8437 Commits

Author SHA1 Message Date
Petr Viktorin
fdac87ae39
[3.13] gh-127773: Disable attribute cache on incompatible MRO entries (GH-127924) (GH-143729) 2026-01-26 16:31:52 +01:00
Miss Islington (bot)
7bca3dd1e6
[3.13] gh-102809: No longer mention Misc/gdbinit in the code (GH-143980) (#144045)
gh-102809: No longer mention `Misc/gdbinit` in the code (GH-143980)

Fix misleading comment on `PyObject_Dump`.
(cherry picked from commit f84ea1107170988742fbd350123678a5c503c1ad)

Co-authored-by: Bartosz Sławecki <bartosz@ilikepython.com>
2026-01-19 17:59:44 +00:00
sobolevn
aa5ad50597
[3.13] gh-143635: Fix crash in ga_repr_items_list (GH-143670) (#143852)
(cherry picked from commit bdba5f0db2ab29f3deedb9416f3c143d33e4ab66)
2026-01-15 15:27:31 +00:00
Serhiy Storchaka
5c028df404
[3.13] gh-141805: Fix crash after concurrent addition objects with the same hash to set (GH-143815) (GH-143853)
This happens when the set contained several elements with the same hash,
and then some of them were removed.
(cherry picked from commit b8e925b4f8f6c5e28fbebc4f3965bf77610698b3)
2026-01-15 07:59:15 +00:00
Inada Naoki
b739bd1d42
[3.13] gh-143189: fix insertdict() for non-Unicode key (GH-143285) (#143772) 2026-01-13 10:12:38 +00:00
Miss Islington (bot)
b2a2dcda3a
[3.13] Remove outdated comment about excess_args warning in object.__init__ (GH-143669) (#143681)
Remove outdated comment about `excess_args` warning in `object.__init__` (GH-143669)

The code emitting a warning was removed in 96384b93aae1d1e45dda21c4024d7d083c91626d.
(cherry picked from commit 03e6457096d452859fb4cfd418dc9268c6454c29)

Co-authored-by: Manuel Jacob <me@manueljacob.de>
2026-01-11 07:49:37 +00:00
Serhiy Storchaka
618a42410f
[3.13] gh-143006: Fix and optimize mixed comparison of float and int (GH-143084) (GH-143624)
When comparing negative non-integer float and int with the same number
of bits in the integer part, __neg__() in the int subclass returning
not an int caused an assertion error.

Now the integer is no longer negated. Also, reduced the number of
temporary created Python objects.
(cherry picked from commit 66bca383bd3b12d21e879d991d77b37a4c638f88)
2026-01-09 17:43:35 +00:00
Miss Islington (bot)
5af09f500b
[3.13] gh-143089: Fix ParamSpec default examples to use list instead of tuple (GH-143179) (#143539)
Co-authored-by: VanshAgarwal24036 <148854295+VanshAgarwal24036@users.noreply.github.com>
2026-01-08 11:49:43 +00:00
Stan Ulbrych
e0e255e244
[3.13] gh-143003: Fix possible shared buffer overflow in bytearray.extend() (GH-143086) (GH-143448)
When __length_hint__() returns 0 for non-empty iterator, the data can be
written past the shared 0-terminated buffer, corrupting it.
(cherry picked from commit 522563549a49d28e763635c58274a23a6055f041)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
2026-01-06 13:49:31 +02:00
Bénédikt Tran
19fda670d6
[3.13] gh-142557: fix UAF in bytearray.__mod__ when object is mutated while formatting %-style arguments (GH-143213) (#143229)
(cherry picked from commit 61ee04834b096be00678c6819b4957f3f4413a5e)
2025-12-27 17:20:49 +00:00
Miss Islington (bot)
b3a0d15e3b
[3.13] gh-142664: fix PyObject_Hash invokation post GH-143217 (GH-143223) (#143225)
gh-142664: fix `PyObject_Hash` invokation post GH-143217 (GH-143223)
(cherry picked from commit 84fcdbd86ecd81f7cc793e22268a029ac6cf29c2)

Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>
2025-12-27 14:53:13 +00:00
Bénédikt Tran
4fcb1d9819
[3.13] gh-142664: fix UAF in memoryview.__hash__ via re-entrant data's __hash__ (GH-143217) (#143222)
(cherry picked from commit 00e24b80e092e7d36dc189fd260b2a4e730a6e7f)
2025-12-27 13:43:11 +00:00
Bénédikt Tran
8aca2fd87c
[3.13] gh-143195: fix UAF in {bytearray,memoryview}.hex(sep) via re-entrant sep.__len__ (GH-143209) (#143220)
(cherry picked from commit 9976c2b6349a079ae39931d960b8c147e21c6c3f)
2025-12-27 12:58:42 +00:00
Cody Maloney
a9e068f0be
[3.13] gh-142560: prevent use-after-free in search-like methods by exporting buffer in bytearray (GH-142938) (GH-142986)
(cherry picked from commit 220f0b107776391201a399c54dd01692c36fcdf4)

Co-authored-by: wangxiaolei <fatelei@gmail.com>
2025-12-24 19:13:47 +00:00
Mikhail Efimov
4504ff89d5
[3.13] gh-140373: Correctly emit PY_UNWIND event when generator is closed (GH-140767) (#140821) 2025-12-20 16:21:11 +02:00
Sam Gross
db552ddb1e
[3.13] gh-142766: Clear frame when generator.close() is called (gh-142838) (#142900)
(cherry picked from commit 25397f9541be89264d35d41a67defcfeaa950844)
2025-12-17 18:46:23 +00:00
Bartosz Sławecki
3e45440382
[3.13] gh-142737: Handle lost io.open in _Py_FindSourceFile (GH-142747) (GH-142774)
(cherry picked from commit f277781bba684322dffffe45cd878f4652ccf7e4)
2025-12-15 23:27:15 +00:00
Bénédikt Tran
2249043874
[3.13] gh-142554: avoid divmod crashes due to bad _pylong.int_divmod (GH-142673) (#142697)
gh-142554: avoid `divmod` crashes due to bad `_pylong.int_divmod` (#142673)

(cherry picked from commit 4e4163676add8caab2dec6cdb93e1b317cf02a2e)
2025-12-14 09:03:14 +00:00
dr-carlos
d768900ca4
[3.13] gh-141732: Fix ExceptionGroup repr changing when original exception sequence is mutated (GH-141736) (#142391)
* [3.13] gh-141732: Fix `ExceptionGroup` repr changing when original exception sequence is mutated (GH-141736)
(cherry picked from commit ff2577f56eb2170ef0afafa90f78c693df7ca562)

Co-authored-by: dr-carlos <77367421+dr-carlos@users.noreply.github.com>
2025-12-08 18:46:55 +00:00
Sam Gross
1a75c0fb05
[3.13] gh-142218: Fix split table dictionary crash (gh-142229) (gh-142245)
This fixes a regression introduced in gh-140558. The interpreter would
crash if we inserted a non `str` key into a split table that matches an
existing key.
(cherry picked from commit 547d8daf780646e2800bec598ed32085817c8606)
2025-12-04 07:46:24 +00:00
Sergey Miryanov
cbeada9ec7
[3.13] GH-141312: Allow only integers to longrangeiter_setstate state (GH-141317) (GH-141568)
This fixes an assertion error when the new computed start is not an integer.
(cherry picked from commit 10bec7c1eb3ee27f490a067426eef452b15f78f9)
2025-11-15 21:14:17 +02:00
Stan Ulbrych
f1a93727c4
[3.13] gh-140939: Fix memory leak in _PyBytes_FormatEx error path (GH-140957) (#141155)
(cherry picked from commit d6c89a2df2c8b7603125883494e9058a88348f66)
2025-11-06 16:16:43 +00:00
Victor Stinner
43882c7c4e
[3.13] gh-140815: Fix faulthandler for invalid/freed frame (#140921) (#140985)
gh-140815: Fix faulthandler for invalid/freed frame (#140921)

faulthandler now detects if a frame or a code object is invalid or
freed.

Add helper functions:

* _PyCode_SafeAddr2Line()
* _PyFrame_SafeGetCode()
* _PyFrame_SafeGetLasti()

_PyMem_IsPtrFreed() now detects pointers in [-0xff, 0xff] range
as freed.

