PyList_GET_SIZE(self) - 1;
3369     Py_INCREF(self);
3370     it->it_seq = self;
3371     PyObject_GC_Track(it);
3372     return (PyObject *)it;
3373 }
3374 
3375 static void
listreviter_dealloc(listreviterobject * it)3376 listreviter_dealloc(listreviterobject *it)
3377 {
3378     PyObject_GC_UnTrack(it);
3379     Py_XDECREF(it->it_seq);
3380     PyObject_GC_Del(it);
3381 }
3382 
3383 static int
listreviter_traverse(listreviterobject * it,visitproc visit,void * arg)3384 listreviter_traverse(listreviterobject *it, visitproc visit, void *arg)
3385 {
3386     Py_VISIT(it->it_seq);
3387     return 0;
3388 }
3389 
3390 static PyObject *
listreviter_next(listreviterobject * it)3391 listreviter_next(listreviterobject *it)
3392 {
3393     PyObject *item;
3394     Py_ssize_t index;
3395     PyListObject *seq;
3396 
3397     assert(it != NULL);
3398     seq = it->it_seq;
3399     if (seq == NULL) {
3400         return NULL;
3401     }
3402     assert(PyList_Check(seq));
3403 
3404     index = it->it_index;
3405     if (index>=0 && index < PyList_GET_SIZE(seq)) {
3406         item = PyList_GET_ITEM(seq, index);
3407         it->it_index--;
3408         Py_INCREF(item);
3409         return item;
3410     }
3411     it->it_index = -1;
3412     it->it_seq = NULL;
3413     Py_DECREF(seq);
3414     return NULL;
3415 }
3416 
3417 static PyObject *
listreviter_len(listreviterobject * it,PyObject * Py_UNUSED (ignored))3418 listreviter_len(listreviterobject *it, PyObject *Py_UNUSED(ignored))
3419 {
3420     Py_ssize_t len = it->it_index + 1;
3421     if (it->it_seq == NULL || PyList_GET_SIZE(it->it_seq) < len)
3422         len = 0;
3423     return PyLong_FromSsize_t(len);
3424 }
3425 
3426 static PyObject *
listreviter_reduce(listreviterobject * it,PyObject * Py_UNUSED (ignored))3427 listreviter_reduce(listreviterobject *it, PyObject *Py_UNUSED(ignored))
3428 {
3429     return listiter_reduce_general(it, 0);
3430 }
3431 
3432 static PyObject *
listreviter_setstate(listreviterobject * it,PyObject * state)3433 listreviter_setstate(listreviterobject *it, PyObject *state)
3434 {
3435     Py_ssize_t index = PyLong_AsSsize_t(state);
3436     if (index == -1 && PyErr_Occurred())
3437         return NULL;
3438     if (it->it_seq != NULL) {
3439         if (index < -1)
3440             index = -1;
3441         else if (index > PyList_GET_SIZE(it->it_seq) - 1)
3442             index = PyList_GET_SIZE(it->it_seq) - 1;
3443         it->it_index = index;
3444     }
3445     Py_RETURN_NONE;
3446 }
3447 
3448 /* common pickling support */
3449 
3450 static PyObject *
listiter_reduce_general(void * _it,int forward)3451 listiter_reduce_general(void *_it, int forward)
3452 {
3453     PyObject *list;
3454 
3455     /* _PyEval_GetBuiltin can invoke arbitrary code,
3456      * call must be before access of iterator pointers.
3457      * see issue #101765 */
3458 
3459     /* the objects are not the same, index is of different types! */
3460     if (forward) {
3461         PyObject *iter = _PyEval_GetBuiltin(&_Py_ID(iter));
3462         if (!iter) {
3463             return NULL;
3464         }
3465         listiterobject *it = (listiterobject *)_it;
3466         if (it->it_seq) {
3467             return Py_BuildValue("N(O)n", iter, it->it_seq, it->it_index);
3468         }
3469         Py_DECREF(iter);
3470     } else {
3471         PyObject *reversed = _PyEval_GetBuiltin(&_Py_ID(reversed));
3472         if (!reversed) {
3473             return NULL;
3474         }
3475         listreviterobject *it = (listreviterobject *)_it;
3476         if (it->it_seq) {
3477             return Py_BuildValue("N(O)n", reversed, it->it_seq, it->it_index);
3478         }
3479         Py_DECREF(reversed);
3480     }
3481     /* empty iterator, create an empty list */
3482     list = PyList_New(0);
3483     if (list == NULL)
3484         return NULL;
3485     return Py_BuildValue("N(N)", _PyEval_GetBuiltin(&_Py_ID(iter)), list);
3486 }
3487