1714 static PyObject *
1715 bucket_repr(Bucket *self)
1716 {
1717     PyObject *i, *r;
1718     char repr[10000];
1719     int rv;
1720 
1721     i = bucket_items(self, NULL, NULL);
when bucket_items() succeeds
1722     if (!i)
taking False path
1723 	return NULL;
1724     r = PyObject_Repr(i);
when PyObject_Repr() succeeds
PyStringObject allocated at:     r = PyObject_Repr(i);
ob_refcnt is now refs: 1 + N where N >= 0
1725     Py_DECREF(i);
when taking True path
1726     if (!r) {
taking False path
1727 	return NULL;
1728     }
1729     rv = PyOS_snprintf(repr, sizeof(repr),
1730 		       "%s(%s)", self->ob_type->tp_name,
1731 		       PyString_AS_STRING(r));
1732     if (rv > 0 && rv < sizeof(repr)) {
when considering range: 9999 <= value <= 0x7ffffffe
taking False path
1733 	Py_DECREF(r);
1734 	return PyString_FromStringAndSize(repr, strlen(repr));
1735     }
1736     else {
1737 	/* The static buffer wasn't big enough */
1738 	int size;
1739 	PyObject *s;
1740 
1741 	/* 3 for the parens and the null byte */
1742 	size = strlen(self->ob_type->tp_name) + PyString_GET_SIZE(r) + 3;
1743 	s = PyString_FromStringAndSize(NULL, size);
when PyString_FromStringAndSize() fails
1744 	if (!s) {
taking True path
1745 	    Py_DECREF(r);
when taking True path
ob_refcnt is now refs: 0 + N where N >= 0
1746 	    return r;
1747 	}
1748 	PyOS_snprintf(PyString_AS_STRING(s), size,
1749 		      "%s(%s)", self->ob_type->tp_name, PyString_AS_STRING(r));
1750 	Py_DECREF(r);
1751 	return s;
1752     }
1753 }
ob_refcnt of return value is 1 too low
was expecting final ob_refcnt to be N + 1 (for some unknown N)
due to object being referenced by: return value
but final ob_refcnt is N + 0
found 1 similar trace(s) to this

1714 static PyObject *
1715 bucket_repr(Bucket *self)
1716 {
1717     PyObject *i, *r;
1718     char repr[10000];
1719     int rv;
1720 
1721     i = bucket_items(self, NULL, NULL);
when bucket_items() succeeds
1722     if (!i)
taking False path
1723 	return NULL;
1724     r = PyObject_Repr(i);
when PyObject_Repr() succeeds
1725     Py_DECREF(i);
when taking True path
1726     if (!r) {
taking False path
1727 	return NULL;
1728     }
1729     rv = PyOS_snprintf(repr, sizeof(repr),
1730 		       "%s(%s)", self->ob_type->tp_name,
1731 		       PyString_AS_STRING(r));
1732     if (rv > 0 && rv < sizeof(repr)) {
when considering range: 9999 <= value <= 0x7ffffffe
taking False path
1733 	Py_DECREF(r);
1734 	return PyString_FromStringAndSize(repr, strlen(repr));
1735     }
1736     else {
1737 	/* The static buffer wasn't big enough */
1738 	int size;
1739 	PyObject *s;
1740 
1741 	/* 3 for the parens and the null byte */
1742 	size = strlen(self->ob_type->tp_name) + PyString_GET_SIZE(r) + 3;
1743 	s = PyString_FromStringAndSize(NULL, size);
when PyString_FromStringAndSize() fails
1744 	if (!s) {
taking True path
1745 	    Py_DECREF(r);
when taking False path
calling tp_dealloc on PyStringObject allocated at src/BTrees/BucketTemplate.c:1724
memory deallocated here
1746 	    return r;
1747 	}
1748 	PyOS_snprintf(PyString_AS_STRING(s), size,
1749 		      "%s(%s)", self->ob_type->tp_name, PyString_AS_STRING(r));
1750 	Py_DECREF(r);
1751 	return s;
1752     }
1753 }
returning pointer to deallocated memory
found 1 similar trace(s) to this