(cherry picked from commit a84181c31bfc45a1d6bcb1296bd298ad612c54d0)
2025-11-05 18:39:28 +01:00
Mikhail Efimov
eec9257aa5
[3.13] gh-140551: Fix dict crash if clear is called at lookup stage (GH-140558) (#140744)
* gh-140551: Fix `dict` crash if `clear` is called at `lookup` stage (#140558)

Co-authored-by: Inada Naoki <songofacandy@gmail.com>
2025-10-30 22:36:49 +05:30
Miss Islington (bot)
30c2661b6e
[3.13] gh-132835: Add defensive NULL checks to MRO resolution (GH-134763) (GH-140437)
Currently, there are a few places where tp_mro could theoretically
become NULL, but do not in practice. This commit adds defensive checks for
NULL values to ensure that any changes do not introduce a crash and that
state invariants are upheld.

The assertions added in this commit are all instances where a NULL value would get passed to something not expecting a NULL, so it is better to catch an assertion failure than crash later on.

There are a few cases where it is OK for the return of lookup_tp_mro to be NULL, such as when passed to is_subtype_with_mro, which handles this explicitly.
(cherry picked from commit a8edca62fc6d44d16c7f86d49421be1a5ebea3e5)

Co-authored-by: Emma Smith <emma@emmatyping.dev>
2025-10-21 20:44:42 -07:00
Peter Bierma
69230d1c56
[3.13] gh-140406: Fix memory leak upon __hash__ returning a non-integer (GH-140411) (GH-140441)
* gh-140406: Fix memory leak upon `__hash__` returning a non-integer (GH-140411)

(cherry picked from commit 71db05a12d9953a96f809d84b4d0d452a464e431)
2025-10-22 01:07:32 +00:00
Miss Islington (bot)
7992a29512
[3.13] GH-140058: Clear key and value if PyTuple_New fails in dictiter_iternextitem (GH-140059) (#140108)
GH-140058: Clear key and value if `PyTuple_New` fails in `dictiter_iternextitem` (GH-140059)
(cherry picked from commit ded59f7e8e93274488584574ff2336a98bc4eff6)

Co-authored-by: Sergey Miryanov <sergey.miryanov@gmail.com>
2025-10-14 13:40:13 +00:00
Mikhail Efimov
cbcee9a0f0
[3.13] gh-140000: Traverse name attribute for TypeVar, TypeVarTuple, TypeAliasType, ParamSpec (GH-140016) (#140073)
Correct traversing name attribute for TypeVar, TypeVarTuple, TypeAliasType, ParamSpec
2025-10-13 20:02:32 -07:00
Miss Islington (bot)
2fd8f036c0
[3.13] gh-138902: Fix generator send arg name (GH-138905) (#138913)
gh-138902: Fix generator send arg name (GH-138905)
(cherry picked from commit cb07bd24eed43a0ac182e664398398164089f294)

Co-authored-by: Marat Khagazheev <marathagazeev@gmail.com>
Co-authored-by: marat <khagazheev@artlebedev.ru>
2025-09-15 11:35:22 +00:00
Stan Ulbrych
0b302280af
[3.13] gh-71648: Optimize PNG files (GH-138842) (#138852)
* Only keep > 1 kb savings
(cherry picked from commit 2e8f64c9317a327a2be1ab8031844ef3967c1040)
2025-09-14 08:29:59 -07:00
Miss Islington (bot)
a9020589de
[3.13] gh-71810: Fix _PyLong_AsByteArray() undefined behavior (GH-138873) (#138884)
gh-71810: Fix _PyLong_AsByteArray() undefined behavior (GH-138873)

Don't read p[-1] when p is an empty string: when n==0.
(cherry picked from commit 8b5ce31c2b44d9bf82e6119e90a52dd530bfd1db)

Co-authored-by: Victor Stinner <vstinner@python.org>
2025-09-14 09:49:23 +00:00
Peter Bierma
e7720612ea
[3.13] gh-138479: Ensure that __typing_subst__ returns a tuple (GH-138482) (GH-138786)
* gh-138479: Ensure that `__typing_subst__` returns a tuple (GH-138482)

Raise an exception if __typing_subst__ returns a non-tuple object.

(cherry picked from commit 1da989be74eaa94590ec28e750e5352de1ead227)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
2025-09-11 11:08:57 +00:00
Miss Islington (bot)
7195d7f3d4
[3.13] gh-71810: Fix corner case (length==0) for int.to_bytes() (GH-138739) (#138783)
gh-71810: Fix corner case (length==0) for int.to_bytes() (GH-138739)

```pycon
>>> (0).to_bytes(0, 'big', signed=True)
b''
>>> (-1).to_bytes(0, 'big', signed=True)  # was b''
Traceback (most recent call last):
  File "<python-input-0>", line 1, in <module>
    (-1).to_bytes(0, 'big', signed=True)
    ~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^
OverflowError: int too big to convert
```
(cherry picked from commit 011179a79a0d7b93ce074b25b0819e96b6dd3315)

Co-authored-by: Sergey B Kirpichev <skirpichev@gmail.com>
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
2025-09-11 10:53:27 +00:00
sobolevn
d3b6bb1125
[3.13] gh-105487: Fix __dir__ entries of GenericAlias (GH-138578) (#138640)
(cherry picked from commit b0420b505e6c9bbc8418e0f6240835ea777137b5)

Co-authored-by: Emma Smith <emma@emmatyping.dev>
2025-09-08 10:03:03 +00:00
Miss Islington (bot)
f0756f8fa1
[3.13] gh-138516: fix typo in OrderedDict exception msg (GH-138517) (#138522)
gh-138516: fix typo in OrderedDict exception msg (GH-138517)
(cherry picked from commit e9c2a357fba72e46e965ecaa54e78be69c6c5d6b)

Co-authored-by: asas1asas200 <asas1asas200@gmail.com>
2025-09-05 07:19:43 +00:00
Miss Islington (bot)
f2d6931656
[3.13] gh-58124: Avoid CP_UTF8 in UnicodeDecodeError (GH-137415) (#137461)
gh-58124: Avoid CP_UTF8 in UnicodeDecodeError (GH-137415)

Fix name of the Python encoding in Unicode errors of the code page
codec: use "cp65000" and "cp65001" instead of "CP_UTF7" and "CP_UTF8"
which are not valid Python code names.
(cherry picked from commit ce1b747ff68754635b7b12870dfc527184ee3b39)

Co-authored-by: Victor Stinner <vstinner@python.org>
2025-08-06 12:59:11 +00:00
Neil Schemenauer
5c16f699d2
[3.13] GH-133136: Revise QSBR to reduce excess memory held (gh-135473) (gh-136480)
The free threading build uses QSBR to delay the freeing of dictionary
keys and list arrays when the objects are accessed by multiple threads
in order to allow concurrent reads to proceed with holding the object
lock. The requests are processed in batches to reduce execution
overhead, but for large memory blocks this can lead to excess memory
usage.

Take into account the size of the memory block when deciding when to
process QSBR requests.

Also track the amount of memory being held by QSBR for mimalloc pages.
Advance the write sequence if this memory exceeds a limit.  Advancing
the sequence will allow it to be freed more quickly.

Process the held QSBR items from the "eval breaker", rather than from
`_PyMem_FreeDelayed()`.  This gives a higher chance that the global read
sequence has advanced enough so that items can be freed.

(cherry picked from commit 113de8545ffe74a4a1dddb9351fa1cbd3562b621)

Co-authored-by: Neil Schemenauer <nas-github@arctrix.com>
Co-authored-by: Sam Gross <colesbury@gmail.com>
2025-07-30 11:06:44 -07:00
Duane Griffin
2383c6015c
[3.13] gh-127971: fix off-by-one read beyond the end of a string during search (#132574) (#136648)
(cherry picked from commit 85ec3b3b503ffd5b7e45f8b3fa2cec0c10e4bef0)
2025-07-14 11:50:22 +02:00
Kumar Aditya
823bf76d37
[3.13] gh-109700: fix memory error handling in PyDict_SetDefault (#136338) (#136642)
gh-109700: fix memory error handling in `PyDict_SetDefault` (#136338)

(cherry picked from commit d22e073d2b49313bbf42d40cbe74afa2b69385df)
2025-07-14 08:25:31 +00:00
Bénédikt Tran
360540fd47
[3.13] gh-91153: prevent a crash in bytearray.__setitem__(ind, ...) when ind.__index__ has side-effects (GH-132379) (#136582)
(cherry picked from commit 5e1e21dee35b8e9066692d08033bbbdb562e2c28)

Co-authored-by: Bast <52266665+bast0006@users.noreply.github.com>
2025-07-12 16:34:45 +02:00
Victor Stinner
e3a277c8d8
[3.13] gh-135607: remove null checking of weakref list in dealloc of extension modules and objects (#135614) (#136126)
gh-135607: remove null checking of weakref list in dealloc of extension modules and objects (#135614)

(cherry picked from commit b1056c2a446b43452e457d5fd5f1bde66afd3883)

Co-authored-by: Xuanteng Huang <44627253+xuantengh@users.noreply.github.com>
Co-authored-by: Kumar Aditya <kumaraditya@python.org>
2025-07-01 11:26:52 +02:00
Serhiy Storchaka
3576e1a954
[3.13] gh-78465: Fix error message for cls.__new__(cls, ...) where cls is not instantiable (GH-135981) (GH-136031)
Previous error message suggested to use cls.__new__(), which
obviously does not work. Now the error message is the same as for
cls(...).
(cherry picked from commit c45f4f3ebe34529a8db3a7918e8dd2e9f7ce8e86)
2025-06-27 12:07:22 +00:00
Miss Islington (bot)
469f69d4e2
[3.13] gh-135878: Fix crash in types.SimpleNamespace.__repr__ (GH-135889) (#135895)
gh-135878: Fix crash in `types.SimpleNamespace.__repr__` (GH-135889)
(cherry picked from commit b3ab94acd308591bbdf264f1722fedc7ee25d6fa)

Co-authored-by: sobolevn <mail@sobolevn.me>
Co-authored-by: Peter Bierma <zintensitydev@gmail.com>
2025-06-24 16:59:29 +00:00
Sam Gross
f33a5e891a
[3.13] gh-132617: Fix dict.update() mutation check (gh-134815) (gh-135582)
Use `ma_used` instead of `ma_keys->dk_nentries` for modification check
so that we only check if the dictionary is modified, not if new keys are
added to a different dictionary that shared the same keys object.
(cherry picked from commit d8994b0a77cc9821772d05db00a6ab23382fa17d)
2025-06-16 17:30:52 +00:00
Mikhail Efimov
e753a7c5f0
[3.13] gh-125723: Fix crash with f_locals when generator frame outlive their generator (GH-135453)
Backport of 8e20e42cc63321dacc500d7670bfc225ca04e78b from GH-126956

Closes GH-125723
2025-06-14 04:08:03 +10:00
Serhiy Storchaka
3e1b8d6e67
[3.13] gh-133489: Remove size restrictions on getrandbits() and randbytes() (GH-133658) (GH-134965)
random.getrandbits() can now generate more that 2**31 bits.
random.randbytes() can now generate more that 256 MiB.
(cherry picked from commit 68784fed78aa297f0de0d038742495709185bef5)
2025-06-02 23:16:30 +03:00
Serhiy Storchaka
6279eb8c07
[3.13] gh-133767: Fix use-after-free in the unicode-escape decoder with an error handler (GH-129648) (GH-133944)
If the error handler is used, a new bytes object is created to set as
the object attribute of UnicodeDecodeError, and that bytes object then
replaces the original data. A pointer to the decoded data will became invalid
after destroying that temporary bytes object. So we need other way to return
the first invalid escape from _PyUnicode_DecodeUnicodeEscapeInternal().

_PyBytes_DecodeEscape() does not have such issue, because it does not
use the error handlers registry, but it should be changed for compatibility
with _PyUnicode_DecodeUnicodeEscapeInternal().
(cherry picked from commit 9f69a58623bd01349a18ba0c7a9cb1dad6a51e8e)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
2025-05-20 14:46:57 +02:00
Sam Gross
e1cc789531
gh-132869: Fix crash in _PyObject_TryGetInstanceAttribute (#133700)
This fixes a crash in `_PyObject_TryGetInstanceAttribute` due to the use
of `_PyDictKeys_StringLookup` on an unlocked dictionary that may be
concurrently modified.

The underlying bug was already fixed in 3.14 and the main branch.

(partially cherry picked from commit 1b15c89a17ca3de6b05de5379b8717e9738c51ef)
2025-05-14 12:47:34 +09:00
Brandt Bucher
50b45c4f45
[3.13] GH-133543: Maintain tracking for materialized instance dictionaries (GH-133617) 2025-05-12 13:00:01 -07:00
Inada Naoki
f0a88e2ce5
gh-133703: dict: fix calculate_log2_keysize() (GH-133809)
(cherry picked from commit 92337f666e8a076a68305a8d6dc8bc9c095000e9)
2025-05-11 15:14:11 +09:00